‫Now, let's see the veil framework in action.
‫Go to the Vail folder and run Vail Dot Pi script.
‫Use list command to list the available tools.
‫We would like to use the evasion tool, so print use one and hit enter.
‫Veil evasion menu is opened.
‫Use the list command to see all available payloads.
‫There are more than 40 different payloads.
‫Let's use maternity payload, which is using a reverse HTTPS connection.
‫Copy the file name of the full path.
‫We'll use it on the next step.
‫Print use 27 to use the payload we selected and hit enter.
‫The options of the payload are listed change as many options as possible to make the payload more customized.
‫The most important options here are the address and port number of the listener Machine Bell host and
‫L Port Options Again listener would be our calling machine.
‫So assign the IP address of Carly as L host, let the L port remain as 44 44.
‫To keep the example simple, I'm not going to change any other option at this point.
‫Now we're ready to generate the payload.
‫Used to generate command for this purpose.
‫Give the base name for the output files to be more meaningful.
‫I'd like to use connection type, reverse protocol https and the port number that uses 44 44 in the
‫file name.
‫And last, it's asking the method to create the executable file from the script code, choose the first
‫one.
‫Malware is ready as a code and as an executable file, plus an RC file, which is used to start an appropriate
‫handler that uses the same options with the malware is prepared.
‫Let's transfer the malware to our victim machine using the win as a tool.
‫First, I copy the malware to the home folder of the S.H. user.
‫You can examine the generated file using Linux file command.
‫Yes, it's Windows executable.
‫Now go to the victim machine run, win FCP and connect to the counting machine with SSA chooser.
‫Before copying the malware generated by Vale, let's turn on Windows Defender.
‫Now, while Windows Defender is running, copy the malware to the victim machine.
‫No Windows Defender cannot recognize the malware.
‫We successfully copied the malware into the Windows eight system.
‫Now, at this point, as the attacker, we need to have a listener because the payload of the malware
‫uses a reverse connection.
‫So go to Kalli use Metasploit RC file, which is generated by Vale to create a listener print MSV console
‫Dash R and add the RC file name with its full path, then hit Enter.
‫An https reverse handler starts on our calling machines 44 44 port as background job.
‫Now go to the Windows machine and run the malware.
‫Our session is opened.
‫Use the Sessions Dash L Command to see the open sessions and the sessions, Dash I one to enter the
‫open session.
‫Now we have a maturity session on the victim machine, even though the victim machine has a security
‫solution.
‫Windows Defender and Joy.