All right, in this demo,
we're going to generate a malicious payload for use in
exploiting a software vulnerability.
We're going to use venom to generate that payload,
and we're going to be exploiting some vulnerable FTP software
that we've loaded on our target workstation.
In this module,
I'm going to show you how to use the appropriate
options based on the vulnerability.
And once we've generated the shellcode,
we're going to plug it into an existing exploit and
test it on our target machine.
Let's take a look at the existing exploit and software and see
what we're going to be able to work with.
For this demo, we're going to be using the exploit of the FTPShell Client 6.7,
found in Exploit Database.
You'll find the link to this specific exploit in the demo files,
and right here you'll also see a link to download the vulnerable
application and install on your target machine.
If I scroll down just a bit,
we will actually see the exploit that we're going to be using.
Up top we can see the exploit author, date when he created this exploit,
and different operating systems this exploit was tested on.
So Windows 7 SP1, we should be good to go.
Down here we'll see the code that we're going to use,
and right in this location,
we'll see the venom command that he used and the shellcode that he came up with.
You'll see here that he's already found the bad
characters for us so we can reuse those,
and we can generate our own payload and plug it into this exploit.
All right, to get started customizing this with our own shellcode,
we're going to first get that exploit and store it in a FTPClient.py file.
And then we'll go ahead and open that up, and I'll change a few variables.
We can see the shellcode in this exploit was set to open the calculator
application on the target machine when it's exploited.
Let's go ahead and change that out with an action that we want it to take.
All right,
we want to see different Windows shell payloads, so I'm going to go
ahead and run the ‑‑list payload command to pull up all the payloads
and then grep it for windows/shell.
Once those results return,
we see a few different options of bind and reverse shells.
Let's use this bottom reverse shell payload for this example.
So when using a reverse shell payload,
we need to specify a few options to our host. This is the
IP address of our attacking machine, which in my case,
is 192.168.1.17, and a port option, which is the port we want it to connect on.
For this example I'll use 4444. And then we want to format it in Python
because we're using a Python script for this exploit.
We can specify an x86 architecture,
and we'll go ahead and let it use the default encoder, but we do have to put
in our bad characters from the exploit which we saw here.
So I'll just go ahead and copy those and paste them into this venom command.
And then we'll run that.
Looks like I had a little typo here, forgot the equals sign
on LPORT. And once we get our shellcode,
copy that, and come in here, and replace it.
One thing we also want to do is change this venom
command just for our own reference.
And once we've got our shellcode plugged in, I did have one other
change that I had to make when testing, and that it was to reduce this
nop value to about 32 to leave enough room in the 400‑byte payload for
everything to actually operate.
Once we've made those changes, let's go ahead and run this client.
And once we start it, we'll see that FTP server started on port 21.
That means we're up and ready to go,
and then all we have to do is set up a listener.
So I set up this netcat listener on port 4444, and now let's head
over to our target machine and see what happens when we run this
command. Over here on the target machine, we have the FTPShell Client
software pulled up, and we're just going to enter the address of our
attacking workstation.
And let's see what happens when we connect.
Hey, we see that that ran, and when we head over to our netcat listener,
we have a command shell on our target host.
Let's see what happens if we enter a few commands, just a basic ipconfig.
We pull the target's IP address, a whoami. We get ieuser,
which, as we can see on our target up here,
is actually the administrator for the machine.
And one other thing we can do is see if we can get to any
files we normally wouldn't be able to access.
And since we can get to the windows\system32 directory,
we can safely say that we have now been able to access all files,
and we're acting as administrator on this machine.
So in this demo,
we learned how to take an existing exploit and add our own
shellcode to it to take advantage of some vulnerable
software on our target network.