WEBVTT 00:00:02.440 --> 00:00:05.950 In this demonstration, we're going to discuss payloads and catalogs. 00:00:06.520 --> 00:00:09.700 We're going to create a maldoc using the shell command, and then 00:00:09.700 --> 00:00:12.150 we'll create another maldoc using custom PowerShell. 00:00:12.640 --> 00:00:13.550 Let's get started. 00:00:15.640 --> 00:00:17.360 Let's begin by loading Luckystrike. 00:00:17.670 --> 00:00:19.680 You'll notice from the main menu that you have four 00:00:19.680 --> 00:00:23.000 primary options: Payload Options, Catalog Options, 00:00:23.000 --> 00:00:25.650 File Options, and then Encode a PowerShell Command. 00:00:26.480 --> 00:00:29.110 The first three are the most important for getting started, 00:00:29.640 --> 00:00:31.930 and the process that we're going to go through in order to 00:00:31.930 --> 00:00:35.050 create our first malicious Office document will be first to 00:00:35.050 --> 00:00:37.340 create a payload by adding it to a catalog. 00:00:37.920 --> 00:00:40.750 Then we'll select that payload and then finally generate 00:00:40.750 --> 00:00:42.350 our new malicious Office document. 00:00:43.040 --> 00:00:47.010 Keep in mind as you create these malicious Office documents that you can add 00:00:47.020 --> 00:00:50.290 any number of payloads in your catalog to those documents. 00:00:50.850 --> 00:00:54.700 They'll be executed in sequence and can allow for more attack vectors per 00:00:54.700 --> 00:00:57.770 malicious Office document to increase the chances of success. 00:00:58.440 --> 00:01:03.020 Let's get started by selecting option 2, Catalog Options. You'll 00:01:03.020 --> 00:01:05.920 see that we have two main sections here, PAYLOADS and TEMPLATES. 00:01:05.920 --> 00:01:09.420 We'll get to TEMPLATES here in just a moment. With PAYLOADS, we 00:01:09.420 --> 00:01:10.300 have three options. 00:01:10.310 --> 00:01:11.960 We can add a payload to the catalog, 00:01:12.180 --> 00:01:16.100 remove the payload from the catalog, or show catalog payloads. Being 00:01:16.100 --> 00:01:19.700 that this is the first time we've run Luckystrike on this host, our 00:01:19.700 --> 00:01:21.640 catalog currently contains no payloads. 00:01:21.930 --> 00:01:24.740 Now let's select option 1, Add payload to catalog. 00:01:25.790 --> 00:01:28.290 You'll begin by defining the title, and I'm just going 00:01:28.290 --> 00:01:30.080 to simply pop calc using a shell. 00:01:31.040 --> 00:01:34.110 You'll have a couple of optional arguments, the Target 00:01:34.110 --> 00:01:36.930 IP, the Target Port, and a Description. 00:01:36.990 --> 00:01:38.850 And I'm going to leave those all blank for now. 00:01:39.240 --> 00:01:42.000 You have your payload type. And for this payload, 00:01:42.000 --> 00:01:44.490 I'm going to choose option 1, the Shell Command. 00:01:44.680 --> 00:01:48.600 Finally, you enter in the payload text. That is, what command do you want to 00:01:48.600 --> 00:01:53.450 run? We're going to just enter in calc.exe. You should see after entering in 00:01:53.450 --> 00:01:57.020 the command that the payload was added. Now we're ready to go back a menu in 00:01:57.020 --> 00:01:59.880 the navigation, so enter in option 99. 00:02:00.180 --> 00:02:02.050 At this point, we need to select our payload. 00:02:02.270 --> 00:02:05.950 So, from the main menu, we'll select option 1, Payload Options. 00:02:06.440 --> 00:02:09.039 Here we have very similar menu options, Select, 00:02:09.050 --> 00:02:11.060 Unselect, or Show selected payloads. 00:02:11.510 --> 00:02:15.650 If we select option 3, Show selected payloads, you'll see a message 00:02:15.650 --> 00:02:17.670 that indicates no payloads have been selected. 00:02:17.930 --> 00:02:21.470 So even though we just added one to the catalog, we haven't selected it yet. 00:02:21.630 --> 00:02:24.550 We need to select the payload in order to add it to the 00:02:24.550 --> 00:02:26.150 malicious document that we're creating. 00:02:26.620 --> 00:02:29.960 So let's choose option 1. Before we select a payload though, 00:02:29.970 --> 00:02:32.310 we need to determine which document type we wish to make, 00:02:32.310 --> 00:02:36.090 whether that's an Excel spreadsheet, xls, or a Word document, 00:02:36.090 --> 00:02:38.650 doc. We'll go with an Excel spreadsheet. 00:02:39.440 --> 00:02:41.110 From there, we can select our payload. 00:02:41.210 --> 00:02:44.320 We only have one payload to select, so we'll enter item 1. 00:02:44.410 --> 00:02:46.480 And now we have to choose the infection method. 00:02:46.710 --> 00:02:47.950 This will be a shell command. 00:02:48.790 --> 00:02:50.730 You can see the payload has now been added. 00:02:51.090 --> 00:02:54.250 If we had additional payloads, we could continue to add those at this point. 00:02:54.840 --> 00:02:55.700 Since we're done though, 00:02:55.710 --> 00:02:59.030 we can enter an option 99 and go back to the previous menu. 00:02:59.260 --> 00:03:01.740 We're now ready to create our malicious Office document, 00:03:01.950 --> 00:03:04.950 so we need to go back one more menu to get to the main menu. 00:03:05.980 --> 00:03:06.750 At this point, 00:03:06.750 --> 00:03:11.170 we want to select option 3, File Options. Here we have a 00:03:11.170 --> 00:03:13.240 number of choices: generate a new file, 00:03:13.380 --> 00:03:17.230 update an existing file, generate from template. write 00:03:17.230 --> 00:03:19.500 existing macro code to file, or go back. 00:03:19.760 --> 00:03:22.210 We're going to select option 1, Generate new file. 00:03:22.620 --> 00:03:23.980 If everything worked correctly, 00:03:23.990 --> 00:03:28.060 you should see a Success message, as well as the location where 00:03:28.060 --> 00:03:30.400 this new malicious Office document was created. 00:03:30.650 --> 00:03:32.830 This is going to be in a subdirectory called payloads 00:03:32.840 --> 00:03:34.750 underneath the main luckystrike folder. 00:03:36.140 --> 00:03:38.890 If you navigate to the luckystrike payloads folder, 00:03:38.900 --> 00:03:41.640 you'll find your malicious Office document. We'll also likely 00:03:41.640 --> 00:03:44.580 want to verify that it works by double‑clicking on the document 00:03:44.590 --> 00:03:46.350 and seeing if calc will be popped. 00:03:46.830 --> 00:03:48.860 As is a common configuration with Office, 00:03:48.860 --> 00:03:51.520 there'll be a banner, a security warning saying that macros have 00:03:51.520 --> 00:03:54.700 been disabled and that the user can enable the content by clicking 00:03:54.700 --> 00:03:57.790 this button. We'll go ahead and do that and see that our 00:03:57.790 --> 00:03:59.550 calculator has in fact been popped. 00:03:59.940 --> 00:04:00.960 For our next example, 00:04:00.960 --> 00:04:04.130 we're going to use some PowerShell that does a very common malicious 00:04:04.130 --> 00:04:07.350 activity, that is to download a file from a host, 00:04:07.520 --> 00:04:10.790 drop it to the file system, and execute it. One of the 00:04:10.790 --> 00:04:13.970 requirements of Luckystrike is that any provided PowerShell 00:04:13.970 --> 00:04:16.560 scripts need to be unobfuscated for usage. 00:04:16.820 --> 00:04:20.200 To view this PowerShell script, I'm using the Windows Power Shell ISE. 00:04:20.800 --> 00:04:21.899 There are three lines here. 00:04:22.050 --> 00:04:23.910 The first defines the destination. 00:04:24.280 --> 00:04:27.250 This is just to get the location of the user's temp directory, 00:04:27.510 --> 00:04:31.520 typically under AppData/Local/Temp, and provide an arbitrary name for the 00:04:31.520 --> 00:04:37.110 executable, AdobePlugin.exe. Start‑BitsTransfer is one of many ways in which we 00:04:37.110 --> 00:04:39.860 can download content over the internet using PowerShell. 00:04:40.340 --> 00:04:41.650 Here we provide the source, 00:04:41.660 --> 00:04:43.670 and I'm just using an executable that I've hosted on 00:04:43.670 --> 00:04:45.850 my own website and the destination. 00:04:46.150 --> 00:04:46.590 Finally, 00:04:46.590 --> 00:04:49.100 we can use Start‑Process to execute the file that 00:04:49.100 --> 00:04:50.550 we've just retrieved and downloaded. 00:04:51.700 --> 00:04:53.340 So, how can we utilize PowerShell? 00:04:53.940 --> 00:04:54.250 Well, 00:04:54.260 --> 00:04:58.710 we'll go back to the main menu, and we'll begin by selecting Catalog Options. 00:04:59.440 --> 00:05:01.740 From there, we'll add a new payload to the catalog. 00:05:02.340 --> 00:05:04.860 We'll call this Calc via PowerShell. 00:05:06.140 --> 00:05:08.350 We don't need any of these optional arguments. 00:05:08.350 --> 00:05:10.870 I'm going to skip the description for now. And for the 00:05:10.870 --> 00:05:12.950 payload type, we'll choose a PowerShell script. 00:05:13.740 --> 00:05:17.900 The last thing that we have to enter is the full path to the ps1 file, 00:05:18.130 --> 00:05:20.050 the PowerShell script that we just created. 00:05:20.580 --> 00:05:23.820 And now we can go back in the menu in order to select this payload 00:05:23.820 --> 00:05:26.150 to create our next malicious Office document. 00:05:26.540 --> 00:05:29.620 You'll notice that at the Select Payload screen we have our 00:05:29.620 --> 00:05:31.790 previous payload, as well as our new payload. 00:05:32.120 --> 00:05:34.560 Those have been added to the catalog. For now, 00:05:34.560 --> 00:05:37.080 since they both ultimately do the same thing, I'm just going to 00:05:37.080 --> 00:05:39.330 select the new payload that we just created. 00:05:39.910 --> 00:05:42.050 As we choose different payload types, we'll have 00:05:42.060 --> 00:05:43.660 different infection method options. 00:05:44.140 --> 00:05:45.530 And at the end of this demonstration, 00:05:45.530 --> 00:05:48.610 I will show you a way in which you can study the payloads themselves. 00:05:48.860 --> 00:05:51.420 That way, you can understand better how they're being 00:05:51.420 --> 00:05:53.770 obfuscated to help you avoid AV. 00:05:54.340 --> 00:05:57.250 For this example, let's just choose option 1, Cell Imbed. 00:05:57.920 --> 00:05:59.950 This will show us that our payload has been added. 00:06:00.340 --> 00:06:03.870 We now can go back to the previous menu, and if you had additional 00:06:03.870 --> 00:06:05.790 payloads you wanted to add to this document, 00:06:05.790 --> 00:06:07.230 you could. However, 00:06:07.240 --> 00:06:09.630 we're just going to add this single payload, so we'll go back one 00:06:09.630 --> 00:06:13.300 more menu to the main menu, and now we're ready to choose option 00:06:13.300 --> 00:06:17.450 3, File Options. And this will allow us to generate our new file 00:06:17.460 --> 00:06:18.790 by selecting option 1. 00:06:19.090 --> 00:06:22.150 Our malicious Office document should now be ready in the payloads folder. 00:06:22.690 --> 00:06:25.780 As with our previous maldoc, we can go to the payloads folder, 00:06:26.160 --> 00:06:28.590 double‑click the malicious Office document, and 00:06:28.590 --> 00:06:30.750 confirm that it is working as expected. 00:06:31.840 --> 00:06:35.880 And there's Calc, confirming that our malicious Office document is working as 00:06:35.880 --> 00:06:40.230 expected. While popping Calc a great way to begin to understand how the 00:06:40.230 --> 00:06:44.370 framework works and see that our payloads are in fact executing, we're going 00:06:44.370 --> 00:06:46.490 to want to move on to more advanced usage, 00:06:46.710 --> 00:06:48.960 and we'll do that in the upcoming demonstrations.