Instructor: Welcome back.
And right now we are going to check
out another tool that is used for generating payloads.
And that tool is called Veil.
Since it is not installed in Kali Linux by default,
we must install it first.
To do that, you can open up your terminal,
enter the root account by typing
in your password after the sudo su, and then
after it you want to type the command apt get install.
Well now since I already have veil installed,
this will not do anything for me.
But for you, it should start the process
of installing Veil and that process might take some time.
However, running this command is only the first part.
After this installation finishes, you can clear the screen
and type veil inside of your route terminal.
This will for me, open up the Veil program,
but for you it'll continue the process of installation.
So Veil has a bunch of dependencies,
and once you run the apt get installed veil,
and after it you run the Veil program for the first time,
it will ask you to install those dependencies.
You want to click there, Yes?
And that process will also take some time.
It'll also have a bunch of popup windows right here
where you want to click on next, next, next, next.
0n each one. You don't want to change any of those settings.
And after all the installation has finished,
you should have Veil up and running.
Okay, great.
After you get Veil up and running,
we can see right here that we get to available tools.
The first one is Evasion and the second one is Ordinance.
And what Veil is, there simply a program that will
allow us to generate payloads similarly to the MSF one on.
So let's give it a try.
If I type use 1 and you will notice
that the commands are similar to the MSF console.
So to use one of these options,
you can simply just type use 1 or use 2.
And since I selected use evasion, as we can see.
number 1 is a Evasion.
It'll tell me 41 payloads loaded.
And these are our available commands.
So we can read information, we can list the payloads,
we can use some payload.
So let us list our payloads. First.
And here we can see those 41 payloads.
Some of them are coded in Ruby,
some of them are coded in Python.
We have PowerShell payloads, Pearl, Go,
CS, C#,
C payloads,
and we get some auxiliary modules as well.
Now the regular payload that we used in the MSF One,
would most likely be this C meterpreter rev tcp pt.
It is pretty much the same thing.
But since we already covered something similar
to this inside of the NSF OneOme,
let us go with a different payload this time.
So let's go with the PowerShell payload.
Let's select payload number 22,
which is PowerShell meterpreter rev tcp py.
So we can just type use 22.
And after you select the payload,
it'll give you all of the available options that you can set
for that payload before you generate it and create it.
Here we can see domain, hostname, Lhost,
local port, minbrowsers, minprocesses, minRAM,
processors, sleep time,
and these options you can use and change as you like.
Some of them might actually help you bypass
some of the antiviruses such as, for example,
this sleep option right here, sleep this amount of seconds.
So whatever we set right here, that amount of seconds
our payload will sleep after execution
before establishing the connection with our listen.
So, let's set that right way.
Let's set sleep to be 20 seconds.
What does this mean once again?
Well, once the target executes our program,
the program will sleep for 20 seconds,
it will not do anything,
and then after 20 seconds,
it'll establish the connection with our listener.
Another thing that we must set is the local host.
And for that we must know our IP address
and it is dot 1 dot 12.
So I'll go right here.
Type set Lhost 192 dot 168, dot 1 dot 12.
And if I type generate, as we can see
by the available commands rate here to generate the payload,
we simply type generate press enter.
Please enter the base name
for the output files and let's call it power payload.
Meaning a PowerShell payload.
I will click here, enter and the payload has been created.
We can see right here, language PowerShell,
payload module is the one that we selected.
Source code is written to this path right here
and we will notice that it is written inside
of the dot bat file.
And Metasploit resource file written
to this location right here.
And the two things that we're interested in are
these two things, the Metasploit Resource file
and this source code.
Now this source code, which is dot bat,
is something that we want to convert to EXE.
Now even though on window systems dot bat file is runable,
but this will get triggered by
any antivirus program out there
Since it is just a basic code that executes commands,
it will get triggered by any antivirus.
We want to convert it to EXE,
and how are we going to do that?
Well, we can go to Firefox
and there is a really good tool that is used
to convert bat programs to EXE files,
and we're going to download it from GitHub.
So if I type right here,
bat 2 EXE, or b2e GitHub,
and I navigate right here to the first link,
I copy the tool.
We can see the tool is an actual zip file
so we must unzip it as soon as we download it.
So let's go right here, go to the second terminal,
let's install the tool on our desktop,
and I will type git clone,
and then paste the link to the tool.
After the tool is installed, we can change the directory
to the tool and if I type LS,
here is the bat to EXE converter as a zip file.
To unzip it, we can type the command, unzip,
and then bat to EXE and it will unzip our file
Clear the screen, type LS, and we will get an EXE file.
Hmm, is this a problem?
We know that EXE files can only be ran inside of a Windows,
but remember we have wine program installed.
Let's get a quick reminder of what wine is.
Wine is a program that allows us to
execute Windows files inside of Linux.
So let's give it a try.
If I type wine and then the program name, press enter.
Let's give it a few seconds and here it is.
It opened the program.
So we must set up the program.
I will set the language to be English, click on, Okay
I accept the agreement.
Of course we're not going to read all of this.
Then click on next,
click once again on next, and click right here on next.
After it, on the last step we can click on install.
We want to check right here
launch bat to EXE converter and click on finish.
And here it is.
It opened our bat to EXE converter.
So now what we want to do is this payload that we generated,
which is inside of this location as a dot bat file,
we want to convert to EXE using this program.
So we must open it inside of this program first.
To do that, we want to go onto file and then open.
Now we must go to this location right here.
So let's click on this arrow.
Let's go to the slash location, find var,
then find lid.
Then the next part is Veil, so we must go and
find the Veil program. Here it is.
And inside of the output
and source is our power payload dot bat.
Let's double click it
and it'll open the code of our payload.
Here it is right here.
Now we have some of the options right here
that we can change if we want to.
You can add an icon by checking this
and then selecting the icon from your system.
But we are not going to be doing that at the moment.
Another thing that you can do, you can set the password
you can change the working directory,
you can change the EXE format
to be something out of these four,
and double select to be 64 bit windows invisible
because I am attacking a 64 bit Windows machine.
You can request administrator privileges at the run time.
So this is sometimes good,
if you want your target to run the pay
up as an administrator, but keep in mind,
once they double click the program, if this was selected
then they will have to input the administrator password.
So that is just another step
before they actually execute the program.
We're not going to be checking that right now.
Another thing that you can do is this packer,
you can enable the upx compression.
But enabling this will just trigger more
and more antivirus softwares
because upx is a really known packer
and it was used a lot to pack malicious programs.
So there is nothing really here that we want to change.
And once you set all of the settings to your liking,
you can go right here on the converter
and then on convert.
Here you want to select the name of your payload
and we can just call it
PS payload, standing for PowerShell payload.
It is an EXE format, so we can just save it.
And if I click on, okay,
it will create our EXE file as we can see down here.
Process finished.
Here, we can see where our file has been saved.
It is in slash var lib veil output source,
and then PS payload dot EXE.
Okay, great.
Now the next thing that we must do to check
out whether this payload works is to run MSF console.
And while it is running MSF console, what I'm going to do
is I'm going to navigate to the Veil directory.
So I will open folder,
I will go to file system
then go right here to var,
navigate to lib all the way down.
I will go to Veil,
then output
source, and here is our power shell payload dot EXE.
Let us scope it to our target desktop.
So I will just drag it onto the desktop of my target machine
and here is our PowerShell payload dot EXE.
If I go right here, open the Metasploit framework,
and I go back to the Veil first,
copy this Metasploit resource file,
copy its entire path,
and type resource and then paste this.
What this is going to do is,
it will set up the listener automatically.
That is made for this exact payload.
As we can see right here,
it started reverse TCP handler on this IP address,
on this port and it's doing all of that in the background.
So all I'm left to do is execute this payload.
Now in this case we can see the console of this payload,
which is something that we don't really want.
It only showed for a brief few seconds.
But that is something that you can change inside
of your bat to EXE converter.
So let's wait for a few seconds and in just a few seconds,
we should receive the Meterpreter session.
And remember why it is taking so long is
because inside of the Veil, we set 20 seconds to wait
before establishing connections.
And here it is regarding Meterpreter session 1 opened.
Let's see whether we can execute command.
So I clear the screen, type sessions.
We have one session active
and I will enter it using the dash I command
get user id and we are on that target machine.
We can enter the shell as usual type who am I,
where this account and everything seems to work. Great.
So we managed to create another type of payload
that wasn't the same as in the previous video.
And to just prove you that I can go right here
to the virus total and we can upload the payload
to see how many antiviruses managed to detect it.
With the regular MSF 1 on payload,
we got about 53 or 54 detection rate out of 60 antiviruses.
Let's see how much we get right now.
Let's go and find the payload.
And it is once again in slash var, slash lib,
slash veil, in the output folder and in the source folder.
Here it is.
I will select it, confirm the upload,
and we should have a much lower detection rate,
than with the regular MSF one on payload.
And once again, read the usage of this bat to EXE converter.
You can change some of these settings
and you might even get lower detection rate
but it will never be zero.
Why? Well, if I just go right here
and I delete the entire code and type some random code,
which doesn't do pretty much anything,
and if I were to convert this code to EXE,
it will still get detected by a lot of antivirus vendors.
You might be asking why since this right here
is not any type of a malicious code,
well that is because we are using this tool
bat to EXE, and some antivirus vendors find files
malicious even though they might not be just because you
converted a bat file to an EXE.
That is pretty much the only reason and frequency rate here,
we get a much lower detection rate
than with the regular MSF one on payload.
We get 27 out of 67,
So we managed to bypass about 20 to 30 more antiviruses
just by creating a PowerShell payload with Veil,
instead of using a regular MSF one on payload.
Great. So what did we learn in this video?
Well, we covered this tool called Veil.
You can experiment with other options as well
and you might get even lower detection rate.
We also covered this BAT
to EXE tool that we can use to convert the BAT files to EXE.
And we also know that
no matter what type of file we convert to EXE,
it will still get detected by some of the antiviruses,
just because we used a tool like this.
Okay, great.
Now that we covered this,
we can proceed with our payloads in the next video.
See you there.