Hey everybody.
Welcome to Part Five of motorsport mini module.
We're gonna be going over MSF venom in this video.
Now MSF venom is in a nutshell a standalone payload generator by Metis boy.
Now what normally what this is normally done is when you build an exploit or you have one that you need
to change the payload out.
This is a good way to generate that payload using Metis points framework which you know in a general
sense you're not going to find anything malicious when it's generated by an approved Manus boy download.
However it's good to double check everything like if you know that you've generated the same payload
before and you validate that that is what it's supposed to be and you check it again occasionally when
there's new updates just double check.
There's been a lot of issues where attackers are getting access to repos and then they start making
code changes which might change the generation of payloads that are being used.
So always keep that in the back of your mind.
Anything can happen.
Nothing's 100 percent but this is generally a good place to do it so you can see up here we have an
example command MSF venom DSP for payload and then you can see this looks pretty similar.
Windows maternity reverse TCB and then we pass it the parameters like l host and then we if we we tell
it the output which is Dash F and then we want it in any XY and then the dash 0 or the type or the file
type is XY and dash over output is payload.
So if we wanted to generate a reverse interpreter shell in a XY format you can do that directly here.
So this is also a good way to do it but what we're going to be using is to generate the OP coded the
shell code itself to work with this.
So the way this kind of works is you want to do MSF.
And what we're gonna do is run to test Ash list payload so I want to show you guys the list of payloads
that are available and you'll find that they're almost I believe I believe are actually identical to
what meds Boyd has built in.
So you can see here it gives you the same examples all of the same outputs are the same just the difference
is the path that just starts with Windows it doesn't say payload Slash.
So MSF venom and we do dash P
then we take a look at let's say Windows interpreter such reverse peacekeeping.
So if we left this Aziz and we go out and run it but it's now what you see here is that no platform
were selected which is fine it's just default into Windows.
That's the directory that it was.
There's no architecture so it's using x eighty six no encoders are bad character specified in the total
payload sizes 341 bytes but you can see that this is useless.
We're not going to go to copy and paste this anywhere.
So that's what the dash F is for.
So if we did that if we did XY as an example Miguel I to look this up.
So what it's done is it's built the XY so we can see in here this looks pretty common for an executable
that we're kind of expecting so in this case we don't actually care about the executable.
We want it in up code.
So what we can do is we could tell it we want it and c or Python or anything else like that.
So if we take a look at python and we go ahead and let it dump the interpreter shell in Python it's
going to generate it into shell code and then provide us a nice little snippet that we can just copy
and paste this directly into our exploit.
Then as long as we use the word the variable buff we have our exploit.
So in most cases people use C because it generally uses a single format that doesn't care what the variable
is.
So you can just kind of copy paste the whole thing so you can see here we could just copy paste this
whole thing and then drop it in a variable in Python and it would work just the same.
So this is our shell code right.
So what happens if we have a bad character right in some cases the exploit so we're looking at have
a bad character list.
And normally a 0 0 is a bad character.
However maybe we want let's see let's say this character's bad right.
So we want to generate the payload again but without that character.
So if we do dash B for our character we go ahead and paste this in there.
We'll go ahead and run it again and tell it that's a bad character so we should be able to generate
this again without it.
However depending on how many bad characters you kick out it will generate it or it won't.
In most cases it tends to be bigger.
So if we take a look at the comparison this is three forty one and this is three sixty eight.
So keep that in mind also 0 0 the number of characters automatically added as a bad character because
any application is is going to reject that.
So in this case we see that we don't have that character anymore which is great so we've got it we've
got our character and then we will just copy paste this into our exploit code.
Now we can do DSW list encoders because there are some instances where it needs a specific encoder.
So if we find that certain character sets are being are being mangled for example can do help.
And so if we look at our encoders here we've got quite a few depending on what what you're wanting to
use.
This tends to be a good one that is pretty common.
So dash E is for encoder and we go ahead and use that particular encoder.
We'll go ahead and rerun our same exploit minus thing the bad character and then encoding the shell
code even further into a particular type.
Now in this case we can't encode it with that bad character.
So go ahead and clear out of that.
So there are some cases where when we encode it we're not going to be able to encode it would certain
bad characters with that encoder which means we can use different types of encoders if we want.
But you'll see that there are some times where in encoder needs a particular code for it to function.
And that's just the way things are.
You pick a different encoder or you might not need the code at all.
It entirely depends in a generic sense.
Try it without an encoder first and then go from there.
And if that's a problem then you'll have to take it a step further.
But that's more on the exploit development side.
So play around with this change the different payloads mess around with this.
In this case we didn't set any parameters.
And keep in mind that if you don't set parameters such as El host or anything like that you're going
to have a motor show that basically connects to nothing so if we took this show code and just copied
it in there it wouldn't work.
So keep in mind keep that in mind.
Go ahead and play around with this.
Get familiar with MSF and then you're going to want to know the syntax pretty much off the top of your
head for the most part you're going to find yourself coming back to this a lot when you're swapping
out Shell code because sometimes people put executing calculator or calc not EMC on Windows machines
as their shell code you definitely.
That's not useful to you from an it's from a red team or standpoint.
You can open up a calculator but you want to actually get a shell back so you can kind of go a little
further.
So again play around with this get familiar with the parameters and what sort of things you can do with
them as a.