So typically when MSRA Venom runs, the payload is embedded into the default executable template at
data template template Dot Yuxi.
Although this template is changed on occasion, antivirus vendors still look for it when building signatures.
However, MSF venom supports the use of any Windows executable in place of the default executable template.
The important point here is you should take very good care about not disturbing the usage experience
of this system, owner or user, and the best part about it is it's extremely simple.
So why don't we embed Métis Boit payload in an executable?
First off, you're going to need a Windows executable file so you can either download or use what you
have already.
So I'm just going to download the ESET Nöjd 32 initial download or file to embed the payload.
So open up your browser and go to the ESET website.
If you scroll down a little bit.
Click on the download button.
And it will redirect you to a download page, click on the download link and save the file.
Now open and terminal and then type in MSF Venom P Windows interpretor.
Reverbs Tsipi.
Almost equals 10, 10 to 11, an airport equals four, four, four, three.
Platform is Windows.
Architecture, 32 bit.
File tape will be Windows executable.
No encoding and iteration then acts to specify a custom executable file to use as a template.
So in my case, it is ESET nod to antivirus Leive installer and OK to preserve the template file behavior
and inject the payload as a new threat.
So now let's give a name to the output file.
And I'll use the same name, as you said, not 32.
So the files generated LRC.
And it's here in the malware directory and let's see the result of the final command, so it's a 32
bit GUI Windows executable.
Now, for the most part, when a targeted user launches a back door executable like this, if nothing
appears to happen, it can raise suspicions.
So to improve your chances of not tipping off a target, you can launch a payload while simultaneously
continuing normal execution of the launched application.
But for now, you just embed the payload into an executable template.
All right.
So now you're going to need a handler.
So open MSF consul and the handler template is already chosen.
Show me the options.
And there's nothing to change except airport, so said airport two four, four, four, three.
But you're going to need to set another variable also, so as soon as the user launches the malware,
you need to jump to another reliable process.
So let's see, in our case, you're going to do this, but you can also do something else.
So show advanced.
And here's a variable auto run script.
So this variable specifies what to do first if the exploitation is accomplished.
So in other words, in this particular scenario, you're going to need to migrate a reliable process.
So then that means set auto run script to.
Post windows, manage my great.
With the parameters name equals explorer dot XY and spawn equals false.
So then after exploitation, the script will run and migrate to explore XY.
OK then let's hit Exploit J.
Go back over to Métis Portable three.
Refresh the page and then download it and save it.
You said not 30 to file to the desktop.
And there's the fire, so let's double click it and launch it.
So did you see that this session open and immediately upon opening the session, the post module is
executed, so there we have it, we've successfully migrated to explore.
So sessions.
Interact with Section five.
Get Eweida this info.
And yes, this is what you want.
Now, unless a user closes the computer.
You can move around anywhere you want.