Hello everyone. In this video. I'm going to be taking a look at
testing. The various payloads that we generated the
target systems were going to be using going to be Windows 7 and
Windows 10. And yeah, without
any further Ado, let's get started. So before
we actually get started, I just want to explain a few
things regarding our attack Vector. Now,
this is not really a complicated or
real attack in, you know, if I
were to use the the common terms to explain it.
Primarily because we are in the early
stages of exploitation. We want to test our payloads, to
see if they'll actually work. Now, when we move on
to using, you know, Frameworks like Veil evasion, which
are great. We will can actually be used to
engineer or to create more sophisticated social
engineering attacks where we can trick users into
executing the 1D payloads, or
we can bind the payload to a legitimate executable like
a setup file for a popular program.
Like a browser like Google Chrome, we can
use multiple techniques, social engineering, 8 techniques
to actually get users to actually click
on on the executables and the
payloads that we've created and therefore get a reverse connection. And
as I said, we'll be taking a look at more advanced attacks
as we move along, where we don't need to make physical contact with
the target. But in this video, we're going to be doing it manually.
And the reason we're doing this is to is to actually show
you the difference between the encoded payload and
Unencoded payload, and now the various antivirus Solutions
respond. So without further Ado, let's get
started. Now. I'm going to head over into my into my
encoded payload directory. So msf,
Venom payloads, and for a list of
the pillows, we have encoded and the payload EXT right
over here. So we'll start off
with the Windows 7 virtual machine. The first thing we need
to do is we need to get these payloads on to the Target system. One
way we can do that is by setting up a web server.
Over and then nevitt, navigating to that web server downloading, the
files manually on the Target and executing them, right?
So we can do that really simply by either setting up Apache or
we can use the simple python module, simple
HTTP server to set up a very quick and robust
web server. So to do that we need to say python
M and this net requires root privileges. So we say, sudo python
em, and we say simple HTTP
server and we can then use the tab auto-completion
and we specify the port we want to listen.
This will say Port 80 and it's
going to. As you can see, it's going to serve all the files within this
directory on Port, 80 on the Kali
Linux virtual machine. And in this case, if I open up
a new tab and I just list out my IP. You can see it's
10.0.0.0 5. All right. Now before
we actually get into executing
the payloads on the target, we need
to set up our reverse listener, because remember, these payloads
are reverse Shields, which means they're going to connect.
Get back to us. And in order for them to connect back to us.
We need to be listening to them. We need to be listening for them.
And the way we do this is by using the exploit Handler
with the Metasploit console. So I'm going to open up the
Metasploit console here. We'll give that a few seconds. And
once we specify the exploit
Handler, we then need to specify the payload that we use
to generate the various the payloads that
we actually generated. So we just need to specify the
options that we used when we were creating the payload and
The port and the IP that we had specified. So
we say use exploit. This
is used.
Like so and then we specify the payload which we
had used during the creation process. We just set. So
we say, set payload.
And we hit enter, you can see. The payload has been set. So if I
say show options, you can see that
the only options we need to set out the options. We had set when
creating the payload, so we need to just specify in this case the
ellos, which is the Kali Linux IP. So
again, we say set
Hit enter and the ndl port is set by default to
44, 44, which we had already set when
we were creating the payload. So now that we have that running or
now that we have that set, we can now run this and
set up the listener. So you can see it set. It started the reverse TCP,
Handler on the Kali Linux IP, and on
the port 4444. So it's now currently listening for
connections. So now we need to move on to the next stage. Where
we we try and download the payloads on to
the
And 07 Target and execute them and let's see
if we can get a meterpreter session back. Alright, so I'm
just going to open up the Windows 7 VM, which is right over here. And
again, we're going to access the web server that we created
with the simple HTTP server with python and
that is going to be serving the files from the
Kali Linux IP address. So I'll just clear the just get
rid of that and that is under 10.0.0.0 five.
I hit enter, you can see the web survey
set up successfully and we can all start downloading the
Snow by default. I have disable Windows Defender.
So I click on Windows Defender. Right?
Sorry, that is incorrect. Let me just search for Defender. That
is Windows Defender. There we are and
we take a look at tools and
options and real-time protection is
currently enabled, right? So that is going to enable. So I'll
click on encoded or I'll click on the payload first. This
is the unencoded payload. So I'll click on that and I'll
save the file. And then we either open up my downloads folder. The
payload is
Still there, so the antivirus hasn't done much yet. So
I'll run this as administrator hit enter and
the payload is now running. So, how do we know if we've
actually got a reverse shell or a reverse meterpreter
session? If I go back into Kelly, you can see, it's
it sends the stage to the target. The
target has an IP of 10.0.0.0 12
or 12, and we get a meterpreter session
that is opened. And we now have a meterpreter session.
And that is denoted by this meterpreter line.
Write a vso. The meterpreter session essentially
allows us to execute commands on the
system and it gives us remote access. So an example of this is
if I say sis info, this will list out the
information on about the target. So in this case,
you can see it's Windows 7 and gives us information regarding
the service pack, the architecture, the work
group, it belongs to and the meterpreter session. In this case. It's a
32-bit meterpreter session. Now,
you can also get more commands from your meterpreter.
By if by clicking on the help option right
over here, so if I just click on help just open
that up right now. So there we are, we can use
the help option and the help option gives
you all the various commands that you can run. Meterpreter is
an extremely powerful tool. You're able to essentially do
anything and I'll just take you through some of
the important ones. So the first thing we want to take a look at our, the core commands,
the core commands allow us to deal with the
meterpreter session so we can background the session and
have it.
In the background while we try and exploit other machines,
we can also take a look at processes in the background that
are currently running on the target. We can migrate to these
processes. So on and so forth, will take a
look at the other ones for the file system commands.
We can download files or a directory
on to the system. We can also print the working directory,
all the various unix commands that you're familiar with
running. We can also upload files, we can search for files. So
on and so forth. We can also get a shell on
the
Item, which will give us a command prompt remote. Command prompt
V of networking commands. We can take take a look at the
IP configuration. We can
take a look at the route configuration right over here. We can also take
a look at the standard API system commands, which
allow us to perform some post exploitation techniques, like,
clearing the event, log on Windows. We can
drop a token for impersonation. We
can execute a command, we can get privileges. So
this will, this will essentially
Escalate our privileges automatically we
can get the user ID. So on and so forth. You can reboot
the system. So on and so forth, we can
also then perform some user interface commands like get
the desktop and that will get the
current meterpreter desktop. We can key events and
key events. We can send keystrokes. We can dump the
keystroke buffer or we can start capturing key
strokes. And yeah, so there's tons of commands that
we can actually do. And then of course, when you talk about password commands,
We can perform a hash dump which will dump the contents of
the Sam database. So if I perform hash dump, for example, so
if I say hash dump hit enter, it gives us the
various hashes for all the users on the system. If
I say get system, which will try and elevate
my privileges. You can see it got to the system and
we were successfully able to elevate our privileges using
the named pipe in perseveration. If
I type in get user
ID and I hit enter we now have anti-authority and
Access or administrative access on the system. I
can then hit shell and that will give me a command prompt,
which you should be familiar with their we are and I can then run
commands like so I can then terminate this
and go back into my meterpreter session. As
I said, if I want to background my session, I can say background.
And that is going to background the session. The session is still
running so I can then, you know perform exploits. I can
then also set up other listeners and get other reverse
shells. Basically do anything with Metasploit. While
that session is running in the background. If I type in sessions, you
can see the session is on the active sessions is currently running
and that means I can switch to it at any time to do
that. I say sessions and provide the session ID. In
this case, it's going to be one and I hit enter and you
can see I'm back I say get use
And that list out anti-authority system. So again, we can see
that work successfully and in terms of
Windows 7 Service Pack 1, we read the antivirus
really didn't detect anything which is a good sign. So we
can take a look at the encoded payload and then we'll take a look at
whether we can do this on Windows 10 as well. All
right. So what I will do is I will say exit and
that is going to such that's going to shut down the meterpreter session
and we'll just set up a listener again. And
what we're going to do now is
Let's try and run the encoded payload, which again will not
make much of a difference. So, I'll just delete the payload that
is unencoded and will just download the
encoded payload, right over here. Say file, that's
going to save the encoded one and we'll just run this ad as
administrator. And if we go back, you can
see we get a meterpreter session. And again, there isn't
much of a difference primarily because we're dealing with an older version of
Windows and again, against a get system. And that
should get. In this case. You can see, it's telling us that
This is denied. And that's primarily, I think because we
have obvious gated the payload. So again, if I say
get use ID because we run this,
as the administrator, we still are logged
in as the ie7, user or
the Internet Explorer user. So now you can see that automatic
privilege escalation has failed. We
now need to perform manual privilege escalation, which
is what we're going to be taking a look at in the privilege, the privilege,
escalation section. All right, so we still are able.
Able to get a meterpreter session on Windows 7. So what I'm going to do
now is I'm just going to start up the windows 10 virtual machine and
I will just exit from this session and we can then
test it on the Windows 10 VM.
Alright, so I've set up the windows VM and
it's currently running. So the first thing we want to do is let us
set up the listener on Kelly here and we can all
head over to the windows VM, and we're going
to start off by disabling, the antivirus, firstly and
the antivirus we're going to be using by default is Windows Defender. And
again, the purpose of this video is to just explain
to you the differences, you know, between the encoded on
an encoded payload and then of course, we'll be talking
about more advanced encoders, like
Veil evasion, so, I'll just open up my browser and
you can actually see on Windows Defender. I
currently have that disabled. If I click on virus in threat, protection and
click on manage settings. Real-time detection on
protection is also disabled. Essentially. The
antivirus is disabled, and we're going to be using the encoded
payload because the payload or the unencoded payload
is going to get detected, really
easily. And the encoded payload will work by default,
when Windows Defender, is it is disabled.
So I'll just click on the encoded payload and it's safe and
Windows 10 by default should have very security
features enabled to prevent me from executing this.
So if I could if I double click to run it, it should actually
tell me that Windows is protected my PC, but
again execute it. Anyway, if I click
on Kelly, we still have that listening here. So I'll
just hit run one more time and we get a
meterpreter session again, and this time it successfully looks
like Windows Defender had the schedule and
Enabled, which kept it running in the background. This
one of the problems with Windows. So, there we are. Looks like we
have access and if I dip type in sis info,
you can see we currently have access. We
have Windows 10 and the build number and the architecture 64-bit.
So given that we know the architecture, we
can actually try and migrate to the meterpreter session
because it's currently a 32-bit meterpreter session. We
can migrate it to a 64-bit meterpreter session, which
is much more reliable because the architecture that's
running.
On the system or the, the actual system is
64 bit. So to do this, we need to, we need to
analyze the processes that are running on the Target. And of
course all can list that out by typing in PS and
the process that we're looking for because all processes have
the 64-bit architecture. The process
we are looking for by default is the explorer.exe. This
is the most stable approaches that you can
migrate to when dealing with windows. So I can look for
it right over here. I can look for explorer.exe and
that has a process ID or 5308. So
if we want to migrate to this process, all we
need to type in is migrate and the process ID, which is
listed right over here on the First Column. So, I can type in my great
and I say, 5308 and
I hit enter and that should migrate to that 64-bit process.
And it tells us migration completed successfully.
If I type in sis info, now, you
can now see we have a 64-bit meterpreter session
and again, we can then try and run.
These various other commands so voice a hash dump. You
can see that that is going to fail because we're dealing with a more advanced
newer operating system, in this case, Windows 10.
However, as I've showed you, we can still get a
meterpreter session with the the,
with Windows Defender. Disabled. However,
again, she got a gun, I is now outdated elevator
work on older versions of Windows, like
Windows XP. Windows Vista, Windows 7, Windows Server, 2008
for the latest versions of
Toes, you want to start using other other
encoders, like the veil evasion framework, so on and so forth, which
we'll be covering. So that's pretty much all I wanted to cover
in this video. This was just a very basic foray into
testing. These various payloads that we created and showing you
how to establish a remote connection to your target, how
to, you know, with that. We've taken a look at some of the basic meterpreter
commands will be. Taking a look at a lot more as we
move along, but that's going to be it for this video and I'll be seeing you
in the next video.