WEBVTT 00:00:02.040 --> 00:00:05.130 Before we dive into the demos on msfvenom's capabilities, 00:00:05.140 --> 00:00:07.610 I want to take a moment to talk about where it fits in the MITRE 00:00:07.610 --> 00:00:11.070 ATT&CK framework. The ATT&CK knowledge base developed by MITRE 00:00:11.070 --> 00:00:14.990 categorizes adversary tactics and techniques into multiple categories 00:00:14.990 --> 00:00:16.950 to describe the adversary's behavior. 00:00:17.620 --> 00:00:20.680 The tactics are categories that cover different phases of an 00:00:20.680 --> 00:00:24.420 attack and allow defensive teams to model an adversary's actions 00:00:24.540 --> 00:00:26.550 and improve the defense of their networks. 00:00:27.090 --> 00:00:30.860 We'll cover two tactics that venom is used for, exploitation for 00:00:30.860 --> 00:00:34.850 privilege escalation and exploitation for client execution. 00:00:35.340 --> 00:00:38.330 Venom can accomplish this by enabling adversaries to generate 00:00:38.330 --> 00:00:40.980 payloads to use in a variety of different exploits. 00:00:41.620 --> 00:00:43.830 In this course, we'll look at two different scenarios that 00:00:43.830 --> 00:00:46.060 could occur in a real world environment. 00:00:46.830 --> 00:00:49.480 If an attacker wanted to take control of devices on 00:00:49.480 --> 00:00:51.500 Globomantics' network, depicted here, 00:00:52.240 --> 00:00:55.800 one option they have is to use venom to generate a payload and then place 00:00:55.800 --> 00:00:58.350 it on a website they host from their attacking machine. 00:00:58.820 --> 00:01:02.260 The attacker then sends a malicious link to their victim which when 00:01:02.260 --> 00:01:05.050 accessed directs the target back to the attacker's page. 00:01:05.540 --> 00:01:08.360 The shellcode is executed which allows the hacker to obtain 00:01:08.360 --> 00:01:10.250 a Command shell on the victim's machine. 00:01:11.130 --> 00:01:11.850 In this case, 00:01:11.850 --> 00:01:14.970 the attacker has taken control of HR's machine and can 00:01:14.970 --> 00:01:17.550 potentially access employees' personal information. 00:01:17.990 --> 00:01:21.950 Another scenario involves an attacker discovering vulnerable software running 00:01:21.950 --> 00:01:26.350 on Globomantics' servers and creating a script to exploit that vulnerability. 00:01:26.940 --> 00:01:30.700 The attacker generates a payload to create a bind shell and codes the payload 00:01:30.700 --> 00:01:34.110 to tailor it to the specific exploit and then run their script against the 00:01:34.110 --> 00:01:35.250 vulnerable application. 00:01:35.800 --> 00:01:38.120 The application executes the malicious shellcode, 00:01:38.210 --> 00:01:41.200 allowing the attacker to connect directly to a port the shellcode 00:01:41.200 --> 00:01:44.270 opens and escalate their privileges to the equivalent of the 00:01:44.270 --> 00:01:46.190 account running the vulnerable application. 00:01:47.040 --> 00:01:50.140 Depending on how the victim configures service accounts and the 00:01:50.140 --> 00:01:53.160 required privileges of the exploited software, this could give 00:01:53.160 --> 00:01:56.420 the attacker administrative privileges over the server and 00:01:56.420 --> 00:01:57.850 possibly the entire domain.