Now let's see the framework in action.
Go to the veil folder and run Vayle Dot Prescript.
Use list, command to list the available tools.
We would like to use the evasion tool, so print use one and hit enter.
Vale of Asian menu is opened, use the list common to see all available payloads.
There are more than 40 different payloads.
Let's use an interpreter payload, which is using a reverse https connection.
Copy the file name of the full path.
We'll use it on the next step.
Print used 27 to use the payload we selected and hit enter.
The options of the payload are listed change as many options as possible to make the payload more customized.
The most important options here are the address and put number of the listener machine L host and L
port options again listener will be our Caly machine.
So assign the IP address of Calli as L host.
Let the port remain as 44 or 44.
To keep the example simple, I'm not going to change any other option at this point.
Now we're ready to generate the payload.
Used to generate command for this purpose.
Give the base for the output files to be more meaningful.
I'd like to use Conexion type reverse protocol HTTPS and the port number that uses 44 44 in the file
name.
And last, it's asking the method to create the executable file from the script code, choose the first
one.
Malware is ready as a code and as an executable file, plus an RC file, which is used to start an appropriate
handler that uses the same options with the malware is prepared.
Let's transfer the malware to our victim machine using the wind as tool.
First, I copy the malware to the home folder of the S.H. user.
You can examine the generated file using Linux file command.
Yes, it's Windows executable.
Now go to the victim machine, run win SICP and connect to the Calli machine with SSA Tuzer.
Before copying the malware generated by Vayle, let's turn on Windows Defender.
Now, while Windows Defender is running, copy the malware to the victim machine, no Windows Defender
cannot recognize the malware.
We successfully copied the malware into the Windows eight system.
Now, at this point, as the attacker, we need to have a listener because the payload of the malware
uses a reverse connection.
So go to Calli, use Métis IT Arcy file, which is generated by Vayle to create a listener print MSF
console Dasha and add the RC filename with its full path then hit enter.
And HTP reverse handler starts on our machines 44 44 PT. as background job now go to the Windows machine
and run the malware.
A session is opened.
Use the sessions dash command to see the open sessions and the sessions dash I one to enter the open
session.
Now we have a maturity session on the victim machine, even though the victim machine has a security
solution, Windows Defender and Joy.