All right, it's time for our first demo of msfvenom,
and in this lesson,
we're going to take a look at how to generate a malicious
payload within a standalone executable.
Once our target runs this executable,
the payload should allow us to obtain access to a target machine.
We'll also want to make sure when we're generating our
payload to select the appropriate shell to generate based
on our goal from this exploit.
This type of payload generation is used when we want a user to
actually run an executable that we send them.
And, of course, once we generate this executable with malicious payload,
we'll test it on our target VM.
But first, a quick overview of the lab environment I'm using.
For this course,
I'm using a Kali Linux VM where I'll be generating our shellcode payloads and
using it to create some exploits for vulnerable software.
Our vulnerable machine for this course is a Window 7 developer image.
The demo files contain links to the software that we'll be exploiting and this
developer image so you can download it and follow along.
The demo files for this course also contain working versions of the
scripts that you'll see me use in other demos.
I'm sure you're excited to get started,
so I'm going to cut straight to payload generation in this demo.
In the next one,
we'll go over a few different options that are available
in venom that you might want to use.
But for now, let's take a look at some of our payload options.
In order to do that,
I'm going to use the ‑‑list payload command and grep for
Windows‑specific exploits since my target workstation is a
Windows VM. Scrolling through the output,
we'll see a lot of different options like bindshells and
reverse shells, vut for this example,
let's go ahead and try to generate a Meterpreter shell.
Specifically, we're going to use this Meterpreter bindshell for our payload,
so let's cut back to our command, adding in that payload option.
Now we're going to go ahead and specify an x86 architecture in exe format,
since we want a standalone executable,
and send this out to a file called bind.exe.
And last, we'll specify a Windows platform.
Let's see what happens.
And once it's complete, we see our bind.exe file has been generated,
and we also see a file size here, and the total size of our payload.
And now we have to find a way to transfer it to our target machine.
So normally, if we were running some sort of an attack,
we would probably set up either a link to download the file
or send it to them directly in some way,
or maybe just place it on a USB drive and see if
anybody starts it up on their machine.
But for the purposes of this example, I'm just going to transfer it over HTTP,
so I'm going to copy this file over to our web directory and start Apache.
And then we'll go over to our target machine and complete this transfer.
To transfer the file over to our target, we're just going to use PowerShell.
So in order to do that, we need to enter two commands,
and these will be placed in the demo files, but if you also
want to pause the video and just type them,
you can do that. Then once we have that,
we can verify that that file did in fact transfer over.
So now let's run it and see what happens.
Okay, it didn't look like anything on this end,
but let's head over to our attacking machine real quick.
And we'll just run a quick nmap command to see if port
4444 is open on our target workstation.
And it is, which means are exploit is successful.
But now how do we take advantage of this now that we have this port open?
Well, we remember from our payload selection, we chose a Meterpreter shell.
So let's open up the Metasploit Framework, zoom in a little
bit to make it easier to read, and we'll go ahead and enter a
few commands to connect to that.
And then we're going to set the payload to the
payload that we selected in venom.
Just take a quick look at the options that exist there, so the
particular port that we're trying to connect to,
which is already 4444. But if we had to set that to
something different, or you did,
then you could just set that. And then we need to set the
remote host as well to our target IP address.
And then once we've got all that set up, hit exploit, and we see that
we have a Meterpreter shell open with our target.
So just a quick recap to summarize, we dove right into this
lesson and generated our first shellcode payload,
and we used it to generate a Meterpreter bindshell in a standalone executable.
We transferred that over to our target workstation.
And when we ran that executable,
we successfully opened a Meterpreter bindshell on port 4444. Now that
you've generated your first successful payload in venom,
let's go back and look at some of those other options available and discuss
different scenarios that we might need to use them for.