Instructor: Welcome back.
In this video, I want to show you a cool way
that you can make your executable
seem and look like another file.
So, what I'm going to do right now
is I'm going to mask our shell.exe
that we created from the previous video
to look like a car image.
And what you will need for this is
you're going to need a car image,
or basically it doesn't even have to be an image,
or a car,
it can be any file type that you want.
If you want to create it to be a PDF file,
you can.
If you want to create it to be a jpeg file,
you can.
Just follow along, and the process of doing that
is the same for every file type.
So, two things your to need.
A file
that you want your executable to look like
and the executable itself.
So, this is the same payload from the previous video
which is the regular Windows meterpreter shell.
And what I'm going to do is I'm going to cope it
to the desktop real quick.
And once you got these two files on your desktop
you are ready to go.
Now the first thing that we must do is we
must make an ico file from this PNG file.
And how can we do that?
Well, we can just open the Google Chrome
or any search engine and type png to ico.
You can navigate to the first link in case you chose
a png file and it will lead you
to this convertico.com where it allows us to
simply just upload our PNG image
and it'll create an ico file with that image.
So, I'm going to lower the screen
then as it says right here,
drop your PNG files.
I will drop it right here.
It'll take a few seconds.
And right here our files should appear once it's done.
Here it is.
We can download it by pressing this arrow
and it'll download the car.ico file for us.
So, I'm going to show it in folder,
paste it on my desktop
and now we are good to go.
We got the car.png, which is the image.
We got this car.ico, which we are going to
use to make our executable have this icon right here.
And we are going to merge it with this png image
in order for once the target executes our program
it also opens this image.
Let me show you how it would look like.
So, all you want to do,
you want to select these two files
right click on them and click add to archive.
Click on this.
Right here there are a few settings that we must set.
First, our high format should be ZIP.
Right here you want to check create SFX archive
and here you can name your file, whatever you want.
The only bad thing about this is
that it will have an exe extension
but most of the people don't have extensions enabled
on their window system
so, this will not present that big of a problem.
Okay, so let's go right here and call it car.exe.
Then I want to go
to the advanced tab and click right here on SFX options.
This will open this small window and we want to go
through each step and set these settings accordingly.
In the Update tab,
you want to click Extract and update files.
And in the Override mode you want to Override all files.
Then if I go to Text an icon tab here
we want to click on this Load SFX icon from the file.
Click on Browse, find the ico file that you just created.
In my case, it is on my desktop,
so, I'm going to select it.
Once you do that, you can move on to the next step.
So, in the License tab
there is nothing that we want to set here.
Also, there is nothing that we want to set
if I go to the Advanced, nothing.
In Modes we want to click on Hide all
and Unpack to temporary folder.
After it in the setup
we want to write both of our file names.
So, in the Run after extraction
we want to type right here, shell.exe.
Just make sure you type the files name right here,
correctly.
So, shell.exe is our executable
and car.png is our
image.
Okay, good.
Under the General, nothing here to do.
So, once you set all of those options, you can click on
OK and you can click right here on OK as well.
And here it is.
We got car.exe on our desktop.
It has the icon of this image and
once we go and execute it,
it should also open this image.
But in the background, it should also run our shell.exe.
Let's test it out.
But first we must set up our listener.
So, open terminal
run msfconsole.
Let's set up our listener.
So, multi/handler set payload to
be regular windows/meterpreter/reverse_tcp.
LHOST will be the IP address
one my Cal Linux machine and LPORT
if I remember correctly, was 5555.
Now I can run this.
This will start the listener.
And if I go to my desktop and execute this file
well for some reason it seems to have only
opened this meterpreter shell
and it didn't open the car image
and this is something that happens sometimes.
So, we can try to change some
of the settings in order to make this work
but in this case, it was just a late opening.
So, here is the image it opened right now.
For some reason that took a few seconds.
So, let's just run it once again just to see
whether it'll open faster right now.
So, I will run the listener once again and open car.exe.
Hmm, it still seems to take some time even
though our meterpreter shell is open.
So, what we can do
instead of this is we can first of all exit this shell
close this image that opened 10 seconds
after we executed
and we can start the msfconsole again,
delete this file.
And we are going to change one setting
which will hopefully make cover file execute faster.
So, let's go once again ZIP.
Here we want to name the file to be car.exe
under the advance SFX options.
And here
under the setup is something that we want to change.
So, last time we specified the shell.exe first.
Right now, we are going to specify car.png, first.
And under it I'm going to specify shell.exe.
Then I'm going to click right here
Hide all.
In the general, nothing.
In the Update,
Extract and update files, Override all files.
Text and icon,
let's select our ico file.
In the License and Module, there is nothing.
So, let just click on, OK,
it'll create our file once again.
Not sure why I closed msfconsole when
right now, we are going to set up our listener again
in multi/handler
meterpreter
set LHost
and the LPORT.
We want to run it,
run the file
and now it opens the image straight away.
Okay, so just make sure
that you specified the image name first
and then after it you can specify the shell name.
And here we also got the meterpreter session opened.
We can execute commands as usual.
So, our program works good.
It has an icon of an image,
it also opens an image.
The only problem is this exe extension and there are some
of the ways that you can fix this
and make it seem like it doesn't have any extension
but most of those ways automatically get detected
by any antivirus out there.
Okay, great.
Now that we covered this, we are ready to finally get
into the post exploitation section.
And here we're going to go
into details with the meterpreter shell,
what options it has
and what post exploitation modules we can run
after hacking the target.
See you in the next video.