WEBVTT 00:00:02.140 --> 00:00:03.020 All right, in this demo, 00:00:03.030 --> 00:00:05.360 we're going to generate a malicious payload for use in 00:00:05.360 --> 00:00:07.110 exploiting a software vulnerability. 00:00:07.540 --> 00:00:09.690 We're going to use venom to generate that payload, 00:00:09.700 --> 00:00:12.410 and we're going to be exploiting some vulnerable FTP software 00:00:12.410 --> 00:00:14.350 that we've loaded on our target workstation. 00:00:14.840 --> 00:00:15.440 In this module, 00:00:15.440 --> 00:00:17.030 I'm going to show you how to use the appropriate 00:00:17.030 --> 00:00:18.910 options based on the vulnerability. 00:00:19.340 --> 00:00:21.340 And once we've generated the shellcode, 00:00:21.350 --> 00:00:24.280 we're going to plug it into an existing exploit and 00:00:24.280 --> 00:00:25.750 test it on our target machine. 00:00:26.640 --> 00:00:29.540 Let's take a look at the existing exploit and software and see 00:00:29.540 --> 00:00:30.850 what we're going to be able to work with. 00:00:31.690 --> 00:00:36.580 For this demo, we're going to be using the exploit of the FTPShell Client 6.7, 00:00:36.590 --> 00:00:38.020 found in Exploit Database. 00:00:38.440 --> 00:00:41.450 You'll find the link to this specific exploit in the demo files, 00:00:41.590 --> 00:00:44.180 and right here you'll also see a link to download the vulnerable 00:00:44.180 --> 00:00:46.420 application and install on your target machine. 00:00:47.140 --> 00:00:48.390 If I scroll down just a bit, 00:00:48.400 --> 00:00:51.180 we will actually see the exploit that we're going to be using. 00:00:51.180 --> 00:00:55.480 Up top we can see the exploit author, date when he created this exploit, 00:00:55.490 --> 00:00:57.900 and different operating systems this exploit was tested on. 00:00:57.910 --> 00:01:01.050 So Windows 7 SP1, we should be good to go. 00:01:01.050 --> 00:01:03.450 Down here we'll see the code that we're going to use, 00:01:03.450 --> 00:01:04.730 and right in this location, 00:01:04.730 --> 00:01:08.240 we'll see the venom command that he used and the shellcode that he came up with. 00:01:08.640 --> 00:01:11.150 You'll see here that he's already found the bad 00:01:11.150 --> 00:01:13.110 characters for us so we can reuse those, 00:01:13.110 --> 00:01:16.310 and we can generate our own payload and plug it into this exploit. 00:01:17.310 --> 00:01:19.720 All right, to get started customizing this with our own shellcode, 00:01:19.720 --> 00:01:24.900 we're going to first get that exploit and store it in a FTPClient.py file. 00:01:24.900 --> 00:01:30.560 And then we'll go ahead and open that up, and I'll change a few variables. 00:01:30.560 --> 00:01:35.140 We can see the shellcode in this exploit was set to open the calculator 00:01:35.140 --> 00:01:37.550 application on the target machine when it's exploited. 00:01:38.190 --> 00:01:41.450 Let's go ahead and change that out with an action that we want it to take. 00:01:42.540 --> 00:01:42.860 All right, 00:01:42.860 --> 00:01:46.230 we want to see different Windows shell payloads, so I'm going to go 00:01:46.230 --> 00:01:50.300 ahead and run the ‑‑list payload command to pull up all the payloads 00:01:50.300 --> 00:01:52.450 and then grep it for windows/shell. 00:01:53.040 --> 00:01:54.400 Once those results return, 00:01:54.400 --> 00:01:58.250 we see a few different options of bind and reverse shells. 00:01:58.640 --> 00:02:01.750 Let's use this bottom reverse shell payload for this example. 00:02:02.240 --> 00:02:04.380 So when using a reverse shell payload, 00:02:05.340 --> 00:02:10.080 we need to specify a few options to our host. This is the 00:02:10.080 --> 00:02:13.080 IP address of our attacking machine, which in my case, 00:02:13.090 --> 00:02:19.080 is 192.168.1.17, and a port option, which is the port we want it to connect on. 00:02:19.240 --> 00:02:24.540 For this example I'll use 4444. And then we want to format it in Python 00:02:24.550 --> 00:02:26.950 because we're using a Python script for this exploit. 00:02:27.440 --> 00:02:30.840 We can specify an x86 architecture, 00:02:31.440 --> 00:02:35.170 and we'll go ahead and let it use the default encoder, but we do have to put 00:02:35.180 --> 00:02:39.950 in our bad characters from the exploit which we saw here. 00:02:40.440 --> 00:02:50.350 So I'll just go ahead and copy those and paste them into this venom command. 00:02:50.940 --> 00:02:51.950 And then we'll run that. 00:02:52.590 --> 00:02:55.430 Looks like I had a little typo here, forgot the equals sign 00:02:55.430 --> 00:03:00.850 on LPORT. And once we get our shellcode, 00:03:01.880 --> 00:03:06.450 copy that, and come in here, and replace it. 00:03:11.540 --> 00:03:14.760 One thing we also want to do is change this venom 00:03:14.760 --> 00:03:16.790 command just for our own reference. 00:03:19.140 --> 00:03:22.870 And once we've got our shellcode plugged in, I did have one other 00:03:22.870 --> 00:03:27.840 change that I had to make when testing, and that it was to reduce this 00:03:27.840 --> 00:03:35.050 nop value to about 32 to leave enough room in the 400‑byte payload for 00:03:35.050 --> 00:03:36.550 everything to actually operate. 00:03:37.440 --> 00:03:40.250 Once we've made those changes, let's go ahead and run this client. 00:03:40.640 --> 00:03:44.900 And once we start it, we'll see that FTP server started on port 21. 00:03:44.960 --> 00:03:46.550 That means we're up and ready to go, 00:03:46.940 --> 00:03:49.520 and then all we have to do is set up a listener. 00:03:49.770 --> 00:03:53.750 So I set up this netcat listener on port 4444, and now let's head 00:03:53.750 --> 00:03:57.270 over to our target machine and see what happens when we run this 00:03:57.280 --> 00:04:01.410 command. Over here on the target machine, we have the FTPShell Client 00:04:01.410 --> 00:04:05.410 software pulled up, and we're just going to enter the address of our 00:04:05.410 --> 00:04:06.590 attacking workstation. 00:04:06.740 --> 00:04:08.650 And let's see what happens when we connect. 00:04:09.940 --> 00:04:14.150 Hey, we see that that ran, and when we head over to our netcat listener, 00:04:14.640 --> 00:04:17.750 we have a command shell on our target host. 00:04:18.140 --> 00:04:23.040 Let's see what happens if we enter a few commands, just a basic ipconfig. 00:04:23.640 --> 00:04:29.850 We pull the target's IP address, a whoami. We get ieuser, 00:04:30.540 --> 00:04:33.830 which, as we can see on our target up here, 00:04:34.080 --> 00:04:36.150 is actually the administrator for the machine. 00:04:37.240 --> 00:04:42.290 And one other thing we can do is see if we can get to any 00:04:42.430 --> 00:04:45.450 files we normally wouldn't be able to access. 00:04:45.900 --> 00:04:49.150 And since we can get to the windows\system32 directory, 00:04:49.160 --> 00:04:53.270 we can safely say that we have now been able to access all files, 00:04:53.270 --> 00:04:55.750 and we're acting as administrator on this machine. 00:04:56.840 --> 00:04:57.940 So in this demo, 00:04:57.950 --> 00:05:00.870 we learned how to take an existing exploit and add our own 00:05:00.870 --> 00:05:03.360 shellcode to it to take advantage of some vulnerable 00:05:03.360 --> 00:05:04.950 software on our target network.