So in this video we'll be testing the Metasploit payloads with our loader.
So I have created a function that is called Inject P 64 and it will take these in the byte format,
the XY in the binary format.
So how are we going to get this is.
So we are going to send via the circuits.
So we'll be receiving directory into this payload and we'll be passing that to a new thread.
So these our XY file never touches the disk.
So in this function I'm creating a new process.
So I will tell you why we are creating the new process.
Huh?
Here we can see good size of feathers, you might say, etc. and we I am allocating a space in my,
in this process virtual space and then also creating the memory region in the remote process.
So that is in this process.
So this process runs the CMD DLC in the background in the hidden.
So it will not pop up on the user desktop.
So we'll be fixing the passing the headers and we'll be mapping the sections into remote memory.
So we'll be mapping into our own memory.
And then we just use this right process memory to write into the remote process memory.
So it will be same as what we are done previously, but we'll be using right process memory instead
of Marshall that copy and then we will be fixing IADS.
So instead of the base address, we will have the remote base address.
And martial art.
So instead of martial law, copy.
All right.
We have this right process memory to the process center and this at which address we want to write and
the bite area and the length.
And this is the output number of bytes written.
So instead of just master copy, all right, we'll be using the right memory to write into the process
memory so you can inject into the same process.
But the motivator payloads, when you type exit in the motivator session, that is a massive console,
then this whole process gets terminated.
So there is this function load P 64, that is the exact function, what we have written from the previous
videos.
So what this does is it will load this PE into itself and starts the thread from that entry point.
So the problem is you need to compare the Metasploit payloads.
M7 went payloads using the exit function is equal to thread, otherwise it will exit the whole process.
Instead of that.
What we're going to do is we are going to create a new process and this dummy process will load the
our XY into this one.
So even though it exits, our main process will be continue.
So it's almost same as our previous code here.
We'll be using the create remote thread instead of create thread.
So how so?
Let's go and generate the pirates.
I have already generated the pirates.
So one is the character.
RTX This enormous character, and this one is not a reversal and this one is the matter of reversal.
So let's go and test out this.
So my, our C2 server is running.
Let's go and start the agent.
Now go to order.
So I have written some HTML code to choose the file so you can click on file and there should be an
output folder.
Currently the program accepts only from the output folder.
We can also customize from the full path as well.
So control the DXY.
Now click on load.
Now you can see the pop up.
Now what we're going to do is we are going to test the normal reversal.
So I have generated to connect to the phone.
One, two, three, four.
So let's go and choose that one normal reversion.
So if you click on load and if you see the connection.
And one thing you need to do, you need to observe is you can still execute commands or not.
Yes, you can still execute commands because we are creating a new process and that process will be
loading the already loaded our metasploit payload so we can type.
Who are my.
We had the username.
Now we can having this connection on we can load again calculator.
It's.
So let's go and exit this.
And we have exited here.
Let's try to execute character die sexy and still we get this.
If you don't create a new process here, your main program can get exit or it will stay in the infinite
state until the reverse connection is exited.
So that's why I have created a new process.
Now let's test the matter.
Beta one so I have already set the execute for reverse TCP so I can run the prisoner.
Well.
Now we can see session one open.
Let's interact with the first session and let's say this info and we get the information.
At this point I should be able to execute commands.
So let's type net users and we got all the users.
And the important thing is if you exit this Metro Beta, our main process should not execute, should
not exit.
So let's exit this one.
Now let's go and road the car to the taxi.
And here you can see the taxi.
So I highly suggest you create a process in C-sharp.
It's very easy.
It's just a few lines of code in windows where you need to use the create process function.
It's also very easy.
So that's over this video.
We have successfully executed the Metasploit payloads with our rotor.