Hello everyone. In this video. We're going to be taking a look
at how to bind, how payloads to legitimate executables
also known as
injecting the payload into the executable. And
we're going to be using shelter. Now, in the previous video. I
showed you how to install shelter and using it
is very simple, just as a small word of
caution, when executing show to ensure, you're doing
this using root privileges, or you can use sudo
to do that. So, again, against a shoot pseudo,
And the scenario that we are going to
be using, for this particular, for
this particular example, is I have downloaded the,
I'll just open on my downloads folder on my desktop,
which is where I saved it. I have downloaded WinRAR of
the latest version of WinRAR. This is the 32-bit executable
and we're going to be using this as our host.
So, what we're going to be doing is we're going to be generating a reverse shell
payload, and then injecting it into the WinRAR executable.
And then again, when we do that,
we'll be able then to send it to the Target. We're going to be using the
Windows 7 VM now. And again, I'll just show
you that the the executable will work as normal and
of course, will specify stealth mode. So that it actually
does install, the it does install
the program. In addition to that. It will also execute
the payload. So this, this case is usually great
for performing social engineering attacks where you can sort
of mask executables and
Is payloads within them? So once I launch shelter,
you want to choose your operation more than you want to
go with automatic mode for now because
shelter does have some Advanced options. So I'm going to a
it's going to ask us for the PE Target. And that is
the the actual destination or the path to
the executable that we want to bind the payload with in this
case. It's going to be home Kelly and
it's on the desktop and the executable name
is WinRAR and let me just confirm.
I'm the name here. The WinRAR. 591 .exe. So
say weiner, 591 exe,
hit enter.
And it's going to proceed and it's going to begin the process. To
first of all, it will begin. It
will check if the executable is packed, as I
mentioned, ensure that the executable you select as
your host is not packed and then secondly, it's going
to take a look at the PE info and eliminate any
any information that that
really isn't relevant and then of course it's going to
begin tracing. So you want to give that a few seconds.
It's up to a certain amount of minutes to
actually complete tracing. So, again,
I'm just going to wait for this to complete tracing, as it will take
a few seconds up to a minute and I'll get back to you on that's done.
All right, the tracing process is complete
and you can see, it's going to tell us instructions traced and
it's going to start the first stage filtering, of
course, first stage filtering is complete and we can then enable stealth
mode. So stealth mode essentially allows
the application, the host application. So, in
this case,
Are to be installed as a legitimate application and
of course it's going to execute our payload for us during
that process. So we'll hit yes. We want that. It's now going
to ask us for the payload that we want to use. We can use a meterpreter
session or a reverse session. Just
using bind, or reverse without any
meterpreter functionality. We, of course, want to use the first one,
which is meterpreter reverse TCP. So we'll specify the
list. So, L and then 14 meterpreter reverse
TCP will set our ellos.
To my Kelly IP. So 10.0.0.0. I've
hit enter and the alport. I will set
to 4444 hit enter and
it's not going to begin the compilation process.
So we'll just let that compile and it looks like it
is done. So I'll hit enter and again
the the executable should not be modified and
it's going to be the same executable or that we had on the desktop. So
it's essentially just recompile it
and we can then use this.
So what I'm going to do now is I'm just going to open up the Metasploit
console and we'll set our
exploit multi handle and set the failure to Windows with Deputy
reverse TCP. And then, of course, we will set
up a web server with python using the
python module, simple HTTP server. So pseudo bash
and I'll just
All say python simple and
we want to actually go into our desktop. So desktop there
we are. So python.
Simple HTTP server.
And we want to open that on Port 80. All
right, so we use the exploit multi Handler.
We can insert the payload, too.
Reverse TCP and we show the options here. We
don't need to set the airport because that is the option. We
set earlier. So set L host to
into ethernet 0 that's my interface name.
And there we I'd sit and we can then set up the listener. So
it's going to start the reverse TCP Handler and we
can now download the payload WinRAR or
the application mineral 591 .dx, you know, targets. I'm
just going to open up the Windows 7 VM here and
we'll reload that as if this is on.
HTTP tensor, just open it one more time again.
And there we are. We have the WinRAR exe. So
I'll save the file and that should be downloaded and
there we are. We have WinRAR. It looks exactly like WinRAR.
So again, we can just run it and it's
going to ask us for administrative Privileges and you can see WinRAR the
installer still work so we can actually install that. If we go back
into Kelly we're going to all we
go back in the minutes played you can see we get a meterpreter session
and against this info.
So you can see we have we are currently
have access on the Windows 7 VM. We're not going
to have administrative Privileges and that's where privilege escalation will come
into play. But again, this module is just focused on showing you
how to generate Advanced payloads. And of course
we were actually taking a look at
and audio shelter. So you
can see that it still works as, as the executable was
designed to work. All we've done, is we've injected the
payload into it. That being said, that's all, I'm
going to be covering.
Whirring in this video in the next video. We'll take a look at how to install
Veil evasion and will then take a look at how to generate payloads
with Veil evasion. So I'll be seeing you in the
next video.