‫Let's see how we can create a basic malicious windows executable using the MSF Venom tool, 64 bit Windows
‫eight is the victim system.
‫Choose an executable to use as a template.
‫The output malware will be the same size.
‫With this template file, I'm going to use Putty Dot Exec File as the template.
‫Let's copy Putty Dot Exact actually to work on it.
‫First, look at the IP address of the target machine here.
‫Callie.
‫You can use Wynn as a tool to transfer a file from a Windows system to a Linux system NCP secure copy
‫as a means of securely transferring computer files between a local host and a remote host, or between
‫two remote hosts.
‫It's based on the Sage Secure Shell protocol.
‫Now, since when FCP uses SSL protocol, you'll be sure the Secret Service is running on Caylee.
‫Check the status of the Secret Service using the Service SSA Status Command.
‫It's already active on my Ali.
‫If it's not running U.S service, as I say, start to start the SSA service in your county machine.
‫If you try to log in win, keep using root user, you may see the access denied message.
‫That means using SSA servers with root user is denied in your county machines.
‫SSA servers configurations either change the S-H servers config to be able to connect with root user
‫or create a new user to use SSL connections.
‫I choose to create a new user.
‫You can use add user or user add commands on the terminal screen or users interface to add a new user.
‫I've already added a user before SSA to user for this purpose.
‫You can add a similar user to your system.
‫Connect with Skype using associates user credentials.
‫Find the exact file at the Windows side in this example, it's on the desktop of a current user.
‫Copy it to the Kalli machine in here to the home folder of SSA user in Kalli use is command in the terminal
‫screen to see if the file is transferred successfully.
‫Now we're ready to create a malicious executable using the Putty Dart exec file as a template.
‫Prepare the appropriate MSF venom command, the first parameter is Dash P, which specifies the payload
‫used.
‫You have to find the correct payload according to your target.
‫Don't forget to choose a payload with the correct platform, correct architecture, correct connection
‫method, etc..
‫You can see the available payload using MSF &mdash.
‫L payloads command.
‫There are a lot of payloads available.
‫And since the target machine is 64 bit, we can filter the results using grep command with pipe.
‫We use the Windows x64 slash metro to slash reverse underscored TCP payload for this example.
‫Let's have a pause here and have a small introduction to the world of Metasploit.
‫Metasploit Project is the most used penetration testing framework in the world.
‫It can be used to test the vulnerability of computer systems or to break into remote systems.
‫Metasploit was created by H.D. Moore in 2003, using Perl by 2007.
‫The Metasploit Framework had been completely rewritten in Ruby.
‫In 2009, the project was acquired by Rapid7.
‫Now they have a free and open source version, Metasploit Framework and a commercial version.
‫Metasploit Pro.
‫It's best known sub project is the open source Metasploit Framework, a tool for developing and executing
‫exploit code against a remote target machine.
‫The MSFT console is probably the most popular interface to the Metasploit Framework MSF.
‫It provides an all in one centralized console and allows you efficient access to virtually all of the
‫options available in the MSF.
‫MSF console may seem intimidating at first, but once you learn the syntax of the commands, you will
‫learn to appreciate the power of utilizing this interface.
‫Metro operator short for the meter interpreter is an advanced payload that is included in the Metasploit
‫Framework.
‫Its purpose is to provide complex and advanced features that would otherwise be tedious to implement
‫purely in assembly.
‫The way that it accomplishes this is by allowing developers to write their own extensions in the form
‫of shared object DLL files that can be uploaded and injected into a running process on a target computer
‫after exploitation has occurred.
‫Mature operator and all of the extensions that it loads are executed entirely from memory and never
‫touch the disk.
‫Let's continue to create a malicious executable using the NSFW Venom tool.
‫Now the first parameter was the payload.
‫We can choose the platform here windows.
‫But since we chose a Windows payload, the tool already understand the platform.
‫Same as the platform.
‫We can set the architecture x64 using the Dash charge parameter because we use a payload for x64 architecture.
‫The two already understand the architecture, so we don't need to use arch and platform parameters in
‫this example.
‫The next parameter is Dash F to determine the format of the output file.
‫You can use MSFT Venom Dash help dash formats to see the available formats.
‫We only use the exec in this example.
‫Then specified the template file using a Dash X parameter with the template file.
‫Named the output file with the Dash O parameter.
‫Now is the time to define the options of the payload, to see the options of the payload, you can use
‫the Dash payload dash options parameter with the payload.
‫We have to design the host and the L port options of the payload here.
‫Complete the command again, output file format.
‫Template file.
‫And output file name.
‫Now a sign Elle host and L Port options of the payload Elle host is the IP address of the listener machine.
‫In this example, our Carly Machine L Port is the port which will be open to listen to the sessions.
‫Hit enter to create the malware.
‫As you see, no watch is selected, the tool selected x64 from the payload and no platform is selected.
‫The tool automatically selected windows from the payload again, to be sure, go to the folder and see
‫the created malware.
‫The attacker should find a way to make the victim accept and run the malware.
‫Let's just copy the malware to the victim's machine at the moment and suppose that we send it as an
‫attachment to a phishing email.
‫First, let's try to copy the file to the Windows machine while Windows Defender is running.
‫As you can see, Windows Defender recognized the malware.
‫And deleted it in seconds.
‫Can you guess why?
‫Because we used a standard Metasploit payload, which is very well known, and Windows Defender recognized
‫it easily.
‫To see the payload in action, let's turn Windows Defender off and send the malware again.
‫As an attacker, we need to listen to capture the sessions of the victims who run the malware.
‫Start me off console.
‫You'll have a Metasploit Framework show.
‫Search for the handlers.
‫Use exploit multi slash handler, for this example.
‫In Handler, we have to use the same payload that we use in the malware.
‫List the options with show options command.
‫Set the listener address in port.
‫Since the default port is the same with the port we assigned in the malware, we can leave it as is.
‫And run the handler.
‫It starts to listen at that moment.
‫Now, go back to the victim machine and run the malware.
‫Voila, we got the session from the victim machine.
‫Look at the system info using this info interpreter command.
‫It's a 64 bit Windows machine.
‫Look at the User ID.
‫Metro operator has a lot of excellent commands to compromise the victim's machine.
‫Use help command to see some of them.
‫Let's take a screenshot of the victim machine.
‫When we list the currently running processes using task list command in the victim machine, we see
‫the malware running.
‫You can kill it using the task kill command with slash PID parameter.
‫Use f parameter to force it to be killed.
‫As soon as the malware process is killed, the Metro Pictures session dies as well.