Oh, everyone.
Welcome to another video of our man in the middle attacks.
Today, we're going to use a tool called Show Cloke.
I wrote this to myself.
You can download it from my GitHub channel.
I just copied.
And download.
Channel Cloke is a new in a new technique to beat antivirus by making the browser to download our show
code to its history database.
When when we put our base64 zip code in our HTML file and split it in three parts, then we use a series
of free directions using JavaScript between each one of them.
The browser will store each part as a visitor material in its history ESKIL database.
Then when the target download the payload or the file and open it, it will combine the three parts
of the shell code from the browser history and execute it using power shell.
First thing we need to do is to install mint.
Mean W.
It's reinstalled second opinions to use is to do the copy base64 ruby file to the user Sheremeta Support
Framework Module's encoders base64.
If you don't have the best 64 directory, just create it and copy this file to it, OK?
Once you're done, go to show Cloke and then make sure it has executable permission and execute it before
we do anything, let's go here and open a massive console when our IP address port four four four four.
And listen, using the payload, when does the interpreter reverse GCP?
Because this is the one we are going to use in our show Cook.
Once it's done, you will ask you to enter the first pattern.
You can just enter anything like p0 you, G.H. anything, enter the second one third.
Cotinine.
Good.
Now, if you go to a bar w w w dot, um, Strachwitz Temel, let's open the free and exciting e-mail.
This will load the cyber address open to cyber dodgiest.
You will find the first part of our base64 shall code and.
If you go to the very end of it.
You should see the first pattern that we entered you, I, uh, you.
H g.
Now let's go here when our Windows box and try to browse the IP address of this box, which it has the
web server.
If you didn't notice a series of redirections happened, but it was very fast, eventually it gave you
this page so it will detect the browser.
Also this download C is for Chrome and just download H.M.S. for Firefox.
Now let's download this one.
Good, if we go to you and you can tell me which it helps with no distribute, we can also try and scandals.
As you can see, only one out of twenty six detected, despite everything else is clean.
If we go to our default, the user at local Google Chrome user data default and then open the history
file.
Notepad or something.
Let's look for the first pattern.
It's there, our show is inside the history database, read it.
You also will find the other two parts of the show.
This is just the first part.
Each one has a pattern.
Let's open the file.
Very good that our interpreter.
Once we are done with this and the history database is infected with our Chalco, we can still combine
this tool with beef exports if we go back to our server here.
And entered the main.
The main file of the chrome, which is.
Download the e-mail, we can inject the JavaScript here, since this is the last page the user will
visit.
Let's do it.
Let's go here and put our JavaScript.
He looks good.
Now.
Supination.
It's to be under control, panel, when this metamorphosis from now.
OK, so let's visit the same page again.
Assuming this is the first time the user is visiting our website over.
Same thing happened.
It's not you.
I just don't see that Schimel, because I missed double quotes there with Schreibman.
We got her Hertog.
So this time of using social engineering and we go to something like fake notification bar and chrome
at this time, we want to give it the euro, our web server.
Now, if he execute this.
First, let's make sure type the name is correct, Rev shall not be executed.
Now, here, the user can see this console missing plugins.
And he will download the report, shall, of course, be downloaded before this is the second time using
beef exports US and if his Kanzaki will be undetected and we already infected the database, the history
database with our base64 show code.
So this should work.
We try again.
Here executer again.
Just start more and they're running again.
We got our interpreter session, so this was a quick demo on how to use your cloak and how to combine
it with exercise.
Thank you for watching and see you in our next video.