OK, so before we can get into actually, you know, creating custom malware and explaining this one
to CentOS, we have to talk about how to transfer our files over there in the first place.
You know, if we want to be able to execute our custom, our executables, we have to be able to transfer
it to the target system, of course.
So thankfully, we can do this with pre install software on the target and also some this on colonics.
Another thing that we're going to download as well, but some methods of transfer, you know, include
FTP, SCDP and CFT.
So we're going to focus on TFTP and I'm going to show you how to do that.
You can take your pick on which one you want to do.
OK, so over an hour, cowardliness machine first and then we're going to want to do is a pseudo NBT
install and the follow that we're going to install is a TFTP.
Now, this is going to be the TFTP server and it says I already have it installed.
So you get the situates password.
So it's going to say that I have the latest version installed.
Also, I don't think that my things on the Internet either.
So you're going to want to go ahead and install that and then we need to make a directory that we're
going to use for it.
So we used to ask Diaa TFT.
So this is going to do with make a directory in the root directory called FTP so you can just go ahead
and do that already have this created.
So I'm not going to do that.
I don't want to be in there.
So then what we need to do one more thing.
I'm going to see the pseudo S.H. own and then we're going to put nobody Colon's CFT here.
This is just going to change the permissions of that.
For that, we create it and just make nobody the owner is going to allow us to do the things that we
need to do with this folder.
So after you do that, we can start up the the damit, the service that we just saw.
So so the command for that is a TFT, PD and then space test as daming.
Now, when you see when you see the word Dayman, that just means that the service is going to be running
in the background and it's not going to be like outputting stuff once at a terminal.
So then you have a space port and then we're going to put Sixty-nine at this point that we're going
to want to use them.
We're going to put right here the directory that we're going to use as the home directory for Tsipi.
So this is going to be our Sebastiao FTP folder and then we may need to run as a pseudo I'm going to
do it anyway.
So and then bam, now we have the running.
So now we can go over to a compromise host.
We can just our desktop over the time.
Let's do our desktop.
And then the sea went on to it, one six, eight, five, six to one, and so make things easier every
time you do Dashti and declared the domain.
So we know the domain name is Ethical Hacking Lab and then dash you you put the user so we know the
uses poor victim and then we just hit enter and then it should connect us over and just give it a second
and we get to go.
OK, so what we can do, the first thing we want to do, like I said, is open up a command prompt.
So just type in the search for our ACMD and then now we can try TPE.
So Windows has it naturally installed.
So we're going to do TFTP and then we're going to put Dash I and then we're going to put the address
of our Kailin Xbox one zero one six eight five six one two seven.
And then we'll get to it and then we're going to put the filename.
So right now I have a in this last TFTP folder, I have a file called Test File Dot S.A.C..
So we're going to go ahead and get that already copied over is let me delete that and now let's do it
again.
And so now Chassidic successful is now, as we can see, this file is back here and if we open it up,
hey, this is a test text file so you can try to put any file over into that directory, that TPE directory
and then copy it over, then you should be able to copy it to the hopes.
OK, so remember how we started the Apache service before we're putting up the spoof website.
So we're going to kind of use that as well and we can use that for file transfer and actually access
the files that we put up here from our compromise post.
So what we can do is actually just start up the service again.
So pseudo service Apache to start.
And then once that started out, remember, the home directory is the VA first w w w e html folders.
So what we can do is actually copy stuff over there.
So there's a folder here.
So this is a pseudo there's a folder Oncolytics that has a bunch of windows, binary soldiers of the
basic one over here.
So we're going to Sepi.
So she was our share such windows resources, such binaries, and then we have a wide variety that we
can provide here.
We see where Incat that we can put over there.
So based on that Khaddafi, we wanted to use it.
Maybe we can put like a reverse, like a pine shell over there.
So we always connect over to it.
We're going to do who am I that you see, we're going to copy that over to our T ftp.
We're going to copy over to our slides w w or Vassos w w e-mail folder when you copy it over there so
we can go to a compromise holes and see if we can access file.
OK, so we're back on a compromise.
So let's open up a browser and what we're going to do is we're going to type in Asadi kind of there
right there on offer when we did the spoof, because remember, we can't we technically, you know,
capture the cards.
That's the address of my colleague's machine.
So we're going to put the slides and then we're going to type in the whoever I see and see what happens.
So now I was asking this, hey, do we want to run it savings so we could just save it?
And then now we have that folder, open folder just to verify.
Now we have this file locally on the system.
So now we know two methods of actually file transferring to our compromise.
So now we can go ahead and create custom malware.
OK, so before we do this, I'm going to show you guys just like the basic way of creating malware and
we're then we're going to do it a different way.
So first, what are you going to need to do is actually disable those Defendor?
Because it will block it.
But we're going to go over how to how to get past it later on so you can just type in Windows Defender
and you can probably just click on virus protection and let this load up.
And what we're going to do is actually see the scroll down for and theft protection Manege settings
and let's turn off real time protection.
And we technically know that this is for demo use, of course.
So I was going to ask for an administrative account to actually do this.
So I'm going to give it a second to load up and we go.
So, Administrator, because, you know, we technically made the account so we know the password.
And so now we had the real time protection officer.
Good to go.
All this other stuff already off.
So now we have real time protection off.
So what we can do is actually freely copy, you know, malicious files over.
So let's go back to our current Linux machine and let's try to create our first malware.
OK, so in order to create our custom malware, there's a software called Venom.
So that's the command that we're going to type in and we're going to give it a bunch of arguments.
The venom is just how you can actually create your custom malware, our custom payloads.
So let's start to give us some arguments.
So the first one is going to be DP and then this is going to designate the payload.
So we're, you know, go for windows.
So Windows slash interpreter.
So this means that we want to open them.
Interpreter Show pretty much an interpreter is like a program that allows us to remotely execute commands
it like do all kinds of amazing stuff on the house.
So we definitely want to try to get my interpreter shows.
And when I say Shell, I just mean like a remote session, like a remote session or something like that.
So then we're going to do a reverse underscore https.
So all that part means is that it's.
Connect back to our Ali leaving's machine over.
Yes, give us a little bit of encryption.
So the next day we're going to do our host and then we're going to put the callisthenics machine IP
service and then we're going to port.
So this the port that is going to connect over this is the port that we're going to be listening for
the connection to come back to.
So four four four four.
Let's just do that for now and then dash e we're going to choose an encoder and this is actually going
to encode our payload.
So it's not exactly detectable.
It still will be in the state that we're doing right now.
But there are ways that I'm going to show you the capacity.
And along with that, we do dash.
I would like something like seven.
So it's going to run it through the encoder like seven different times to kind of mix it up a little
bit, jumbled it up, and then dash f we're going to designate the file type.
So we want to make a file.
OK, and then we're going to get it assigned and then this is going to be the name of the output file.
So let's just do exploit easy and then we can just enter and it's going to go through and create the
payload usually takes about one or two minutes.
So just give it a little bit of time will come right back.
OK, so our payload file finished being created so we could do it less and then we could check it out.
So we see that the file is our exploit e e right here.
So what we can do is actually copy this over.
So I prefer to keep it's pretty quick straight to the point.
So Suto Kafi exploit e I'm going to put this in the last FCP folder copied over here.
I'm going to go back to my compromise host.
And I'm going to do the same command, but I'm going to put exploit, you see, so let's see what happens.
So Transavia successful.
So we see that the file is right here.
So before we run it, we have to go ahead and actually go into medicine and actually get ready to catch
this interpretor show that's going to be coming back to us.
So what is reverse its connection?
So we're going to go back to our colleague Gene Taylor himself, console and hit enter and then give
this a minute to load, and it takes a minute or two as well.
So we're going to come back once it's loaded.
OK, so we have a massive console up.
So the first time we're going to do is want to do use, exploit, slash, multi slash handler.
And this is just what you can use actually pretty much catch interpretor sessions that you're trying
to set up typically so to enter.
So now we're using that.
So we're going to want to set the payload to the same payload as what's in our executable payload windows.
Interpreter,
interpreter, slash reverse underscore a few tips so we set our payload.
So now there's another command that we're going to want to do is set auto run scripts and then we're
going to post windows.
So I manage my migrate.
This is going to make sure that, you know, our session migrates appropriately to the right process
idea that, you know, things really don't get dropped or runs into issues.
I want to make sure we have our connection solid.
So now we just have to set our house.
So you got two options if you want to see what the different things you the set are.
So I'm going to set our hosts one or two down one six eight five, six, seven set said Port four four
four four.
And I could just do another option just to check and make sure everything's right.
The payload looks right.
My dress looks right.
So now we're ready to launch.
So let's go ahead and type exploit, exploit.
That's cool.
So what we're going to do is just wait right here for a second and now it's the start of a reverse handler.
So now our machine is listening for connection over four four four four.
So let's go back over to our Windows machine and let's try to launch this next week.
So what I notice is that when I run it one time, it didn't work, but when I double click it twice,
it typically connects over something that connects to first time.
But if it doesn't work the first time that you double click it, just go ahead and go back.
So you double click and see what happens.
So it didn't do it.
So let's just give it a second and just see if it worked.
So just give it a minute and might take a second to connect.
OK, so now we have a return of the shell, as you can see.
So you type in help and there's a lot of different commands that we can do, you know, over on here.
So as you can see, you can record stuff in the microphone.
You can check out the web cam, all kinds of stuff that you could enumerate, all kinds of information
we can, you know, don't what stuff the typing like, you know, with like a key, a key logger, all
kinds of stuff.
So interpretor is definitely helpful to you.
Definitely want to aim to get an interpreter.
So when you're, you know, exploiting these systems.
OK, so now we know how to put malware onto the system, but what about if Windows Defender or something
is on?
So it's going to detect stuff.
So like, for example, I term Windows defender, real time protection back on.
So if I actually go, let me see.
Let me delete this file.
I was actually not going to do it because Windows Defender probably already had already found it, so
we can't copy the file over anymore if we wanted to if we try to do the same exact thing.
They can't write.
And then a problem with, you know, virus protection right here.
So what we're gonna do is actually to bypass the antivirus system.
So the way that we can do that, just a series of steps and a software called shelter.
So let's go back to our machine and check that out.
OK, so we're going to create a new payload and a victim again, and then we're going to dash P and
then we'll Windows interpretor and then we're going to do this time we going to reverse underscore TCP
connection and then say things before put our host one on to the one six eight, six, seven, and then
I'm going to do outport this time as Port 80.
You know, I'm not too suspicious.
All right.
And then we'll be coded again with the same exact Encoder Shikata gunnii.
There we go.
And then we're going to iterate through seven times with the encoder.
But this time we did a dash f we're going to do we're going to put it in a raw format.
So it's not going to exactly be easy.
And then we're going to put that into a file that we're going to call Meqdad been.
So this isn't exactly on an executable file.
We can still use this and inject it into an actual file and have that run when we put it on to the host
so we can go ahead and do that, give it a second and let that finish up, OK?
So our new payload is complete, so we just do less and actually verify that is there.
So if you look for we'll see our Medoc been file right there.
OK, so the next thing we're going to want to do is actually go and download.
So as you know, PURRY is like a tool.
So what we can do, I need to get on connection right here and then get on to the Web.
I really have to do is just Google like Pudi download or something.
So that's all I'm going to do really quick.
Let me get in.
There they go.
Party download.
There you go.
And then it's like the first link that pops up.
So you go to download and what we're going to do is actually download the X file, not the M as I file.
So if you just scroll down, you'll see that there is that data to be 64 bit.
You can grab either one.
I, I have found success with the 32 bit and actually that's what we need to use this other software
that you can use and inject, you know, payloads into executables.
But the one that we're using is actually going to use a thirty two, but it can only take 30 to be a
file.
So we're going to download this.
So you can download it and then it's going to be in your downloads folder.
I already have it.
So I have a folder to see payloads and then I have this file right here that Putti 30 to see.
So what I'm going to do, I'm going to back out really quick.
I'm going to keep my met, been into this payloaders folder.
See, there you go.
So now let's go back to payloads and then I have my party father and copy over here to is a copy see
squiggle downloads and then should be putty.
I think I've changed the punditry to.
Yeah.
So this is the default file on the copy over to here.
So party three two.
I see.
I'm going to override the fathers in this directory that I'm in and through Asuda to do that.
There we go.
So now we have this stuff that we need in this folder.
So the next day we're going to do is actually install this application called shelter.
So you're going to be able to install shelter.
And when you try to do that, it's probably going to tell you that you have to do some other a couple
of the commands.
So what you're going to need to do is Suto deep.
Kaiji downstairs and there's architecture.
And then I three, eight, six, two.
And Symbol's is just to give another batch commands a pseudo ABC does get an update and then you to
do another batch command.
So and and pseudo ABC Dasch you install one three two and one three two allows us to compile 30 different
Windows applications, you know, on our Linux machine.
OK, so once you do that, you then start try to install shelter again in a shelter with two L's.
So once that's done and it's all downloaded, we can erase this and we're going to run shelter.
So let's go ahead and run Suto shelter Souto.
So the.
And then it's going to take a second and it's going to pop up with this window, kind of neat little
graphic shelter, so choose operation mode.
So what we're going to do, want to do a Oromos and we're not to worry too much.
So now the P target is going to be the fire that we're going to inject our payload into, which is that
might have been found.
So the farther we're going to inject that form into is the to take some of the home slash Calli slash
payloads, slash Pudi 30 to EXI.
OK.
So now was going to see this next step takes like 30 to 60 seconds, so just give them some time to
come right back.
OK, so our 60 seconds have passed, so now I was going to ask us if we want to enable stealth mode
where this is going to do as kind of like stealthily put it in there so that the file tax will still
execute as needed as is originally intended to.
You could do that if you want.
I found less success with that and actually got detected when I would do that.
So we can do no for a naval stealth mode.
So now is as good as our payload.
So you know, what the payload is, is an interpreter.
So in terms of the payload, so we can we want to do a custom one.
So we're going to do a capital C and ask for the payload.
So we're going to give it the full directory forces us home.
So the scaley sized payloads slash yet been found.
And then it's going to ask if it's a reflective downloader.
We're just going to say no to that because it is not.
And then now it's going to go through and inject it in there and it's going to give you a confirmation
and then you just enter.
So there we go, injection verified enter.
And now we know that our priority to the file is now inject it with our panel.
So let's copy this over to our TV folder.
So pseudo S.P. Putti three to see.
So today, the TFTP Bam!
So now we know that it's over there.
So now the moment of truth is going to are our compromise hosts.
So let's try this again.
Oh, I connected to the Internet, so it was disconnected me from that.
So give me a second and I'll get right back on here, OK?
So I'm back connected to my host, so I'm going to try to it again.
But this time we're going to do Putti 30 to date.
Now let's see what happens.
Oh, it's already here.
So actually I need this files.
So give me a second.
I need to delete this one is a friend of mine.
Give me trouble.
Let me try to delete this really quick.
There we go, cool.
OK, so that's delete it, so sorry was a.
You have to be it to accept transfers successful, so before we try to transfer to exploit that easy
fall, it could have righted because what was the film was detecting it as malware.
But now after we went through shelter and injected into an innocent file.
Now it's undetectable by antibodies, so we can confirm that is over here, Pudi, 32, so we know that
that is there.
So what we can do now, we need to go back before before we execute it.
We need to go launch a massive consolo again.
So already have it up here.
So the only thing we're going to do here is actually change the payload.
So it's set and actually change the payload window.
Slash interpreter slash reverse underscore t, c, p.
There we go.
So now we're also going to sell for 80.
We're going to exploit and it's going to we have to do this as actually a song about the I actually
know because Apache is running.
So that's actually close off Apache right now.
So pseudo service Apache to stop.
So now property should be free.
So now we should be able to exploit.
Permission not so you need to be zero, so I'm going to exit out, of course, Escudo.
I'll be right back.
OK, so I got everything back and running as a pseudo.
So those are our options.
We have a colonics machine there.
We're going to be listening over 80.
So let's go ahead and type in run.
And now we've got the same as before.
Start of reverse Tsipi handle import 80.
So now our machine is listening for a connection, a specific connection over for Haiti.
So let's go right to our house.
And I just had to execute this fall as it happens.
So once again you might have executed a couple of times for it to actually, you know, make that connection
back.
But this happens.
What I mean by the boom might take a couple of tries.
So go ahead and try it again and give it a second.
You see the little spinning, the circle right there spinning.
So something's happening.
So it's trying to reach out and make a connection.
So let's try to open it again and see what happens.
OK, so we gave it a second and now we're starting to actually capture that connection back to our machine.
Just do it on migration successfully and we're good to go.
So now we have an to show again, and we did that by bypassing antivirus.
That is amazing.
So now you have the power to bypass antivirus, whatever that you make you set to make sure that you
do follow these steps.
You'd be good to go.
So now you, my interpreter, and do all kinds of stuff like install a key logger for privilege, escalation
stuff, more system integration.
Once again, you can just type in help and you can see all kinds of stuff and you can try different
commands and just play around it.