WEBVTT

00:00:02.040 --> 00:00:05.650
Would you like to learn how to use a tool that can generate shellcode for you?

00:00:06.240 --> 00:00:08.460
Do you need a tool that can generate a variety of

00:00:08.460 --> 00:00:10.750
different payloads to add to your exploits?

00:00:11.240 --> 00:00:14.310
Well, if that's what you're looking for you came to the right place.

00:00:14.550 --> 00:00:15.110
Hello,

00:00:15.180 --> 00:00:17.980
I'm Matt Glass and in this course I will show you how to use

00:00:17.980 --> 00:00:21.200
msfvenom to generate shellcode payloads for a few different

00:00:21.200 --> 00:00:24.870
scenarios. We will see how venom can be used by hackers when

00:00:24.870 --> 00:00:27.790
exploiting vulnerabilities to get a Command shell on a target

00:00:27.790 --> 00:00:30.840
device and take control. In this course,

00:00:30.850 --> 00:00:34.580
I will also show you how to use venom to generate your own payloads and use

00:00:34.580 --> 00:00:37.350
the same methods to take control of a vulnerable target.

00:00:38.440 --> 00:00:40.600
But before we get to how it's used let's take a

00:00:40.600 --> 00:00:42.650
moment to understand what venom is.

00:00:43.240 --> 00:00:45.330
Venom is a part of the Metasploit Framework.

00:00:45.400 --> 00:00:48.450
In fact, that's actually what the MSF in the name stands for.

00:00:48.940 --> 00:00:53.850
Metasploit was created by H.D Moore in 2003 and is now owned by Rapid7.

00:00:54.340 --> 00:00:58.470
Venom is actually a combination of two other tools, msfpayload and

00:00:58.470 --> 00:01:03.140
msfencode. As the names of the original tools suggest, these tools provided

00:01:03.140 --> 00:01:05.770
a method of creating a payload and then encoding it.

00:01:06.540 --> 00:01:09.280
These functions are now contained within one tool, venom.

00:01:10.340 --> 00:01:12.260
If you're wondering how you get msfvenum,

00:01:12.310 --> 00:01:14.970
well if you're running Kali Linux it's preinstalled

00:01:14.980 --> 00:01:16.650
and no further action is required.

00:01:17.440 --> 00:01:19.680
If you need to obtain it though you can get it by

00:01:19.680 --> 00:01:22.100
downloading the Metasploit Framework from Rapid7.

00:01:22.940 --> 00:01:25.910
The payload generation portion of the tool allows you to generate

00:01:25.910 --> 00:01:28.750
shellcode that can perform a variety of functions on a target.

00:01:29.070 --> 00:01:31.450
These include creating bind and reverse shells.

00:01:32.140 --> 00:01:35.060
Venom allows you to generate shellcode to fit a variety of different

00:01:35.060 --> 00:01:38.560
scenarios and then encode that payload to eliminate characters that

00:01:38.560 --> 00:01:40.550
your target will not interpret correctly.

00:01:41.220 --> 00:01:46.050
These functions are used in the exploitation and escalation phases of an attack.

00:01:46.840 --> 00:01:48.870
Depending on the vulnerability you're exploiting,

00:01:49.030 --> 00:01:51.250
these actions may occur simultaneously.