In this demo, we'll execute the payloads on the remote host
and obtain access using reverse shells.
We will utilize the HTA and macro payloads generated in the previous
demo and observe the results in our lab environment.
Testing the payloads allows us to see the results of the attacks we
generated with Unicorn and know what modifications we may have to make to
make them more effective in a live environment.
Let's head over to our lab and get started.
For our first test, we'll use the HTA attack on our Metasploitable host.
The first thing we need to do is set up a web server on our Kali VM that
we can access from our target. To do that, we just change the directory
to the hta_attack directory that Unicorn created. From here, we can use
Python to start a simple HTTP server using python ‑m http.server,
followed by a port number.
Let's use 8080 for this example.
Now that we have our server set up,
we need to set up a listener to capture the reverse shell.
To do that, we can open a second tab and navigate to the same directory.
Unicorn makes it easy to set up a listener using Metasploit. We can
just type msfconsole ‑r, followed by unicorn.rc.
Now we're ready to test. Let's head over to our
Metasploitable VM and access our web server.
Normally, to attack a target with this type of method,
you could send a link as part of a phishing attack. To simplify
our environment, I didn't set up an email server. Accessing this
link validates our exploit and allows us to observe the behavior
the user has to take,
which we could use to craft a more convincing phishing attack and further
increase our chances of success. Immediately after entering the address,
we're asked to take action with the HTA.
If we accept to download the file and click Run,
the payload will execute. We don't really see any other behavior here, but
let's check back in with our Kali machine. And we have our shell. Although
we have some work to do to increase the likelihood that a phishing attack
will succeed and minimize suspicion, Unicorn did some heavy lifting for us
to generate a working exploit, which certainly saves us some time.
I'll let you know now that this HTA is detected by
Windows Defender in Windows 10.
Let's try accessing it from our Windows 10 machine. And there we see
that it did try to download our Launcher file, but it was immediately
blocked because it could harm our device.
Even if we try to keep the file, Windows Defender will detect it as a virus.
At the time of some of my initial tests, I could rearrange
the text in the word PowerShell to get past the initial
scan and enable it to download.
However,
once my Windows 10 machine updated, this no longer
worked and it detected it every time.
Even if I got it past the initial detection on download, the
reverse shell does not appear to make it past the runtime
execution for Windows Defender.
Custom shell code might help you out in this section,
but generating our own shell code is outside the scope of this course.
For now, let's see if we can solve this problem with our next attack,
the macro payload. We'll target our Windows 10 host specifically for this one.