Hey everyone,
and thank you for joining me on Pluralsight to learn more about
defense evasion through the tool called Veil.
Veil is an open source project released under the GNU General Public License.
The creators of this tool are Will Schroeder, Chris
Truncer, and Michael Wright. Currently, Veil is under support by Chris Truncer.
Above all,
I want to thank them for their contributions to the community
and hope this course can showcase their work in such a way that
others can appreciate it as well.
This tool is created to automate the generation process of Metasploit
payloads that bypass as many antivirus solutions as possible by
combining different techniques and being able to compile the payload in
a higher level language such as Python.
And that is exactly what it delivers.
It's a free and open source shellcode generation and obfuscation framework
that combines encryption and obfuscation techniques to create repeatable,
but unique payloads that evade antivirus. It is available through the
package manager on Kali Linux or by downloading it from the project GitHub
page here. Operation instructions can be found on the wiki included on the
GitHub project page.
Once downloaded,
the installation of all requirements is handled through the script,
which is initialized when you first start the tool. Though most the
installation will finish without issues, I will go through some of the
installation gotchas shortly. If you haven't picked up on this already,
Veil is focused on the creation of payloads,
which can generate from the same shellcode, albeit Meterpreter or
your own custom back door. By utilizing the combined obfuscation
techniques used throughout the industry,
it allows you to create a unique payload every time. As every payload
has a unique signature, Veil also allows you to check if the blue team
has submitted the payload to VirusTotal.
This allows you to keep track of the payloads that
are burned throughout the campaign.
At the end of this course,
you will know how to install the tool and how to solve common issues,
as well as creating your environmentally keyed payloads
through the user interface and command line.
Now, let's take a look where Veil is located on the cyber
kill chain. Veil is used to obfuscate your payloads
throughout the operation; therefore,
Veil would placed on two different points in the cyber kill chain. Veil cannot
only be used to obfuscate your payloads on initial access,
but also by creating a new unique payload to help you spread throughout the
network and reduce the chance that you are booted from a network when one
implant is caught. Veil is focused on evading AV detections.
Therefore, the MITRE ATT&CK coverage is rather specific.
You will find Veil and most of its functions in the Defense Evasion subcategory.
One of the features that sets Veil apart is the ability to natively compile your
payloads into a select few high‑level languages,
allowing Veil to use the advantages of a packaged executable. The use of
native compilation allows Veil to compile the employed obfuscation and
encryption techniques in a package granting the ability to create a unique
signature with every compile allowing for packages to slip past
signature‑based AV with ease. Another of its features,
like with several other solutions, allows you to set boundaries to your payloads.
This function allows you to make sure that the payload does not run
outside the timeframe scope for the engagement and even checks for
parameters so that it only executes on the computer of that specific
user you identified as your target.
I want to quickly go over what the tool does and how it is
used within the target infrastructure.
After that, we will dive into a live demo.
Veil has the option to create a payload or use your own custom
code base to further use in its functionality.
Using your intended back door, you can use the obfuscation and
encryption techniques available in the tool,
like Pyherion and XOR single‑bit encryption, or you can send your
payload through to the manually integrated packages from other tools
like PE‑Scrambler or the Backdoor Factory.
With your now obfuscated or encrypted payload in hand,
Veil gives you the possibility to natively compile it in the language of choice,
which you selected at the start of the process. How this all fits
together in the tool I will show you in the demo.
So, now that we know how the tool operates,
let's quickly look at how the functions operate within your target environment.
The payload created by Veil is sent through your
preferred method to your target.
In this case,
let's assume it is sent through an email from your adversarial environment.
Using the features of Veil, your payload has been keyed to
only execute on the computer of the HR person you
identified during your scoping phase.
The payload is sent through the network to your target PC
and checked locally by the virus scanner.
As Veil has done its magic,
the payload is not detected as malicious and can be executed on the target PC.
Luckily,
our HR guy is helpful and falls for our ploy, allowing our payload to run
and do its job by allowing us access to his system.
If the payload had been sent to any other user,
for example the person in finance, it would not have executed as the
environmental keys did not match with what it was set to look for.