WEBVTT 00:00:02.990 --> 00:00:04.510 In our final demonstration, 00:00:04.520 --> 00:00:08.460 we're going to discuss how you can add an executable payload, We'll then 00:00:08.460 --> 00:00:12.130 use the Unicorn framework to generate PowerShell, and we'll need to 00:00:12.130 --> 00:00:14.270 decode the PowerShell for use in Luckystrike. 00:00:14.740 --> 00:00:15.930 After this demonstration, 00:00:15.940 --> 00:00:17.980 you should have a really good understanding of all of the 00:00:17.980 --> 00:00:20.600 different features of Luckystrike and how to use it to create 00:00:20.600 --> 00:00:21.990 your malicious Office documents. 00:00:23.540 --> 00:00:27.090 We'll begin by opening up a terminal inside of a Kali Linux VM. 00:00:27.090 --> 00:00:30.410 From the terminal, we'll be using msfvenom in order to create a 00:00:30.410 --> 00:00:31.950 fairly straightforward payload. 00:00:33.040 --> 00:00:35.600 Our focus in this course is on Luckystrike, so we won't have 00:00:35.600 --> 00:00:38.700 much time to get into msfvenom. However, 00:00:38.710 --> 00:00:42.850 there is a course already in the Pluralsight library; the focus is on msfvenom. 00:00:43.740 --> 00:00:46.320 The different arguments that we need are first to define the payload, 00:00:46.590 --> 00:00:47.640 the ‑p flag. 00:00:47.870 --> 00:00:51.150 And I'm just going to use a windows/meterpreter/reverse_https. 00:00:51.740 --> 00:00:55.130 The next argument is LHOST. This is the IP address of our Kali 00:00:55.130 --> 00:00:57.500 machine or whatever host you want the victim, 00:00:57.500 --> 00:00:59.350 your mal doc, to connect back to. 00:00:59.520 --> 00:01:00.860 After that comes LPORT. 00:01:00.960 --> 00:01:03.340 That's the port that it'll use. Then ‑f, 00:01:03.350 --> 00:01:06.910 which will be the file type. We'd like an executable. And ‑o, the 00:01:06.910 --> 00:01:09.160 name of the payload, the file that this command's going to 00:01:09.160 --> 00:01:11.140 generate. After executing the command, 00:01:11.140 --> 00:01:13.860 it should only take a few seconds, and you'll have the payload, 00:01:13.860 --> 00:01:17.330 the executable in the location of the file system that you're currently at. 00:01:17.410 --> 00:01:21.150 We can now copy this over to our Windows machine to be used with Luckystrike. 00:01:21.540 --> 00:01:22.750 But before we do that, 00:01:22.760 --> 00:01:26.790 I've also set up a .rc file that will configure a handler in 00:01:26.790 --> 00:01:30.710 Metasploit for our victim to call back to and will allow the 00:01:30.710 --> 00:01:32.310 shell to connect back to our host. 00:01:33.240 --> 00:01:35.670 The .rc file is actually a resource script, 00:01:35.740 --> 00:01:38.860 and we can use those with msfconsole by providing it 00:01:38.860 --> 00:01:40.950 as an argument to the ‑r argument. 00:01:41.540 --> 00:01:44.250 If Metasploit was able to process the resource script correctly, 00:01:44.250 --> 00:01:46.540 we should see that our handler has been started and is 00:01:46.540 --> 00:01:47.940 waiting for incoming connections. 00:01:48.310 --> 00:01:51.400 Now we're ready to use Luckystrike in order to add 00:01:51.410 --> 00:01:53.220 that payload type to the catalog, 00:01:53.220 --> 00:01:56.050 select the payload, and create our malicious Office document. 00:01:56.810 --> 00:01:59.550 I've already pasted the payload onto my user's desktop. 00:02:00.040 --> 00:02:03.290 So the first thing is to go to the Catalog Options and add 00:02:03.290 --> 00:02:06.980 a payload to the catalog. You'll likely want to give this 00:02:06.980 --> 00:02:08.300 a fairly descriptive title, 00:02:08.310 --> 00:02:12.030 especially as your catalog of payloads grows. This will help you better 00:02:12.030 --> 00:02:14.450 remember all of the different payloads that you've set up. 00:02:15.090 --> 00:02:17.740 You also have the ability to set the optional target IP, 00:02:17.740 --> 00:02:21.300 port, and description. Again, this is there just to help you 00:02:21.300 --> 00:02:22.880 keep all of your payloads straight. 00:02:23.260 --> 00:02:26.050 For this demonstration though, I'm going to continue to skip those options. 00:02:26.480 --> 00:02:28.650 The last is to select the payload type. 00:02:29.300 --> 00:02:32.560 We will choose 3, Executable. We now need to enter in 00:02:32.560 --> 00:02:34.350 the full path to the executable. 00:02:35.040 --> 00:02:38.250 And once we enter that path, we should see that the payload is added. 00:02:40.040 --> 00:02:43.850 Our next step then is to select our payload, so we can choose Payload Options, 00:02:43.990 --> 00:02:46.660 Select a payload, and then select the payload that we 00:02:46.660 --> 00:02:48.880 just created, our Reverse HTTPS. 00:02:49.140 --> 00:02:51.950 We have to choose the infection method. And each one of these 00:02:51.950 --> 00:02:54.400 options are fairly well documented on the wiki. 00:02:54.920 --> 00:02:58.850 The first one is Certutil. This will embed a Base64 encoded 00:02:58.850 --> 00:03:01.320 binary into the cells of the Excel doc. 00:03:01.570 --> 00:03:06.070 It then saves it as a text file to disk using certutil to decode the payload, 00:03:06.280 --> 00:03:08.620 save it as an executable, and then launch it. 00:03:09.190 --> 00:03:12.170 Save to Disk is relatively straightforward. It embeds the 00:03:12.170 --> 00:03:14.650 executable, saves it to disk, and then execute it. 00:03:15.240 --> 00:03:17.150 The last one is ReflectivePE. 00:03:17.740 --> 00:03:20.040 This one uses an additional PowerShell module, 00:03:20.050 --> 00:03:23.430 Invoke‑ReflectivePEInjection, and will try to 00:03:23.430 --> 00:03:26.260 reflectively inject the PE into memory. 00:03:26.740 --> 00:03:29.550 This one's a bit trickier and requires more thorough testing, 00:03:29.550 --> 00:03:32.990 as well as ensuring that the architecture of the payload that 00:03:32.990 --> 00:03:35.650 you've created is going to map with your victim. 00:03:35.840 --> 00:03:36.960 For this demonstration, 00:03:36.970 --> 00:03:40.920 we're going to choose option 1, Certutil. Now that the payload's been added, 00:03:40.930 --> 00:03:43.810 we can go back to the main menu, and we can generate 00:03:43.820 --> 00:03:45.250 our malicious Office document. 00:03:45.990 --> 00:03:49.290 We can either generate a new file, or since we've already created a template, 00:03:49.300 --> 00:03:52.600 we'll go ahead and use that one. After Luckystrike has informed us that 00:03:52.600 --> 00:03:55.620 it was successful in creating our document, we can now launch it and 00:03:55.620 --> 00:03:58.700 confirm if our executable not only was executed, 00:03:58.710 --> 00:04:02.050 but if it was able to connect back to our handler on our Kali VM. 00:04:03.020 --> 00:04:05.440 We'll find our newly created malicious Office document under the 00:04:05.440 --> 00:04:07.880 payloads folder inside of our Luckystrike directory. 00:04:07.880 --> 00:04:11.050 Double‑clicking that will launch the document, 00:04:11.940 --> 00:04:13.450 and then we'll need to enable content. 00:04:14.440 --> 00:04:17.740 Of course, one of the main ideas behind this is from the victim's perspective. 00:04:17.750 --> 00:04:20.850 It's going to look like nothing really happened. So we'll 00:04:20.850 --> 00:04:23.100 need to go back to our Kali VM to see if our shell 00:04:23.100 --> 00:04:27.250 connected back. And at this point, it looks like we have a successful session. 00:04:28.440 --> 00:04:31.190 The next example tool that we're going look at is called Unicorn. 00:04:31.520 --> 00:04:36.400 This is available on GitHub and is maintained by TrustedSec, Dave Kennedy. 00:04:37.280 --> 00:04:40.810 Magic Unicorn is a simple tool for using PowerShell downgrade 00:04:40.820 --> 00:04:43.010 attack to inject shell code straight into memory, 00:04:43.360 --> 00:04:46.890 And this tool provides another good demonstration on how we can use one to 00:04:46.890 --> 00:04:51.330 create the necessary capabilities that we need to then include in the creation 00:04:51.340 --> 00:04:53.880 of our malicious Office documents using Luckystrike. 00:04:54.440 --> 00:04:56.720 Once you've downloaded Unicorn from the GitHub, 00:04:56.830 --> 00:04:59.680 you can navigate to that directory and just execute the 00:04:59.680 --> 00:05:02.240 Unicorn Python script. Without any arguments, 00:05:02.240 --> 00:05:04.620 you'll get the help, and you'll see here that there are a 00:05:04.620 --> 00:05:06.740 number of different options for using this tool. 00:05:07.340 --> 00:05:09.210 We won't have time to go through all of these, 00:05:09.210 --> 00:05:11.390 but I did want to focus on a couple of examples. 00:05:11.760 --> 00:05:14.090 First, we have the ability to create macros, 00:05:14.300 --> 00:05:15.950 which we'll discuss here momentarily. 00:05:16.520 --> 00:05:19.050 The second is our ability to create PowerShell. 00:05:20.040 --> 00:05:23.710 To create our macros using Unicorn, we just need to provide a few options. 00:05:24.240 --> 00:05:26.560 Much like the previous example, I'll be creating a 00:05:26.560 --> 00:05:28.940 windows/meterpreter/reverse_https. 00:05:29.340 --> 00:05:32.680 This is a payload that comes from Metasploit. After that, 00:05:32.680 --> 00:05:35.640 we needed to find the host, what IP address the victim will 00:05:35.640 --> 00:05:39.090 connect back to, the port, and then we need to instruct 00:05:39.090 --> 00:05:40.720 Unicorn to create the macros. 00:05:41.640 --> 00:05:42.940 After executing this command, 00:05:42.940 --> 00:05:46.390 you'll see that it should take a few minutes, and if successful, we'll 00:05:46.390 --> 00:05:49.050 have two different files that were created as output. 00:05:49.640 --> 00:05:52.650 The first is called powershell_attack.txt. 00:05:53.640 --> 00:05:55.250 This is the actual macro code. 00:05:55.900 --> 00:06:00.830 The second is a unicorn.rc file, so a Metasploit resource script that we can use 00:06:00.830 --> 00:06:05.140 to start the handler. If you open up powershell_attack with a text editor, 00:06:05.140 --> 00:06:08.490 you'll see that you do in fact have macro‑ready code. 00:06:09.640 --> 00:06:12.090 And while this may seem like the most intuitive first 00:06:12.090 --> 00:06:14.210 option of using a framework like Unicorn, 00:06:14.510 --> 00:06:17.000 there's actually no way to directly include the macro 00:06:17.000 --> 00:06:19.250 code into usage with Luckystrike. 00:06:20.340 --> 00:06:22.800 If we wanted to use this output as is, 00:06:22.810 --> 00:06:26.680 we would need to manually add it to our malicious Office documents ourselves. 00:06:27.140 --> 00:06:30.010 However, if you pay attention to the beginning of this macro code, 00:06:30.020 --> 00:06:33.200 you'll see the PowerShell command, along with what 00:06:33.200 --> 00:06:35.350 appears to be a Base64 encoded string. 00:06:35.740 --> 00:06:37.320 And that's in fact what this is. 00:06:37.570 --> 00:06:41.840 So it's really taken a PowerShell payload and just simply broken it 00:06:41.840 --> 00:06:45.650 apart for obfuscation to avoid detection and then added the necessary 00:06:45.650 --> 00:06:47.950 components to get it to execute as a macro. 00:06:48.840 --> 00:06:52.170 What this means is that we can go back to Unicorn and just generate the 00:06:52.170 --> 00:06:54.850 PowerShell that we can utilize within Luckystrike. 00:06:55.290 --> 00:06:57.920 To do that, we'll use the same command that we previously 00:06:57.920 --> 00:07:01.350 utilized, except we'll remove the end macro argument. 00:07:02.040 --> 00:07:05.130 This will generate the same two payloads, the unicorn.rc 00:07:05.130 --> 00:07:07.730 file, as well as powershell_attack.tx. 00:07:08.740 --> 00:07:10.820 Viewing this content in a text editor, 00:07:10.820 --> 00:07:13.250 you'll see that we have two PowerShell commands, 00:07:14.240 --> 00:07:17.210 both of them using a large Base64 encoded payload. 00:07:17.690 --> 00:07:20.830 If you recall one of the requirements of Luckystrike, that if we 00:07:20.830 --> 00:07:23.670 utilize any PowerShell within the Luckystrike framework, 00:07:23.680 --> 00:07:24.750 it is unencoded. 00:07:25.140 --> 00:07:27.970 Our goal here then is to create a PowerShell script that we can 00:07:27.970 --> 00:07:30.400 import with Luckystrike. For this demonstration, 00:07:30.400 --> 00:07:33.710 I'm just going to decode one of these Base64 encoded payloads. 00:07:34.140 --> 00:07:34.690 However, 00:07:34.700 --> 00:07:37.000 you could decode both of them and add them to the same 00:07:37.000 --> 00:07:39.150 PS1 script to be added to Luckystrike. 00:07:40.120 --> 00:07:44.280 In order to decode this payload, I'm going to remove everything but the Base64. 00:07:44.740 --> 00:07:48.350 I'm using the second script here, and you'll notice that inside this 00:07:48.350 --> 00:07:51.630 script there was some concatenation, so make sure that you've removed 00:07:51.630 --> 00:07:54.700 any invalid non‑Base64 encoded characters. 00:07:55.440 --> 00:07:57.980 Once I've completed that, I'll go ahead and save the file. 00:07:59.710 --> 00:08:03.290 While there are many ways that we can Base64 decode that content, I'm just 00:08:03.290 --> 00:08:07.120 going to use a built‑in Linux utility. So we'll count the contents of 00:08:07.120 --> 00:08:11.690 powershell_attack, we'll pipe that output to the base64 utility, providing it 00:08:11.690 --> 00:08:16.320 the ‑d argument, which will decode the payload. We'll then redirect that output 00:08:16.320 --> 00:08:22.080 to a new text file called powershell_attack_decoded.txt. Now if we take a look 00:08:22.080 --> 00:08:23.470 at powershell_attack_decoded, 00:08:23.470 --> 00:08:26.750 we should see the PowerShell that was contained within that Base64 string. 00:08:27.440 --> 00:08:29.730 You can spend some time analyzing this if you want, 00:08:29.740 --> 00:08:32.280 but the gist of it is that we have some shell code that will be 00:08:32.280 --> 00:08:34.760 staged into memory and executed using PowerShell. 00:08:35.940 --> 00:08:38.830 The last thing that we'll do before going back to Luckystrike is to start 00:08:38.840 --> 00:08:43.000 msfconsole. That way we can verify that this PowerShell did in fact create 00:08:43.000 --> 00:08:45.350 the Reverse HTTPS shell that we expected. 00:08:46.640 --> 00:08:47.150 Finally, 00:08:47.160 --> 00:08:50.420 the last thing we need to do is just add our new payload type to our 00:08:50.420 --> 00:08:53.700 catalog and then create our malicious Office document. 00:08:54.240 --> 00:08:57.940 So I'll give this a slightly more descriptive name, Unicorn Reverse HTTPS. 00:08:58.270 --> 00:09:00.100 I'll leave the optional information empty. 00:09:00.740 --> 00:09:02.750 This will be a PowerShell script. 00:09:03.340 --> 00:09:05.950 And when I copied the original text file, 00:09:05.960 --> 00:09:08.950 the powershell_attack_decoded over to this VM, I went ahead 00:09:08.950 --> 00:09:11.310 and renamed the file extension to .ps1. 00:09:14.440 --> 00:09:15.990 We should see that our payload was added. 00:09:17.340 --> 00:09:18.850 Now we can select the payload, 00:09:25.040 --> 00:09:31.830 choose the infection method type, and finally, we'll be able 00:09:31.830 --> 00:09:33.750 to generate our malicious Office document. 00:09:40.940 --> 00:09:44.050 From our payloads folder, we can open up the newly created document, 00:09:44.590 --> 00:09:49.080 enable content, and much like the previous, it's designed so that the user is 00:09:49.080 --> 00:09:51.620 not aware of what's actually going on behind the scenes. 00:09:53.090 --> 00:09:56.590 If we go back to our Kali VM, we'll see that we did in fact get our session. 00:09:58.500 --> 00:09:59.570 So, as you can see, 00:09:59.580 --> 00:10:02.580 while Luckystrike is a powerful framework for managing and creating 00:10:02.580 --> 00:10:05.870 malicious Office documents, a lot of the work is going to come in the 00:10:05.870 --> 00:10:08.300 different types of payloads that you're able to integrate. 00:10:09.820 --> 00:10:10.830 At this point though, 00:10:10.840 --> 00:10:13.510 you have a very good understanding of how Luckystrike works, 00:10:13.690 --> 00:10:16.940 how to integrate it with other tools, and how to begin to create your 00:10:16.940 --> 00:10:19.350 malicious Office document for red team operations. 00:10:19.940 --> 00:10:20.550 Great work.