Welcome to part six of this module.
Last video we saw how to generate a payload and met a split using MSF venom.
We did this as part of an imaginary scenario where our opponent the network administrator was a not
so sapient chimpanzee.
In other words our target had no antivirus or defenses of any kind.
And while it is true that a shockingly high number of targets out there that you might be called upon
to penetration test have lax security or even no security at all.
We really can't proceed under the assumption that this will always be true.
If you recall we uploaded the payload we created to Virus Total and it was immediately detected by every
antivirus software out there as being a malicious piece of code.
This is obviously unacceptable.
So now it is time to start learning about encoders Briefly put we use encoders to encoder payloads and
obfuscate what they are.
The idea is that antivirus software is setup to recognize certain strings within code and encoders switch
these around so that they look different but still do the same thing.
Thus evading detection.
Granted what I just said is a gross oversimplification of a very complex and multilayered science but
I hope it's enough to give you the general idea.
In a perfect world we would all be coating geniuses and could do this in a unique way ourselves.
However very few of us have the time or inclination to figure out how to encode by hand.
Hence why met a split comes preloaded with a wide selection of encoders for use built right into the
framework itself.
A few years ago encoders were almost bullet proof.
Unfortunately as Carly and Metis Floyd have grown in popularity among penetration testers and hackers
alike more and more antivirus companies have begun to study the unique ways each individual encoder
works and then put out updates to detect encoded payloads.
We get around this with a variety of tricks such as using additional iterations in the encoding process
or even multiple different encoders.
The antivirus companies counter with additional updates and so continues the game of cat and mouse between
attackers and defenders.
For that reason you aren't going to see a method in this video to create a completely undetectable payload.
Even if such a method existed it would be obsolete soon enough.
As a wise man once said you can fool some of the people some of the time but you can't fool all the
people all of the time.
Fortunately for us we really don't need to fool every single antivirus software out there.
We only need to concentrate on the ones we are most likely to come up against.
In particular Windows Defender and Malware bytes.
This is also where reconnaissance of your target comes into play.
Most systems have one antivirus and maybe Malware bytes.
If you know what the specific defenses are and you can fool them that's really good enough so we're
going to start out by loading the MSF console if you need a refresher on how to do this.
We just type service post rescue will start and then MSF console.
Now obviously I've already done this because that tends to take quite some time.
We'll start off by typing MSF venom Tac tac help to see the optional switches that we'll be using.
Now we're going to do exactly what we did in the last video.
Only this time we're going to employ evasion techniques to try to get our payload around antivirus.
The encoders included with metal split are not the only or even necessarily the best method of doing
this by the way.
And at the end of the video I'll speak a bit more about other options.
Let's go over these switches really quick tack P is used to specify the payload we'll also be using
a second tack for custom payload.
We'll see this in the second example TAC f is going to be the output format for our payload such as
for example e XY bean or raw TAC is very important that is used to specify the encoder and is the crux
of this tutorial tech.
S isn't as important but I want to mention it even though I'm getting a little ahead of myself.
We won't be using this switch however you could use it to set a limit on the maximum size of the payload.
This is useful because the more iterations you tell the encoder to use the bigger the payload is going
to be.
This is generally the difference of maybe a few hundred bytes.
However there may be circumstances where you need to keep the file size perfectly consistent.
That is what this which is used for tech ie stands for iterations as the description says this is the
number of times the encoder will encode the payload.
In theory the more times the better in practice if a payload is being detected after about 10 to 30
iterations then it's time to consider using either a different payload or a different encoder or a different
set of encoders you can perform thousands of iterations if you want to but after a certain point in
either works or it doesn't and overkill won't really change that tack.
K is used to preserve the template behaviour and inject the payload as a new thread.
All this really means is that when we combine our payload with some other file to create a Trojan horse
that other file will behave normally when executed the payload simply gets attached to the end of that
file and run in sequence.
This isn't always a good thing and it can make the malicious code easier to detect.
But figuring out how to wedge a payload in the middle of another file and have that file perform normally
is outside of the scope of this tutorial.
And honestly it doesn't really make that much of a difference to the detection rate.
Tech X is template which is used to specify a custom executable file to append to our payload or rather
to append our payload to.
In reality it doesn't really change the file itself.
It creates a new copy of the file with the payload attached to it.
Tax C isn't something we will be using in this video either but this is a really advanced switch that
you can and should study.
If you really want to get into payload generation this allows you to append additional code to the payload
itself so that the code is executed along with the payload.
Again really advanced stuff but it is possible to do things like disable certain defenses or extract
information at the time that the payload is actually run and might even be possible to create a Windows
task that loads the payload at certain times of the day thus granting you access again in the future
when using the same method.
All right.
That was quite an info dump.
Now let's look at the encoders that we'll be using.
Keep in mind that your list may look different depending on when you watch this video as new encoders
are being released and old ones that become obsolete are at least in theory being removed from the framework
between updates so to bring up the list.
We're gonna do M S F of venom Tak El for list and encoders.
It'll take a few seconds for the framework to enumerate all of them.
Remember that this list are just the ones that come prepackaged with Cally other encoders do exist and
can be downloaded and added to the framework which is modular.
In fact you might be able to find better or less widely known options if you search online that have
better success rate because they are less mainstream and so the antivirus companies are less familiar
with them.
In any event here we have a list of all the encoders to start us off.
We're going to use the polymorphic additive feedback encoder Shikata and I hope I'm pronouncing that
correctly.
This encoder is ranked Excellent.
Which means it has been found to have a very good success rate in the past.
She can't deny as I understand it in Japanese means unbeatable.
Sadly it is far from unbeatable but it is going to be our starting point.
This is a 32 bit encoders so it will work best with 32 bit XY files.
Now I mentioned that this is a polymorphic encoder.
What does that mean exactly.
Well essentially a polymorphic encoder changes the encoding signature automatically and keeps changing
it to make the payload harder to detect.
We'll be needing our own IP address for our on our network.
Just like last time to get this we do I f config.
And we can see under a net right here.
Remember that yours will vary depending on your network setup once the IP is in hand.
We'll use it to set the El host.
Just like in the last video I'm just going to type out the command and then I'll go through this step
by step.
So it's going to be M S F venom TAC P windows forward slash interpreter.
Forgive my typing forward slash reverse DCP l host equals R IP address which in my case is going to
be 10 0 0 0 to twenty five.
We're going to set the L port and just like last time we're going to go with 444
tech K tak e and we'll specify x.
86 for its last Shikata underscore.
Underscore Nye Tak I 250 Tak f he XY.
Greater than sign.
Forward slash route forward slash desktop.
Forward slash.
And then we give the name of the payload in this case I'm just going to call it encoded payload.
Dot e XY nut like I said this is basically the same command that you saw in the last video we're generating
a Windows mortar printer reverse t C.P. payload MSF then I'm Tak P for payload we specify when as mature
printer reverse DCP although we could specify any payload that we wish to use and there are a lot of
them for the L host we again use our own network IP address and yours will be different for this demonstration
I'm keeping 4 4 4 4 for the L port just to make things simple and straightforward but you might consider
using a different port but that isn't really something we need to worry about right now and tak e is
used to specify our encoder and once again that is Shikata deny which is a 32 bit or X 86 encoder that
is highly rated the TAC AI is four iterations or the number of times that you want to encode according
to most documentation I've read ten is really the recommended value but such recommendations are more
than a year old and most antivirus software has come a long way since then.
So for that reason I've completely arbitrarily picked two hundred and fifty it will take slightly longer
of course and the more iterations you select the larger the payload file will be.
So keep this in mind you can get away with 10 if you think two hundred and fifty is overkill then we
select TAC F for the format that we want and specify XY for an XY file last we use the greater than
sign to specify the output file which we want on our desktop just to keep things straightforward you'd
probably want to give the file an innocuous sounding name but for just right now I'm going to call it
something easy to understand like encoded payload XY but remember whatever you call it may show up in
a task manager so you probably do want to give this a name that won't be noticed in any case we press
enter and this encodes our payload using Shikata Anni once encoded the payload should only be detected
by about maybe 50 to 60 percent of the antivirus is out there instead of 100 percent but keep in mind
this is just one way the easiest way of doing this there are additional steps that we can take to improve
our ability to evade detection
the important thing is that this method should allow you to evade Windows Defender at least to a certain
extent and it has a reasonable chance of slipping past malware bytes I'm not at all trying to suggest
that a 40 to 50 percent evasion rate is in any way great or something you should aspire to but it is
at least a starting point.
If we look at our desktop we can see that the file was in fact created now in the last video you saw
me upload an on encoded payload to virus total to show off how easy it was for such a thing to be detected.
You can upload your newly encoded payload if you want to.
If all you want to do is see how each new method improves upon your end victory evasion rate however
I don't recommend this unless you manage to create a payload that is 100 percent undetectable.
You need to remember that antivirus companies tend to share their data.
If even one of those antivirus scanners detect a virus the hash data and the other information will
be shared across the board and your payload will be obsolete within an update or to a better strategy
would be to create a contained virtual environment with a number of updated scanners like a Windows
virtual box and see if your payload is able to infect it without being detected and blocked at any rate
even at 50 percent.
Those are pretty bad odds Shikata Kanai was a good starting point but we need to take further steps
if we want to have the best possible chance of success.
Now it's time to add a second encoder into the mix and we will go so far as to attach our malicious
code to a file that looks safe.
So once again we'll bring up the list of encoders we've used a polymorphic encoder already so let's
choose another one using two encoders will give us a better chance that our payload will be able to
evade detection.
To this end let's select the blocks or metamorphic encoder.
This is block based and it will allow us to encode a raw file into an XY file template.
Since we are starting fresh I'm going to delete the old payload.
We now need to export this is a bin file in raw format that is the only format that you can use in this
case.
It's going to look like this NSF venom attack AP windows forward slash interpreter forward slash reversed.
CCP will set the L host once again it'll be the same network IP and we'll continue using for 44 for
the L port.
Doesn't really matter.
Tak e and we will once again select the X 86 Ford slash Shikata 9 Tak I for the number of iterations.
Which again is up to you.
10 is recommended.
I'm using 250 just because I feel like overkill Tak F for the format and this time we're going to specify
it raw instead of E XY the greater than sign for our output which is going to be for Slash root or slash
desktop forward slash and I'll just call it encoded payload dot been uh oh it hopes if we take desktop
correctly what we're doing here is essentially outputting the payload into a raw file.
It's the same one.
So Windows maternity reverse TGP we're keeping all of our old settings the same and we specified the
Shikata Ghanaian coder and this is our our first round so to speak.
And this shooting code fairly quickly in this case we did not need to select an architecture.
And that is because we're going to be using a template which again in this case is going to be an access
file but any XY file will work for this.
So you'd want it to be something that someone is likely to click on.
It's basically a Trojan horse.
Don't forget for this demonstration actually I'll pull it up for this demonstration.
I've selected the malware bytes community edition installer because irony if your target is a 64 bit
operating system or your file that you're attaching to is exclusively 64 bit and you can specify 64
bit architecture in the next step.
Now comes the complicated bit right.
So I've gone ahead and cleared the screen and we'll walk through this rather a long bit of code real
quick.
MSF venom TAC P for payload.
We give it an extra space and an extra dash then tack X for the XY file we want to use as our template.
Again this is the malware bytes installer in this instance TAC K which means we don't want to make any
changes to the malware bytes installer.
We just want to slap our malicious code right onto the end of it.
TAC F E XY says we want to create an EMC file as our final product TAC a is where you specify the architecture
I'm using x 86 for 32 bit but you could use X 64 we do Tak tak platform and specify windows.
This is very important.
Tak e for the encoder we want to use and then we give it x eighty six blocks or TAC AI for the number
of iterations and I'll just go with 10 4 for this instance and then we give it a greater than sign and
specify that we want our final product to be created on the desktop.
We would also probably want to name our file Malware bytes installer or something similar but I'm just
going to call it Final product for this video.
Then we use the less than sine and specify the path to the raw payload that we just created with Shikata
can I.
This is now taking the raw payload that we encoded with Shikata and I further encoding it with blocks
or then creating a new XY file that is going to be our Malware bytes installer with our payload attached
to the end.
In this case it's going to be named final product XY.
So when someone double clicks on this new installer Malware bytes will install and our payload will
activate right along with it.
Well that's the idea anyway using the polymorphic in conjunction with the metamorphic increases our
evasion chances significantly and that was also a really fun sentence to say out loud.
Now it's going through the iterations as we specified should be finished in just a moment.
And there we go and note the final payload size is related to the XY file that we used as a template
as well as the number of iterations.
And here's our final product.
Notice that the Malware bytes installer is still here.
So we would want to name this something like
Malware bytes installer or whatever.
Now if someone were to click on this Malware bytes would install and our payload would install right
along with it but that's not the last word on evasion not by a long shot.
The dance between hackers creating payloads of all sorts and antivirus companies is ongoing.
There are many many techniques that you can discover and employ several of them beyond the scope of
this tutorial.
This is a very deep well to dive into and remember also that the encoders that come with metal split
are not the only ones out there.
In fact you might have better luck if you find a few less well-known and coders online and add them
to the MET's flight framework.
If they're less well known it is less likely antivirus companies have their methods in their virus definitions
so that will be about it for the subject of encoders.
Remember you can try various combinations using the method shown here.
You need to get creative and really work at it though.
If you plan to go this route it is also an entirely different subject unto itself.
But I would be remiss if I did not point out that encryption is also an option where payloads are concerned.
There are many programs out there called cricketers which in terms of what they do are very much like
encoders but some of them have very high success rates.
Actually most serious hackers do not rely on the encoders that are built into Metis Floyd but either
design their own or pay real money to download cricketers from professional creators.
I'll touch on this subject a bit more in the modules on encryption and we'll talk about it again when
we go over bot nets.
But just for right now.
Note that there are still several alternatives out there.
If you find that the encoders are not satisfactory I will not be recommending any third party encoder
or scripture in these videos however.
So you must do your own due diligence and find such things on your own.
If this is something that interests you all right then that pretty much covers the basics of encoders
as always.
Never use anything demonstrated in these videos against any target that you do not have written permission
from the owner to penetration test abide by the law at all times.
Thank you for your attention and will pick up in the next video.