Lecturer: Okay, now that we have Veil loaded,
you can see it show us the main commands
that you can use with Veil.
So, the first command is, you can do exit to exit,
you can do info to get information about a specific tool,
you can do list, to list the available tools.
You can do update, to update Veil,
and this is very, very important
because you always wanna be up to date
when it comes to bypassing anti-virus programs,
and then you can do use to use a tool.
Now, let's start using Veil Evasion,
and as we do it, it's gonna become so easy
and you'll be able to understand it more.
Now, Veil has two main tools and if we do list,
you'll be able to see them.
So, we have the first one which is
the one that we're interested in, which is called evasion.
And that's the one that generates
undetectable backdoors for us.
And then there's the second one, which is called ordnance,
and this tool generates the payloads that's used by evasion,
so you can look at this as a helper or a secondary tool.
Now, what I mean by a payload is,
a payload is the part of the code of the backdoor,
that does the stuff that we want,
that does the evil stuff if you wanna say.
So, it's the part of the code
that give us a reverse connection,
it's the part of the code
that download and execute something on the target computer,
it's the part of the code that allow us
to achieve what we want by executing that file.
And this is gonna become more clear as we start using Veil.
Now, for now we're interested into using evasion,
so we're gonna do use 1, because that's the first tool,
that's number one.
And as you can see we have Veil Evasion loaded now,
and as I said before, this used to be a standalone tool
that you just downloaded on it's own.
But now they have it all combined together.
Now, as you can see, the first thing that we get
when we load Veil Evasion is the commands
that you can run on this tool.
So, the first thing that we wanna do is
we want to list to see all the available payloads.
And as you can see, we have 41 different payloads
and all of this payloads follow a certain naming pattern.
And you can see for example,
let's take this example right here
because that's the payload that I'm gonna be using.
You can see the payload is divided into three parts.
The first part right here refers to the programmer language
that's the payload is gonna be wrapped in.
So, we have the evil code, and then the evil code
is gonna be wrapped into a certain programming language
that the target computer understands.
And right here you can see that this payload uses
go programmer language, we can see this one uses c,
we can see these ones use cs,
we have python, we have powershell,
and we have ruby if we scroll down.
The second part of the payload is really important.
This is the type of the payload, the type of the code
that's going to be executed on the target computer.
In this example, we're using Meterpreter
which is a payload designed by Metasploit.
Metasploit is a huge framework for hacking
and it allows you to do a lot of things.
But in this lecture we're focusing
on creating a payload called Meterpreter,
and what's really cool about Meterpreter is
it runs in the memory and it allow us
to migrate between system processes,
so we can have the payload or the backdoor
running from a normal process like Explorer for example,
and this payload will allow us to gain full control
over the target computer,
so we'll be able to navigate through the file system,
download, upload files, turn on the mike,
turn on the webcam, even use that computer
to hack other computers, install a key logger,
you can literally do anything you can think of.
And all of this will be running from the memory
from a normal process on the system.
So, it's very hard to detect
and it doesn't leave a lot of footprints.
That's why it's a really, really cool payload
and we'll be using it a lot.
The third part of the name is the method
that's gonna be used to establish the connection.
So, and here we can see that this is called rev https.
So, rev stands for reverse, and https is the protocol
that's gonna be used to establish the connection.
So we can see that this payload will create
a reverse https connection.
You can see this one right here for example,
it creates a reverse http connection.
And we have this one in here
that creates a reverse tcp connection.
Now, what I mean by reverse is the connection is gonna come
from the target computer to my own computer.
So, I won't be connecting to the computer
that I want to hack, what's gonna happen is
once the person double clicks the backdoor,
the backdoor will connect back to me
from the target computer.
What's cool about this is,
I'll be able to bypass anti-virus programs
because the connection is not going to the target computer,
it's coming back to my computer,
so it's literally as if the target person
is just connecting to a normal website.
I'm gonna use a port that websites use which is 80 or 8080,
so again, if the person analyzes the connection,
it will look as if they're literally
just connecting to a normal website.
Also, if the target computer is hidden behind a router,
or behind a network, again this is gonna work,
because the connection is coming
from the target computer to me,
instead of me connecting to the target computer.
So, using a reverse connection is really,
really handy and I think this is really
the only practical way of gaining access to a computer
because there is a lot of things that can stop you
from connecting to a certain computer.
Now, this is the general naming pattern.
You'll see some payloads like this one right here
which doesn't follow that general naming pattern.
And basically, what these payloads do for example
you can see this one is called shellcode inject,
so what it's going to do is, it's going to create a payload
that injects your other payload.
So, it's gonna create a normal payload,
and that normal payload injects
a Meterpreter payload for example.
Now, it does this to try to bypass more security
but usually they won't bypass more things
than the normals payloads would bypass,
so that's why I usually just use
one of the normal payloads in here.
So, this is it, this is all about the payloads,
sorry I took a bit of time, but I wanted to make sure
that you guys understand the naming pattern,
I wanted you to understand what a payload is,
and the difference between a reverse
and a bind, and a tcp payload,
this way the rest of the course
will become more clear to you
and I can just use the payload that I want
without explaining what it is.
Now, in the next lecture we're gonna be
generating a payload, and we'll be testing it
against anti-virus programs.