WEBVTT 00:00:02.140 --> 00:00:04.560 All right, it's time for our first demo of msfvenom, 00:00:04.560 --> 00:00:05.840 and in this lesson, 00:00:05.850 --> 00:00:08.250 we're going to take a look at how to generate a malicious 00:00:08.250 --> 00:00:10.650 payload within a standalone executable. 00:00:11.140 --> 00:00:12.930 Once our target runs this executable, 00:00:12.940 --> 00:00:15.950 the payload should allow us to obtain access to a target machine. 00:00:16.440 --> 00:00:18.360 We'll also want to make sure when we're generating our 00:00:18.360 --> 00:00:21.370 payload to select the appropriate shell to generate based 00:00:21.370 --> 00:00:23.340 on our goal from this exploit. 00:00:23.340 --> 00:00:27.190 This type of payload generation is used when we want a user to 00:00:27.190 --> 00:00:29.650 actually run an executable that we send them. 00:00:30.340 --> 00:00:33.620 And, of course, once we generate this executable with malicious payload, 00:00:33.620 --> 00:00:35.650 we'll test it on our target VM. 00:00:36.740 --> 00:00:39.950 But first, a quick overview of the lab environment I'm using. 00:00:39.950 --> 00:00:41.230 For this course, 00:00:41.240 --> 00:00:45.420 I'm using a Kali Linux VM where I'll be generating our shellcode payloads and 00:00:45.420 --> 00:00:48.790 using it to create some exploits for vulnerable software. 00:00:48.790 --> 00:00:52.950 Our vulnerable machine for this course is a Window 7 developer image. 00:00:53.540 --> 00:00:57.160 The demo files contain links to the software that we'll be exploiting and this 00:00:57.160 --> 00:01:00.440 developer image so you can download it and follow along. 00:01:00.440 --> 00:01:04.230 The demo files for this course also contain working versions of the 00:01:04.230 --> 00:01:06.750 scripts that you'll see me use in other demos. 00:01:07.340 --> 00:01:08.760 I'm sure you're excited to get started, 00:01:08.770 --> 00:01:11.280 so I'm going to cut straight to payload generation in this demo. 00:01:11.280 --> 00:01:12.360 In the next one, 00:01:12.370 --> 00:01:14.720 we'll go over a few different options that are available 00:01:14.720 --> 00:01:16.350 in venom that you might want to use. 00:01:17.040 --> 00:01:19.950 But for now, let's take a look at some of our payload options. 00:01:21.240 --> 00:01:21.940 In order to do that, 00:01:21.940 --> 00:01:24.730 I'm going to use the ‑‑list payload command and grep for 00:01:24.730 --> 00:01:27.660 Windows‑specific exploits since my target workstation is a 00:01:27.660 --> 00:01:30.660 Windows VM. Scrolling through the output, 00:01:30.900 --> 00:01:33.550 we'll see a lot of different options like bindshells and 00:01:33.550 --> 00:01:36.040 reverse shells, vut for this example, 00:01:36.050 --> 00:01:38.450 let's go ahead and try to generate a Meterpreter shell. 00:01:39.240 --> 00:01:42.490 Specifically, we're going to use this Meterpreter bindshell for our payload, 00:01:42.490 --> 00:01:47.500 so let's cut back to our command, adding in that payload option. 00:01:47.500 --> 00:01:55.380 Now we're going to go ahead and specify an x86 architecture in exe format, 00:01:55.380 --> 00:01:57.550 since we want a standalone executable, 00:01:58.740 --> 00:02:02.950 and send this out to a file called bind.exe. 00:02:03.830 --> 00:02:07.350 And last, we'll specify a Windows platform. 00:02:08.840 --> 00:02:10.050 Let's see what happens. 00:02:10.050 --> 00:02:13.940 And once it's complete, we see our bind.exe file has been generated, 00:02:14.020 --> 00:02:17.750 and we also see a file size here, and the total size of our payload. 00:02:19.140 --> 00:02:22.660 And now we have to find a way to transfer it to our target machine. 00:02:22.670 --> 00:02:25.820 So normally, if we were running some sort of an attack, 00:02:25.830 --> 00:02:29.960 we would probably set up either a link to download the file 00:02:29.970 --> 00:02:32.640 or send it to them directly in some way, 00:02:32.640 --> 00:02:35.650 or maybe just place it on a USB drive and see if 00:02:35.650 --> 00:02:37.850 anybody starts it up on their machine. 00:02:38.440 --> 00:02:42.870 But for the purposes of this example, I'm just going to transfer it over HTTP, 00:02:42.870 --> 00:02:49.950 so I'm going to copy this file over to our web directory and start Apache. 00:02:49.950 --> 00:02:53.770 And then we'll go over to our target machine and complete this transfer. 00:02:53.770 --> 00:02:58.750 To transfer the file over to our target, we're just going to use PowerShell. 00:02:59.640 --> 00:03:02.870 So in order to do that, we need to enter two commands, 00:03:02.870 --> 00:03:05.840 and these will be placed in the demo files, but if you also 00:03:05.840 --> 00:03:07.440 want to pause the video and just type them, 00:03:07.440 --> 00:03:10.920 you can do that. Then once we have that, 00:03:10.920 --> 00:03:13.750 we can verify that that file did in fact transfer over. 00:03:14.740 --> 00:03:17.850 So now let's run it and see what happens. 00:03:18.840 --> 00:03:20.730 Okay, it didn't look like anything on this end, 00:03:20.740 --> 00:03:23.450 but let's head over to our attacking machine real quick. 00:03:26.340 --> 00:03:29.740 And we'll just run a quick nmap command to see if port 00:03:29.750 --> 00:03:34.150 4444 is open on our target workstation. 00:03:35.140 --> 00:03:38.010 And it is, which means are exploit is successful. 00:03:38.020 --> 00:03:41.730 But now how do we take advantage of this now that we have this port open? 00:03:41.750 --> 00:03:46.250 Well, we remember from our payload selection, we chose a Meterpreter shell. 00:03:46.940 --> 00:03:54.600 So let's open up the Metasploit Framework, zoom in a little 00:03:54.600 --> 00:03:58.110 bit to make it easier to read, and we'll go ahead and enter a 00:03:58.110 --> 00:03:59.950 few commands to connect to that. 00:04:02.040 --> 00:04:03.680 And then we're going to set the payload to the 00:04:03.680 --> 00:04:05.850 payload that we selected in venom. 00:04:07.010 --> 00:04:11.300 Just take a quick look at the options that exist there, so the 00:04:11.300 --> 00:04:13.320 particular port that we're trying to connect to, 00:04:13.400 --> 00:04:19.260 which is already 4444. But if we had to set that to 00:04:19.260 --> 00:04:21.149 something different, or you did, 00:04:21.399 --> 00:04:24.950 then you could just set that. And then we need to set the 00:04:24.960 --> 00:04:29.650 remote host as well to our target IP address. 00:04:30.440 --> 00:04:35.860 And then once we've got all that set up, hit exploit, and we see that 00:04:35.860 --> 00:04:38.550 we have a Meterpreter shell open with our target. 00:04:39.140 --> 00:04:42.450 So just a quick recap to summarize, we dove right into this 00:04:42.450 --> 00:04:44.900 lesson and generated our first shellcode payload, 00:04:45.060 --> 00:04:48.950 and we used it to generate a Meterpreter bindshell in a standalone executable. 00:04:49.540 --> 00:04:51.920 We transferred that over to our target workstation. 00:04:51.990 --> 00:04:53.700 And when we ran that executable, 00:04:53.700 --> 00:04:59.120 we successfully opened a Meterpreter bindshell on port 4444. Now that 00:04:59.120 --> 00:05:01.450 you've generated your first successful payload in venom, 00:05:01.840 --> 00:05:05.140 let's go back and look at some of those other options available and discuss 00:05:05.140 --> 00:05:07.450 different scenarios that we might need to use them for.