To be able to use Veil, you will need to install it.
Installation is pretty straightforward.
You can get Veil in two ways,
through downloading and installing the package from the GitHub page or,
arguably, the easiest option, installing through the package manager.
And that is exactly what I'm going to show you in this demo.
I will make use of the Kali Linux operating system as it is
an OS of choice for red teamers; however,
there are several other options,
like for example building your own setup once you know which tools you like.
You can install the Veil package by running apt‑get install veil.
This will download and install the tool directly from the
repository of Kali Linux onto your system.
I chose to do this demo on the Kali Linux operating system as it is a
well‑known operating system for pen testers and red teamers alike,
which makes it easier for you to follow along.
Kali Linux is a Linux distribution based on Debian,
so settings and configurations carry over to another Debian distribution and,
in many cases, to Ubuntu as well.
Now that the installation through the package manager has been completed,
we will run the tool by just typing veil.
As this is the first time running Veil,
it will automatically start the first run script,
which allows you to automatically install all the prerequisites,
which will enable Veil to live up to its full potential.
You can choose to either install in interactive or
silent mode by choosing yes or silent.
The interactive mode allows you to change the settings of
all packages which will be installed, like installation directories and such.
While the silent mode will install everything in its default configurations,
doing the silent installation will have it as an added bonus that you won't
have to change any configuration settings within Veil.
We will, however,
still look at where to set them if you need to do so after
the installation has been completed.
In some cases,
the installation of Veil will not complete successfully
and Veil will not work correctly.
In this case, you can restart the first run setup process by typing veil ‑‑setup.
You can also add the silent switch if you wish to
run it with all default settings.
Now that the package manager has downloaded and installed the tool for us
and the first run setup has completed without any issues,
let's have a look at the installation directory.
Veil has been installed in its own directory in /usr/share.
There you will find the main file,
as well as a directory containing the configuration files.
If you chose not to install with the silent switch and have
changed any of the prerequisite default paths,
this is where you have the option to tell Veil the location of these files,
as well as the directories where Veil will output the files it has generated.
You can run the configuration file as any other Python script to get
a nice overview of what can be configured in it.
What you see here is the default configuration as it comes
with the tool when it is freshly installed.
There are two main directories Veil operates in,
/var/lib/veil and /usr/share/veil.
To allow Veil to operate correctly,
we need to make sure that it has the correct
permissions to write in those directories.
We can do this by making our current user the owner of
these and all underlying directories.
Do this for both the directories,
and don't forget the ‑r to make sure that all underlying
directories and files are changed to this owner as well.
Now that we have seen where you can make changes to the
configuration and have made sure that Veil is allowed to write
to the directories which it works in, let's have a look at the tool itself.
From the main menu of Veil, we can see that Veil is divided into two tools,
Evasion and Ordnance.
Ordnance is used to generate shellcode to either using in an
exploit or as input for the Evasion part.
Evasion is the part of the tool where you can apply the different
techniques Veil offers to make sure that your payload will bypass as
many AV solutions as possible. As we will be using a default
Meterpreter payload for this course, we don't have to generate our own shellcode.
At the end of this course,
I will provide a link to information regarding working with this specific tool.
Now let us dive into the Evasion part. To go into the
submenu for either of these tools,
you can type use, and either 1 for Evasion or 2 for Ordnance.
Typing use evasion or ordnance will work as well. At any moment
in the tool, you can type back to go back one step or menu to be
returned to the main menu.
With basic navigation out of the way,
let's continue on creating our first payload.
Currently, there are 41 payloads available within Veil by default.
A lot of them are added by scanning the installation directory of
Metasploit and adding the readily available options you have there
to this tool for further obfuscation.
To view all the payloads, you can type list payloads,
which will list all the options on your screen.
As you can see, there are a lot of flavors.
All payloads have its pros and cons.
For instance, if you are attacking an older or stripped down version of Windows,
you could choose to go for PowerShell or a C# variant.
Linux environments are easier compromised by using either C, Go or Python,
for example.
I have identified that our target machine is running Windows 10,
and from experience,
I have found that a packaged Python payload does very well here, so
let's go for that and we will choose the Python Meterpreter version of
the reverse HTTPS connection. We chose the HTTPS option to add a layer
of encryption over the traffic, as well as trying to blend in with our
other web traffic.
So, we will use option 27 for our preferred payload.
Choosing this payload,
we are taken directly to the screen where we can configure the settings
for it. At any time during this configuration step,
you can type options to view the currently set configuration for this payload.
You can change any of the options by typing set,
followed by the option name, and the value you want to set it to.
The options can be divided into three sections. Payload settings so
the implant knows where to go back to and through what method to
execute. Environmental key settings.
These make sure that the payload is executed on the machine you wanted to. And,
lastly, anti‑analysis settings.
These are the settings which allow your payload to try and check if
it is run within an analysis environment. Before you continue to
set up the options for our payload, I do want to explain the
differences between the injection methods which can be utilized to
execute our payload.
You can choose for virtual allocation, void pointer casting or heap allocation.
All have their uses,
especially when you are using the code injected into other forms of delivery
besides our compiled Python payload. First off, virtual alloc.
Virtual allocation is the most used option as it allocates memory as read/write,
copies in its code, calls on the Windows API to set it to read execute, and
starts a threat. Void pointer casting is a tough one.
It casts your payload to a raw chunk of memory, invokes
execution on it, and jump executes straight to that.
The downside to this method is that there is no guarantee
that a memory region is executable, so depending on available protections,
it might fail.
Heap allocation will create a heap object and then manually allocate memory
space for it, copy in the shellcode, and do the same kind of approach as the
first option. With the different options out of the way,
let's proceed with configuring the settings for our payload, starting
with the IP and port the implant needs to connect back to. So let's
set the localhost IP and the local port.
The localhost IP is that of the system in our demo environment,
and we will use port 443 to blend in with regular web traffic as much
as possible. During our investigation of our target,
we identified that the person to attack has the username hr, so let's set that
as our environmental key to make sure that it is only executed on his PC. As
we would like to have our payload compiled to an executable, this is set to
true by default in the payload options, we get the following question.
We can choose between PyInstaller or py2exe. PyInstaller is default; however,
there are some known issues with the default installation where the
payload works well when you run the Python file manually,
but when compiled it would not execute on the target system.
This is due to that the out‑of‑the‑box installation of PyInstaller
defaults to opt in to data execution prevention. As PyInstaller is an open
source package, there are ways to disable this and open it up for a wider
range of shellcode injection techniques.
A link to a guide on how to do this will be provided at the end of this course.
We will choose to continue with the default and let
Veil work on creating our payload.
With the payload generation successfully completed,
we are presented with an overview of what has been created and where to find it.
We see that three files have been created, an executable,
the Python source code, and the Metasploit resource file.
The executable is the one we are going to send to our target through a
clever ploy so he will execute our totally legit payload. The python
source code we can use to customize the payload even more and
eventually manually compile it, if needed.
The Metasploit resource file we can use to quickly spin up our
Metasploit listener with the settings we set for this specific
payload. During your engagements, you most likely generate several payloads,
and the blue team will inevitably upload a sample to VirusTotal.
The creators of Veil have also accounted for that by adding a
little function initially created by XXX. In the Evasion menu
where you end up after pressing return,
we can call the function CheckVT to check the hashes of the payloads we
generated against the entries in the database of VirusTotal. When a
payload shows up, we know that a particular implant has been burned and
cannot be used anymore for further engagement. Running it now, you can
see that the two reports that are payloads are unique and not yet known
to VirusTotal.
All right, let's continue and start our listener and move on to our target
machine to see if the payload is detected by Windows Defender.
Now that we're on a target system, we can see that the payload we
created has magically appeared on the desktop.
Getting your payload onto the target system is not part of this course.
Let's execute the payload and see if a connection is
returned or that it is stopped by the AV.
As we can see,
a connection is returned to our listener in Metasploit. As the
payload has been executed on the target host,
we might conclude that the payload was not marked by the antivirus
as being malicious and executed perfectly fine.
Now that we have seen how to create a payload through the user interface,
let me show you how it's done through the command line, as this can be
very helpful when integrating Veil into your own tools and workflow.
From inside the installation directory,
we can run veil with the help switch to get a printout
of all the options available to us.
Here we can see that both Evasion and Ordnance are
available through the command line.
Let's build up the payload we previously generated through this method.
The t switch allows us to choose between the two main
parts of Veil, being Ordnance and Evasion.
As we are recreating our payload through this method,
let's go for Evasion. Adding the p switch, which we configure Veil
to use our python/meterpreter/rev_https payload.
Don't forget the .py at the end.
For our payload,
we will be setting our IP and our port number, as well as our environmental key,
which is the username of our target.
With all the options set,
we specify that we want our payload compiled through the
PyInstaller and add a ‑o to give the output a name.
This is all that is needed to configure the same payload we created in the
user interface through the command line. Having the option to generate a
payload through the command line allows you to integrate it into your
workflow and generate new payloads in an instant,
speeding up the time it takes to react to a changing environment.
So, we have learned where Veil fits into your workflow and the MITRE
ATT&CK chain and how to create a unique payload through the user
interface, as well as the command line.
Let's continue in the next section to review some additional
documentation on tools integrated into Veil,
as well as guides to developing your own payload.