WEBVTT 00:00:02.240 --> 00:00:03.450 Alright, in this next demo, 00:00:03.450 --> 00:00:05.390 we're going to take a little bit closer look at the 00:00:05.390 --> 00:00:07.950 different functions available within msfvenom. 00:00:08.540 --> 00:00:09.210 In particular, 00:00:09.210 --> 00:00:12.940 we're going to focus on the options that involve the use of bad characters, 00:00:13.220 --> 00:00:15.230 the encoder, and the keep options. 00:00:15.610 --> 00:00:16.820 As we explore these options, 00:00:16.820 --> 00:00:20.110 we're going to discuss what they're used for like exploits that 00:00:20.110 --> 00:00:22.990 require the filtering of some bad characters and how to get around 00:00:22.990 --> 00:00:26.380 that. And we'll talk about how to select your bad characters and 00:00:26.380 --> 00:00:29.450 encode your payload using msfvenom and different reasons why you 00:00:29.450 --> 00:00:30.850 might want to encode the payload. 00:00:31.740 --> 00:00:34.280 We'll also discuss the keep option and how it avoids 00:00:34.280 --> 00:00:35.750 crashing the target application. 00:00:36.440 --> 00:00:39.520 Let's head over to our Kali Linux VM and start exploring some of the 00:00:39.520 --> 00:00:46.000 capabilities of Venom. To get started, we'll just do a quick ‑h to pull 00:00:46.000 --> 00:00:47.650 up the list of all the different options, 00:00:48.040 --> 00:00:51.400 and we'll talk about a few different ones. On top we just see 00:00:51.400 --> 00:00:53.850 another explanation of what msfvenom is, 00:00:54.240 --> 00:00:58.550 which is a replacement for the msfpayload and msfencode tools. 00:00:58.940 --> 00:01:00.520 The options start with a list option, 00:01:00.520 --> 00:01:03.250 which allows you to list different payloads, encoders, 00:01:03.260 --> 00:01:06.550 ops, platforms, formats, or list all options. 00:01:07.040 --> 00:01:07.540 If you remember, 00:01:07.540 --> 00:01:10.450 we used this in the last demo to list the different Windows payloads. 00:01:10.940 --> 00:01:13.350 We also have the payload option where we select that payload. 00:01:13.840 --> 00:01:17.560 We also see under list options that our payloads have additional standard 00:01:17.560 --> 00:01:19.750 and advanced evasion options that we can choose from. 00:01:20.640 --> 00:01:22.830 We also have format where we select the format of our 00:01:22.830 --> 00:01:25.240 output. In our last demo, we used exe. 00:01:25.410 --> 00:01:27.950 There's also other formats like Python or C. 00:01:29.140 --> 00:01:31.690 We have our encoder, which we'll talk about in a little bit, 00:01:31.790 --> 00:01:35.110 and that's what we can use to actually encode our payload. 00:01:35.110 --> 00:01:37.850 Architecture where we select different architecture options. 00:01:38.080 --> 00:01:39.650 Depending on the payload you select, 00:01:39.660 --> 00:01:42.370 you can actually leave this out and Venom will determine 00:01:42.370 --> 00:01:44.450 which architecture you're likely targeting. 00:01:45.140 --> 00:01:48.050 We have out to save the payload to a file like we did in our last demo. 00:01:48.540 --> 00:01:51.510 We have b, the bad characters filter where we can rule out bad 00:01:51.510 --> 00:01:54.080 characters if our exploit doesn't process them correctly, 00:01:54.090 --> 00:01:55.850 and we'll talk about that a little bit more in a bit. 00:01:56.540 --> 00:01:58.740 And down here we have the keep option, 00:01:58.750 --> 00:02:02.040 which allows us to inject our payload as a new thread and 00:02:02.040 --> 00:02:04.420 prevent the application from crashing in the process of 00:02:04.420 --> 00:02:06.150 running our shellcode during an exploit. 00:02:06.740 --> 00:02:08.850 So now that we understand some of the different options, 00:02:08.860 --> 00:02:12.290 let's take a closer look at some different formats and encoders that we can 00:02:12.290 --> 00:02:19.090 use. First on our list of formats are different executable outputs. In our 00:02:19.090 --> 00:02:22.790 last lesson, you may remember we used exe, but you'll see there's quite a few 00:02:22.790 --> 00:02:25.050 more output options that Venom can use. 00:02:26.740 --> 00:02:29.930 You can also output it to the screen for use in different scripts or 00:02:29.930 --> 00:02:33.160 other applications you might want to use like C, Bash, 00:02:33.220 --> 00:02:35.650 PowerShell, Perl, Python, or Ruby. 00:02:36.440 --> 00:02:39.270 We'll be using the Python format in the next demo and 00:02:39.270 --> 00:02:42.100 taking our output and pasting it directly into a Python 00:02:42.100 --> 00:02:43.910 script that we'll use for an exploit. 00:02:45.040 --> 00:02:47.820 Now that we've seen all of the different formats that Venom can support, 00:02:48.010 --> 00:02:51.050 let's take a quick look at encoders and talk about what they would be used for. 00:02:54.180 --> 00:02:56.880 So here's a list of the different encoders that you can 00:02:56.880 --> 00:02:59.050 use in Venom to encode your payload. 00:02:59.640 --> 00:03:03.230 Reasons why you would want to encode your payload are both 00:03:03.240 --> 00:03:07.250 avoiding antivirus applications and also filtering out bad 00:03:07.250 --> 00:03:08.750 characters from the shell code. 00:03:10.040 --> 00:03:13.030 Some of the applications that you want to run an exploit against will 00:03:13.030 --> 00:03:17.190 interpret shellcode characters as something other than what you want 00:03:17.190 --> 00:03:20.580 them to interpret them as. Some of the applications that you're going to 00:03:20.580 --> 00:03:23.770 run an exploit on have specific functions for different shellcode 00:03:23.770 --> 00:03:28.810 characters like the hex code 0 alpha or line feed and the hex code 0 00:03:28.810 --> 00:03:30.250 delta or carriage return, 00:03:30.640 --> 00:03:33.280 which could cause that line feed or carriage return to be fed to the 00:03:33.280 --> 00:03:36.140 application and prevent the rest of your shellcode payload from 00:03:36.140 --> 00:03:38.730 running. If there is an existing exploit, 00:03:38.740 --> 00:03:41.350 usually somebody will have already done the homework for you to 00:03:41.350 --> 00:03:44.500 determine what the bad characters are, and then you just need to 00:03:44.500 --> 00:03:48.100 remember to place those bad characters with the ‑b command when 00:03:48.100 --> 00:03:49.850 you're generating your shellcode payload. 00:03:50.640 --> 00:03:52.110 When you're finding your own exploit, 00:03:52.120 --> 00:03:54.880 you're going to want to test all of the different hex code characters 00:03:54.880 --> 00:03:58.010 and see how the application interprets it to be able to find your bad 00:03:58.010 --> 00:04:01.750 characters. When you select the ‑b option, 00:04:02.540 --> 00:04:05.860 msfvenom will automatically select the shikata_ga_nai 00:04:05.860 --> 00:04:08.400 encoder to encode your payload. 00:04:09.340 --> 00:04:11.400 If you want to specify another encoder, 00:04:11.410 --> 00:04:14.950 you can use the ‑e and specify any other encoder on this list. 00:04:15.540 --> 00:04:17.070 Now that we understand the different options, 00:04:17.079 --> 00:04:20.820 let's look at an example of payload generation using some of these commands. 00:04:20.820 --> 00:04:24.550 As we did in the last lesson, let's take a quick look at some different 00:04:24.550 --> 00:04:27.960 Windows payloads we might want to use. For this example, I'm going to use 00:04:27.960 --> 00:04:33.780 this 64‑bit bind shell option up here. So my final command will be # msfvenom 00:04:33.890 --> 00:04:39.950 ‑p windows/x64/ shell_bind_tcp. 00:04:40.540 --> 00:04:44.090 We would want to use the bad characters and add in some of 00:04:44.090 --> 00:04:45.940 the bad characters from our application. 00:04:46.020 --> 00:04:47.930 Let's just say we've already done our homework, 00:04:47.940 --> 00:04:52.340 and this application has the bad characters 00, 0d, and 00:04:52.340 --> 00:04:57.820 0a. And I almost forgot to specify a port that we want 00:04:57.820 --> 00:04:59.250 that bind shell to show up on. 00:04:59.430 --> 00:05:00.260 For this example, 00:05:00.260 --> 00:05:04.340 we used port 4444. Let's see what happens if we don't specify 00:05:04.340 --> 00:05:07.690 our architecture and don't specify an encoder, 00:05:07.820 --> 00:05:16.010 but also add the ‑k option and format this output in Python. And there we 00:05:16.010 --> 00:05:20.210 have our shellcode payload, and you'll see that it's already formatted for 00:05:20.210 --> 00:05:23.450 us to copy and paste into a Python script. 00:05:24.140 --> 00:05:27.740 And we see that because no platform was selected, 00:05:28.060 --> 00:05:30.460 it determined that Windows must be from the payload we 00:05:30.460 --> 00:05:33.170 chose because no architecture was selected, 00:05:33.220 --> 00:05:35.390 but we used an x64 payload. 00:05:35.400 --> 00:05:37.850 It chose the x64 architecture for us. 00:05:38.440 --> 00:05:44.110 It found two compatible encoders and failed to encode the first one due to 00:05:44.110 --> 00:05:49.330 one of the bad characters, x00. It tried the other encoder, 00:05:49.450 --> 00:05:51.360 which was x64/xor, 00:05:51.360 --> 00:05:57.650 which it succeeded in encoding our payload and the final size being 551 bytes. 00:05:58.540 --> 00:06:03.140 And you'll notice as we scroll through, it's already set up to add each of 00:06:03.140 --> 00:06:07.990 these shellcode lines to a variable buff. And we'll notice that it does not 00:06:07.990 --> 00:06:11.850 contain anywhere any of our bad characters. 00:06:13.740 --> 00:06:18.410 So this shellcode payload is set up to not only generate a 00:06:18.410 --> 00:06:20.750 bind shell, but also decrypt itself. 00:06:21.140 --> 00:06:22.610 So when we plug this into a script, 00:06:22.610 --> 00:06:25.750 we're going to need to leave it a little room in order to do that 00:06:25.750 --> 00:06:30.110 decryption. And you'll see an example of how an existing exploit 00:06:30.110 --> 00:06:32.250 already incorporates that in the next demo. 00:06:32.740 --> 00:06:33.950 So just a quick recap, 00:06:34.340 --> 00:06:37.640 we went over some of the different options, how to find a list of encoders, 00:06:37.640 --> 00:06:43.480 payloads, and different formats that msfvenom supports, and how to use the bad 00:06:43.480 --> 00:06:47.530 characters and keep options in order to filter out any characters that your 00:06:47.530 --> 00:06:51.920 target application does not interpret the way you want them to, and how to 00:06:51.930 --> 00:06:55.820 have your shell codes bond in a new thread so that it doesn't crash the 00:06:55.820 --> 00:06:59.960 application. In the next demo, we're going to use some of these options in an 00:06:59.960 --> 00:07:04.800 actual exploit when we exploit an FTP client running on our Windows 7 target 00:07:04.800 --> 00:07:05.150 machine.