To compromise the victim systems, we prepared some malicious software and forced the victim to run
the malware into their systems so we can open a back door or steal some data or gain a session, et
cetera.
Before talking about the customer payload creation, we need to see a few terms to make the subject
clearer.
Most likely, you already know the terms we'll talk about in this slide, if so, just jump to the next
one.
Malware, it's a short form of the term malicious software.
It's a kind of software that's used to compromise the computer systems.
It's an umbrella term used to refer to a variety of forms of hostile or intrusive software, including
computer viruses, worms, Trojans, ransomware, spyware, adware scareder and other malicious programs.
It can take the form of executable code scripts, act of content and other software.
Payload inside malware is the portion of the malware which performs malicious action, Métis Foyt framework
is one of the most known terms in the cyber security domain as the open source sub project of the Métis
Boyd Project Metastable Framework as a tool for developing and executing exploit code against the target
machine.
Even though their depreciated and removed from Métis Foyt framework, I'd like to talk about MSF payload
and MSF encode first their depreciated because their abilities are collected into a single tool, MSF
venom.
To understand what MSF venom does, it's better to talk about MSF payload and MSF encode first.
MSF payload was a command line tool that's used to generate an output, all the various types of shell
code that are available in Métis Point using MMFs payload, you can create an executable file, as well
as creating a payload to embed the file, the parameters displayed in the slide.
Give us some more about what the MSF payload does.
Most of the time, one cannot simply use Chalco generated straight out of MSF payload, it needs to
be encoded to suit the target in order to function properly.
This can mean transforming your shell code into pure alphanumeric, getting rid of bad characters or
encoding it for 64 bit target.
It can also be instructed to encode shall code multiple times, output the shell code in numerous formats,
see Perl, Ruby and one can even merge it to an existing executable file.
So most of the time this tool was used in conjunction with MSF payload.
MSF venom is the meta split's standalone payload generator.
It's the combination of MSF payload and MSF and code putting both of these tools into a single framework
instance.
That means MSF venom is a combination of payload generation and encoding.
You can do everything that you can do with MSF, payload and MSF and code.
You can generate a payload and code the payload, avoid the bad characters, use a custom template and
more.