Instructor: Okay, so in this video,
we're gonna be using Veil to create a backdoor.
So the first thing I'm gonna do is I'm gonna do list
to list the available tools,
and I'm gonna use number one,
cause we want to use evasion.
And then I'm gonna list my payloads.
And you said in the previous lecture,
I want to use go meterpreter reverse HTTPS,
so that's number 15.
So I'm gonna do use 15.
And that's gonna list...
First of all, it's gonna show me information
about this particular payload.
And then it'll show me the options that I can set
for this payload.
So the main option that you want to set
and the most important one is the IP address.
So this is the IP address
which you're gonna be receiving the connections on.
As we said, we're gonna have a reverse connection.
And we need to set the IP address,
which the payload or the backdoor
will try to connect back to.
And in our case,
we want to receive the connection back to this Kali machine.
So we're gonna set the IP lhost
to the IP address of the current Kali machine.
Now to get the IP of my Kali machine,
I have to run ifconfig.
So I'm gonna split the screen by doing right click
and click on split horizontally.
And I'm just gonna bring this down a bit
and we're gonna run ifconfig.
Now you can see the IP address in here is 10.20.14.213.
This is the IP of my Kali machine.
This is the IP of the machine
that I'm using as the attacking machine.
So this is where I want the connection to come back to
so I can hack the target computer
once the backdoor is executed.
So I'm gonna set lhost to 10.20.14.213.
So you can set any of these options using the set command.
So all you have to do is write set,
followed by the options that you want to change.
So in this case, we want to change the lhost.
And we want to change that to 10.20.14.213.
Now the lport is set to 80, which is really good,
because that's the port that's used by web servers.
So as I said,
the connection will look as if the target person
is connecting to a website
and it's not gonna be suspicious.
But I don't want to use that port
because I'll have a web server running on this
and we'll talk about that later.
So I'm gonna change that to 8080.
8080 is another port that's used by web servers,
so it's still not suspicious
and it should still bypass firewalls.
So I'm just gonna do set,
same way that we did it before with the lhost,
we're gonna do lport,
to the value that we want to set this option to.
And we're gonna set it to 8080.
Now, if I do options again
to list all the options,
you'll see that the lhosts changed to 10.20.14.213,
and the lport changed to 8080.
Now, if you generate the backdoor like this,
you will bypass all antivirus programs except AVG.
I've already tried this, that's how I know this.
And that's not good enough
because we want to bypass everything.
Now, the way antivirus programs work
is they have a very large database of signatures.
These signatures correspond to files
that contain harmful code.
So what they do is they compare the signature of your file,
of your backdoor, to all the files in this huge database.
If your file matches any of these files,
then they'll flag it as a virus or as malware.
If it doesn't,
then they'll think that it's a normal file
and it's not malware.
So the main point in here
is we're gonna try to modify the file, our backdoor,
as much as possible to make it more unique
so that it bypasses the signature database
and will be able to bypass antivirus programs.
Now, as I said, Veil is already doing that for us.
It's encrypting the backdoor, it's obfuscating it,
it's injecting it in the memory
so that it doesn't get detected.
And it's doing a good job at it.
It's bypassing pretty much everything,
except for only one antivirus program.
So just to bypass this last antivirus program,
I'm gonna set some optional options
that really won't do much of a difference.
They'll just make the backdoor look a bit different.
So the first thing that I'm gonna modify is processors.
And that's the minimum number of processors
to be used by the backdoor.
I'm not gonna set a huge number
because that'll just make my backdoor not work.
I'm just gonna set it to one,
which is pretty much nothing really,
but I'm just gonna set this option
to make the code look a bit different.
So I'm gonna do set.
Again, the same way that we are setting the lport
and the lhost,
we're just gonna put the option name,
which is processors.
And we're gonna set that to number one.
And I'm also gonna set another option,
which is the sleep option.
And that basically lets the backdoor sleep
for a number of seconds that you set
before it executes the evil code that you have in there,
before it executes the payload.
So I'm gonna set this to six.
Again, no real reason for this.
I'm only doing this
to make the backdoor look a bit different.
So I'm gonna do set sleep to six.
So I'm gonna hit Enter
and I'm gonna do options again,
to make sure that all the options are set
the way I want them to be.
So I have my IP address set properly.
I have my lport, I have my processors, and I have my sleep.
So I'm gonna generate the backdoor.
And now it's asking me to name this backdoor something.
So I'm gonna name this backdoor rev_https_8080.
Just so that we can remember
which payload and which port to use for this backdoor
in the future.
Now the backdoor is generated
and you can see it's telling us the module that's used
and it's telling us where the backdoor is stored.
So the backdoor is stored in this path right here,
so I'm gonna copy that.
Let's go ahead and check to see if the backdoor is detected
by any antivirus programs.
Now you can use the built-in feature by Veil
using the checkvt command,
but this feature only uses the signature of the file
and it's not a hundred percent accurate.
Sometimes it tells you
that the file will bypass all antiviruses,
but it'll actually be detected.
You can also use VirusTotal,
but I don't recommend that and please don't do that,
because if you do that,
your backdoor will become less effective.
Because VirusTotal share the results of their scans
with antivirus programs.
What we're gonna do is
we're gonna use a website called NoDistribute.
So we're gonna go to it now.
So I'm just gonna Google for NoDistribute.
And what this is gonna do, it's similar to VirusTotal.
The only difference
is it's not gonna share the scan results
with antivirus programs, so it won't affect your backdoor.
So I'm gonna click on Browse to navigate to my file.
And I'm just gonna copy where the file is stored.
So, Veil is telling me now it's stored in this location,
in usr/share/veil-output/compiled.
So I'm gonna copy this
and I'm gonna come here.
I'm gonna click on the pen
and I'm gonna paste the location.
I'm gonna click on Open
and scan the file.
I'm gonna include a link to this website
in the resources of this lecture,
along with an alternative in case it didn't work for you.
And as you can see,
the file is bypassing all antivirus programs.
So we can use this backdoor against any device,
and we'll be sure that the device or the computer
will not be able to detect this file as a virus.
Now, please keep in mind
that you won't always get perfect results like this.
Antivirus programs always update their database
and Veil also always updates
the way they generate backdoors.
So it's pretty much like a full cycle.
Veil is always trying to bypass antiviruses
and antiviruses are always trying to detect
the latest backdoors.
So first of all, you want to make sure that you're using
the latest version of Veil
and you'll have to experiment with the different payloads
and different options until you get it to work.
This is the most basic method
of generating undetectable backdoors.
I actually cover more advanced methods
in my social engineering course
and in my Python course,
where I actually show you how to write your own backdoor,
which is the best method.
But these methods are more complex,
and this course is designed to be a general course
that will introduce you to most hacking fields
without diving deep in any.
So if you want to learn more advanced methods
of bypass and antivirus programs,
then check out these courses in the bonus lecture,
the last lecture of the course.
But anyway, you don't need to worry about this for now.
If you can't get it to bypass a lot of antiviruses,
you can simply turn off windows defender
or the antivirus in the target Windows machine
for now for testing,
just to get an idea on how to generate backdoors
and how to interact with them.
And then, if you want to learn more,
you can check out these other courses
because these other courses will build
on what you're gonna learn here.
So you'll have to learn these skills in here anyway.
Also check out the YouTube video
in the resources of this lecture
to get a taste on what these methods look like
and how effective they are.