Let's see how we can create a basic malicious Windows executable using the MSF venom tool 64 bit Windows
eight is the victim's system.
Choose an executable to use as a template.
The output malware will be the same size with this template file.
I'm going to use Puti dot exec file as the template.
Let's copy put exec to Calli to work on it.
First, look at the IP address of the target machine here Kawi.
You can use win SICP tool to transfer a file from a Windows system to a Linux system, SICP secure a
copy as a means of securely transferring computer files between a localhost and a remote host or between
two remote hosts.
It's based on the S.H. Secure Shell protocol.
Now, since when SICP uses SSL protocol, you'll be sure the S.H. Service is running on Calli.
Check the status of the Sensage service using the service SSA Status Command.
It's already active on Micheli.
If it's not running, use service, S.H., start to start the SSA service in your county machine.
If you try to log in when SICP using route user, you may see the access denied message, that means
using S.H. service with route user is denied in your Calli machines.
S.H. Service configurations either change the S.H. service config to be able to connect with route user
or create a new user to use S.H. connections.
I choose to create a new user you can use, add user or user, add commands on the terminal screen or
users interface to add a new user.
I've already added a user before S.H. user.
For this purpose, you can add a similar user to your system.
Connect with SICP using S.H. user credentials.
Find the exact file at the Windows side in this example, it's on the desktop of a current user, copy
it to the COWEY machine in here to the home folder of S.H. User in Calli use is command in the terminal
screen to see if the file is transferred successfully.
Now we're ready to create a malicious executable using the DOT exec file as a template.
Prepare the appropriate MSF venom command, the first parameter is Dasch P, which specifies the payload
used, you have to find a correct payload according to your target.
Don't forget to choose a payload with the correct platform, correct architecture, correct connection,
method, etc..
You can see the available payload using MSF and El Payloads Command.
There are a lot of payloads available, and since the target machine is 64 bit, we can filter the results
using grep command with pipe.
We use the windows for interpreter reverse, underscore TCP payload for this example.
Let's have a pause here and have a small introduction to the world of Métis Voit.
Metastable project is the most used penetration testing framework in the world.
It can be used to test the vulnerability of computer systems or to break into remote systems.
It was created by HD Moore in 2003 using Perl.
By 2007.
The Métis Foyt framework had been completely rewritten in Ruby in 2009.
The project was acquired by Rapide seven.
Now they have a free and open source version metastable framework and a commercial version.
Métis Boyd Pro.
It's best known sub project is the open source metastable framework, a tool for developing and executing
exploit code against a remote target machine?
The mSv console is probably the most popular interface to the Métis Plate Framework MSF, it provides
an all in one centralized console and allows you efficient access to virtually all of the options available
in the MSF.
MSF console may seem intimidating at first, but once you learn the syntax of the commands, you will
learn to appreciate the power of utilizing this interface.
Pitcher, short for the matter, interpreter is an advanced payload that is included in the Mideast
Foyt framework.
Its purpose is to provide complex and advanced features that would otherwise be tedious to implement
purely in assembly.
The way that it accomplishes this is by allowing developers to write their own extensions in the form
of shared object DL files that can be uploaded and injected into a running process on a target computer
after exploitation has occurred, masturbator and all of the extensions that it loads are executed entirely
from memory and never touch the disk.
Let's continue to create a malicious executable using the MSF venom tool.
Now the first parameter was the payload.
We can choose the platform here, Windows, but since we chose a Windows payload, the tool will already
understand the platform, same as the platform.
We can set the architecture x 64 using the dash arch parameter because we use a payload for X 64 architecture.
The two already understand the architecture, so we don't need to use arch and platform parameters in
this example.
The next parameter is dash F to determine the format of the output file.
You can use MSF venom, dash, help dash formats to see the available formats.
We only use the exec in this example.
Then specify the template file using a dashikis parameter with the template file.
Name the output file with the dash o parameter.
Now is the time to define the options of the payload, to see the options of the payload, you can use
the dash payload dash options parameter with the payload.
We have to design the host and the airport options of the payload here.
Complete the command again, output file format.
And output file name.
Now, a sign host, an airport, options of the payload el hostas, the IP address of the listener machine.
In this example, our Calli machine, El Port is the port which will be open to listen to the sessions.
Hit enter to create the malware.
As you see, no watch has selected the tools selected x 64 from the payload and no platform is selected,
the tool automatically selected windows from the payload.
Again, to be sure, go to the folder and see the created malware.
The attackers should find a way to make the victim accept and run the malware, let's just copy the
malware to the victim's machine at the moment and suppose that we send it as an attachment to a phishing
email.
First, let's try to copy the files of the Windows machine while Windows Defender is running.
As you can see, Windows Defender recognized the malware.
And deleted it in seconds.
Can you guess why?
Because we use the standard medicinally payload, which is very well known, and Windows Defender recognized
it easily.
To see the payload in action, let's turn Windows Defender off and send the malware again.
As an attacker, we need to listen to capture the sessions of the victims who run the malware.
Start MSF console.
You'll have a metal support framework show.
Search for the handlers.
Use, exploit, slash, multi handler for this example.
In handler, we have to use the same payload that we use in the malware.
List the options with Show Options command.
Set the listener address in port.
Since the default port is the same with the port we assigned in the malware, we can leave it as is.
And run the handler, it starts to listen at that moment.
Now go back to the victim machine and run the malware.
Voila, we got the session from the victim machine, look at the system info using this info interpreter
command.
It's a 64 bit Windows machine.
Look at the user ID interpreter has a lot of excellent commands to compromise the victim's machine,
use help command to see some of them.
Let's take a screenshot of the victim machine.
When we list the currently running processes using task list command and the victim machine, we see
the malware running.
You can kill it using the task kill command with rapid parameter.
Use the F parameter to force it to be killed.
As soon as the malware process is killed, the interpreter session dies as well.