Alright, in this next demo,
we're going to take a little bit closer look at the
different functions available within msfvenom.
In particular,
we're going to focus on the options that involve the use of bad characters,
the encoder, and the keep options.
As we explore these options,
we're going to discuss what they're used for like exploits that
require the filtering of some bad characters and how to get around
that. And we'll talk about how to select your bad characters and
encode your payload using msfvenom and different reasons why you
might want to encode the payload.
We'll also discuss the keep option and how it avoids
crashing the target application.
Let's head over to our Kali Linux VM and start exploring some of the
capabilities of Venom. To get started, we'll just do a quick ‑h to pull
up the list of all the different options,
and we'll talk about a few different ones. On top we just see
another explanation of what msfvenom is,
which is a replacement for the msfpayload and msfencode tools.
The options start with a list option,
which allows you to list different payloads, encoders,
ops, platforms, formats, or list all options.
If you remember,
we used this in the last demo to list the different Windows payloads.
We also have the payload option where we select that payload.
We also see under list options that our payloads have additional standard
and advanced evasion options that we can choose from.
We also have format where we select the format of our
output. In our last demo, we used exe.
There's also other formats like Python or C.
We have our encoder, which we'll talk about in a little bit,
and that's what we can use to actually encode our payload.
Architecture where we select different architecture options.
Depending on the payload you select,
you can actually leave this out and Venom will determine
which architecture you're likely targeting.
We have out to save the payload to a file like we did in our last demo.
We have b, the bad characters filter where we can rule out bad
characters if our exploit doesn't process them correctly,
and we'll talk about that a little bit more in a bit.
And down here we have the keep option,
which allows us to inject our payload as a new thread and
prevent the application from crashing in the process of
running our shellcode during an exploit.
So now that we understand some of the different options,
let's take a closer look at some different formats and encoders that we can
use. First on our list of formats are different executable outputs. In our
last lesson, you may remember we used exe, but you'll see there's quite a few
more output options that Venom can use.
You can also output it to the screen for use in different scripts or
other applications you might want to use like C, Bash,
PowerShell, Perl, Python, or Ruby.
We'll be using the Python format in the next demo and
taking our output and pasting it directly into a Python
script that we'll use for an exploit.
Now that we've seen all of the different formats that Venom can support,
let's take a quick look at encoders and talk about what they would be used for.
So here's a list of the different encoders that you can
use in Venom to encode your payload.
Reasons why you would want to encode your payload are both
avoiding antivirus applications and also filtering out bad
characters from the shell code.
Some of the applications that you want to run an exploit against will
interpret shellcode characters as something other than what you want
them to interpret them as. Some of the applications that you're going to
run an exploit on have specific functions for different shellcode
characters like the hex code 0 alpha or line feed and the hex code 0
delta or carriage return,
which could cause that line feed or carriage return to be fed to the
application and prevent the rest of your shellcode payload from
running. If there is an existing exploit,
usually somebody will have already done the homework for you to
determine what the bad characters are, and then you just need to
remember to place those bad characters with the ‑b command when
you're generating your shellcode payload.
When you're finding your own exploit,
you're going to want to test all of the different hex code characters
and see how the application interprets it to be able to find your bad
characters. When you select the ‑b option,
msfvenom will automatically select the shikata_ga_nai
encoder to encode your payload.
If you want to specify another encoder,
you can use the ‑e and specify any other encoder on this list.
Now that we understand the different options,
let's look at an example of payload generation using some of these commands.
As we did in the last lesson, let's take a quick look at some different
Windows payloads we might want to use. For this example, I'm going to use
this 64‑bit bind shell option up here. So my final command will be # msfvenom
‑p windows/x64/ shell_bind_tcp.
We would want to use the bad characters and add in some of
the bad characters from our application.
Let's just say we've already done our homework,
and this application has the bad characters 00, 0d, and
0a. And I almost forgot to specify a port that we want
that bind shell to show up on.
For this example,
we used port 4444. Let's see what happens if we don't specify
our architecture and don't specify an encoder,
but also add the ‑k option and format this output in Python. And there we
have our shellcode payload, and you'll see that it's already formatted for
us to copy and paste into a Python script.
And we see that because no platform was selected,
it determined that Windows must be from the payload we
chose because no architecture was selected,
but we used an x64 payload.
It chose the x64 architecture for us.
It found two compatible encoders and failed to encode the first one due to
one of the bad characters, x00. It tried the other encoder,
which was x64/xor,
which it succeeded in encoding our payload and the final size being 551 bytes.
And you'll notice as we scroll through, it's already set up to add each of
these shellcode lines to a variable buff. And we'll notice that it does not
contain anywhere any of our bad characters.
So this shellcode payload is set up to not only generate a
bind shell, but also decrypt itself.
So when we plug this into a script,
we're going to need to leave it a little room in order to do that
decryption. And you'll see an example of how an existing exploit
already incorporates that in the next demo.
So just a quick recap,
we went over some of the different options, how to find a list of encoders,
payloads, and different formats that msfvenom supports, and how to use the bad
characters and keep options in order to filter out any characters that your
target application does not interpret the way you want them to, and how to
have your shell codes bond in a new thread so that it doesn't crash the
application. In the next demo, we're going to use some of these options in an
actual exploit when we exploit an FTP client running on our Windows 7 target
machine.