Hello everyone. In this video. We're going to be taking a look at
how to generate payloads with Veil evasion. I'm
so let's get started by default. Again. If
you installed Veil using the, the callee repositories,
you can launch a veil using the veil command. And
ensure you, you launch it with root privileges, using
pseudo or a the switch, or into the, you into the root
user. Like I have, I cloned the directory. So
again all going to my opt directory under Veil and
I can execute it using the veil .pi script. So
To save a little pie and that opens up Veil for us. All
right, so we're going to be focusing on Veil evasion and
generating python payload. So, what
I'm going to do is the syntax is very simple. As you can see, you can
exit using the exit command. You can get more information using
info. We can list the available tools using list.
We can show the veil configuration using options. It's
very similar to the Metasploit console. We can also update
Veil or use a specific tool in our case. We
want to use the available tools.
In this case, we want to use evasion. So we say use and
option one. Alright, so that is going to specify Veil evasion and
it's going to tell us we have 41 payloads a loaded. So let
us take a look at the payloads we have by typing in list. All
right, so this will list all the various payloads that we
can use. And you can see, there's there's tons of payloads that we can use in.
These are all based on very scripting languages. So
and of course, programming languages, we have the ability to use AC
reverse meterpreter session, of
course, using HTTP or reverse.
Phoebe. We can use C sharp. We
can use the go programming language. We can use the Lua scripting
language, Perl Powershell as well. So Powershell will
actually generate a bat or a batch file instead
of an exe. We're going to be using python because
again python is quite useful. So again,
we do not need to have python installed on
the Target. In this case. The target is going to be the Windows 7 VM,
and of course, we have the Windows Defender
neighbor, so we'll actually see will be detected. So
We'll be using python meterpreter reverse TCP. So to use
this, we just take a look at the number and say, use option,
28. So use option, 28 hit enter and
these are the various options associated with
this particular module. You can see, they are far more advanced than your typical
payload with. Msf, Venom. You
can also specify a click track which allows you to specify the
minimum amount of clicks to execute a payload, which is awesome.
Compile to a exe set to
yes, because we want to compile it to an EXE.
As for cursor Movement, we
can just set that to false. We can also set a domain
and internal domain. If we want, we
can also set the payload to expire after a certain amount of
days. That's very, very useful. We
can take a look at the El host, which is we're going to set shortly, and
then, of course, the airport. And of course, we
can set the minimum minimum amount of
ram required. And the minimum amount of Number the,
in the minimum amount of processes required.
So this is like a sparse Vector payload
where you can set the minimum requirements for
the payload to be executed. And then,
of course, you can set sleep options. So on and
so forth. So the only option we're going to be changing, is the L host
will leave L Port as it is. So we say set L host
to the Kali IP in my case. It's 10.0.0.0 I've
hit enter and then to generate this. We
say generate right of eso. Generate hit
enter and it's going to say please.
Of the base name for the output file. So it's essentially asking to
enter a name for your payload and the Handler.
So the payload name we'll just call it. Let's just
call it payload, right? Just to keep things, simple hit enter. It's
not going to ask you. How would you like to create your payload,
executable? We want to use by installer. It's always much
better. So we hit option, one hit enter. So
that is going to use by installer to start generating the payload for
us. So what I'm going to do is we're just going to
wait for that to complete and that shouldn't take too much time.
I'm at all after which it's going to give us the various options
that we need to that. We need to specify. So it's
very important after the payload has been generated to
focus on the information that has been output. So
number one. It's going to tell us the python is language. The payload module
to use is python meterpreter reverse TCP. The
executable has been written to this particular directory. So
Vale Vale output compiled payload .exe. The
source code has been written to Vale Vale, output
Source payload and
Importantly, we have the Metasploit resource file, which
is written on the varlet veil output.
Handlers payload RC. So it's
very important when using Veil evasion. If you encounter any
issues setting up your act exploit multi Handler
to use. The Metasploit resource file
that has been output and you can see that's under
Handler. So we can actually set that in a few seconds
so we can just hit enter to continue and we essentially, we
essentially done with generating the payload.
So what I'm going to do now is I'll just open up my other terminal here
and you can see that I'm
currently in the Vale Vale directory. And if I list
the the, the contents of this directory, we
have the output folder. So let's go into the output. And within
the output we have the compiled directory which will actually contain the
the the payload exe under
the Handler is where we have the
Metasploit RC file, that will set up the handle of for us.
Okay. So what I'm going to do now is
I'm going to start the python module, simple
HTTP server, so you can get the payload on to the Target.
So simple HTTP server and
we're going to run that on Port, 80, right? And what
we can do again, is start up the Metasploit console. So,
msf console, and we'll set up
the listener using the exploit multi
Handler. So again, we'll just give this a few seconds to load up.
All right, so that is loaded up. So we say use exploit
multi.
Exploit multi Handler, we then can
use, we can set the options that were given to us right
over here. So python meterpreter, diversity, CP for the module, however,
it is recommended that you utilize the
resource, the Metasploit resource file
or configuration script. That was given for the Handler. So
we can say resource within say VAR, VAR
lib. We specify the directory
to the resource on the veils of our lip Veil output
and we're looking for
Going for the handlers. So handlers and payload
or RC hit enter. It's now going to set up
the listener for you. And it's going to say started the reverse TCP
Handler on the IP and the port that we specified, when
generating the payload. This is very important. All
right. So the exploit is also running as a background job, which again is
extremely useful. So what
we can do now is we can actually go to the our Windows 7
VM and download the payload. So we'll just
open up, Firefox here. And we'll,
Go into the IP 10.0.0.0 when we have
payload exe here. So we'll click on that and we save that
file, right? And we'll wait for that to be downloaded. There. We are.
You can see we have payload or exe. And yet it has the
python, the python logo or icon, there the
python Windows icon. So we can just run this
and hit run and we can go back into Kelly and
we're going to the middle split console and it's
going to say meterpreter Session One opened, right? And
you can see the connection and the IP
He deals. And if we hit enter, you can see it appears
as if all session has died, but if you click on sessions, because
this is running in the background. We now have a meterpreter session. Yes,
so we can actually go into that session. So we session
one and we say this info, and we have access to
the Windows 7 VM, and the antivirus wasn't
able to detect it. So we can also, you know, say, get user ID
and that tells us, we're currently as the IE user. So we'll
have to elevate privileges. But again, that's how to use Veil
evasion to generate payloads are different types of pain.
Loads and you can change our whole ton of options regarding
the payloads. So there's a lot of advanced options
you can specify, as I mentioned, you can also go. You
can also use any of the other payloads here. It's all
about just testing, what works for you. So
that's pretty much all that. I wanted to cover in this section and
in this video. So with that being said, will now move
on to our final module or section of this course, we
will be going through the entire. We'll be taking a look at exploiting
the Metasploit Table. Three virtual.
In which runs Windows Server, 2008, so I'll be seeing you
in that video.