>> Hey, guys. Welcome back to
the cyber kill chain course on Cybrary.
This is Abdulrahman Alnaim,
and today's episode we cover up weaponization.
Weaponization is the second step
of the cyber kill chain,
and in this step, we depend a lot on reconnaissance.
This is why I was saying spend
as much time as you can doing reconnaissance
because reconnaissance will give you
the base that you're going to
build the rest of the attack on.
If I go to weaponization
without doing proper reconnaissance,
I won't be able to build a weapon or
a payload that would work on the target machine,
because I'm guessing what the target machine is.
From now on, our assumptions
are the target machine is Windows.
We're going to use localhost.
From now on, all of the attacks are going to
happen within my virtual environment.
We're not going to communicate with
anything on the Internet.
Weaponization is a fairly passive step.
This step happens on my side or the attacker side only.
We're not going to communicate with the victim.
What we're trying to do here, as I said,
is build a payload that we're going to use later
on or deliver the following step to the victim,
to be able to install it and
then have control over the victim side.
There are two tools that we're going to talk
about today, Metasploit and Unicorn.
Metasploit comes built-in in Kali Linux,
it's an extremely popular tool.
There's a lot of documentation out there.
I'm going to leave a couple of links in
the resources page that I highly recommend going to,
because if you're looking to go into pen testing,
Metasploit is the tool you want to learn.
The other tool is Unicorn.
It's a tool that I stumbled upon few weeks ago.
It's a Python tool and it's extremely good
in evading protection tools. Let's jump right into it.
The first thing that we're going to
learn today is MSFvenom,
which is an add-on to Metasploit,
and our payload is going to be reverse_tcp.
Reverse_tcp is very popular because it
bypasses or uses the statefulness
of a firewall to bypass the control.
A firewall will block any communication
coming from the outside to the inside.
However, ethic communication and
a [inaudible] firewall is
triggered from behind the firewall,
the return packet will be automatically allowed.
As I said before, we're going to use localhost here,
so it's going to be my local IP.
Let me find it here, and that's my local IP.
That's the IP that I'm going to use from now on.
We're going to use port 444,
and that you can pick whatever port you want.
A lot of people tend to use the defaults,
so i5, and then we're going to
generate an executable space here,
and we're going to put it in root desktop.
We're going to call it payload.exe.
[NOISE] Once this create the payload,
you might notice that the payload.exe,
which is difficult to send
over email or get it to the victim,
and that's correct because
a lot of antiviruses and a lot of
email exchange servers will block any exe to be sent,
and for that, we're going to use the other tool
that I'm going to show you, Unicorn.
But before we get into Unicorn,
we're going to show you the output
of the payload of Metasploit.
There you go, that's the payload.exe.
Obviously, I cannot run it here
because I'm running a Linux machine,
but any protection tool easily detect a .exe file.
Let's move to Unicorn.
As I said, it's a Python tool.
It's a fairly easy Python tool.
We're going to run this exact same command that we
run before out of
the exact same payload that we did before,
the reverse_tcp,
but this time it's going to be reverse_https,
the same IP 21.
Because it's a reverse_https, we're going to use 443.
While it's generating,
the payload is going to generate two files.
The first one is the text file, which will be
>> delivered in the next phase to the victim.
>> The other one is the rc file, as you can see here,
and that's going to configure MSFconsole or
Metasploit to be able to execute
>> and create the listener.
>> Let's add that here,
and that's the powershell.text, and that's unicorn.rc.
We have a number of true or false questions
for our post-assessment questions.
The first one is weaponization phase is
independent from reconnaissance and can
be done in parallel with it,
and the answer here is false.
As I said, reconnaissance
is the most important step.
You cannot go to weaponization.
You won't create a collect weapon
if you bypass reconnaissance.
The second question is in weaponization phase,
the attacker is actively trying
to access the victim's node.
Again, that's incorrect.
False because weaponization is
a fairly passive phase and we're not
going to communicate with
the victim during the weaponization phase.
Finally, Metasploit will
produce a text file and .rc file,
and that's also incorrect.
As you saw, Metasploit created
an executable that we are
supposed to get somehow to the other side.
Obviously, this can be done if they
have an open FTP port
that has access to a Windows server,
you might be able to get it there.
However, any antivirus or
any anti-malware tool, or IPS, or IDS in the way,
would actually detect that executable file
and most probably block it in most cases.
However, in Unicorn,
we created a text file that we are
going to use to send to the victim
and a .rc file that we're going to use to
execute and create the listener.
In today's episode, we cover the weaponization phase
>> and we went through a couple of
>> examples in Metasploit and Unicorn.
In the next episode we will cover delivery.
>> See you then.