WEBVTT

00:00:01.240 --> 00:00:05.260
In this demo, we're going to cover the shell cogeneration process with Donut.

00:00:06.140 --> 00:00:09.460
We'll start with a lab overview so that you can see the environment

00:00:09.460 --> 00:00:11.960
I'm using and replicate it on your own machine.

00:00:12.840 --> 00:00:13.270
Next,

00:00:13.270 --> 00:00:16.520
we're going to explore the options in Donut that we will use to

00:00:16.520 --> 00:00:19.460
generate shell code from executables and DLLs.

00:00:20.240 --> 00:00:20.840
Finally,

00:00:20.940 --> 00:00:24.590
we'll explore the additional built‑in tools that will help us leverage the shell

00:00:24.590 --> 00:00:28.250
code to execute programs on our targets and evade defenses.

00:00:28.940 --> 00:00:31.760
Let's head over to our lab and get started with the overview.

00:00:32.940 --> 00:00:36.260
The lab I am using consists of a Kali Linux machine and one

00:00:36.260 --> 00:00:38.250
Windows 10 target running in VirtualBox.

00:00:39.140 --> 00:00:41.860
The Windows target is a Microsoft developer image,

00:00:42.440 --> 00:00:44.920
there's a link to obtain these in the demo files.

00:00:44.920 --> 00:00:46.890
On my Kali Linux machine,

00:00:46.910 --> 00:00:51.080
I'm running a Pupy server using Docker that I'll use in the last demo.

00:00:51.080 --> 00:00:53.950
There's a link for obtaining this software in the demo files,

00:00:53.950 --> 00:00:58.270
and I have another red team tools course on its use if you're interested.

00:00:58.270 --> 00:01:01.340
Installing is only required in your environment if you

00:01:01.340 --> 00:01:03.420
want to follow along in the last demo.

00:01:03.420 --> 00:01:04.670
For Donut,

00:01:04.670 --> 00:01:07.530
I used Git to clone the repository into a folder

00:01:07.530 --> 00:01:09.260
called donut in my home directory.

00:01:09.840 --> 00:01:12.860
Once cloned, you can run Donut directly from this directory.

00:01:14.240 --> 00:01:17.440
The Windows developer image has a few tools that will help in the demos,

00:01:17.440 --> 00:01:19.250
including Visual Studio Code.

00:01:20.140 --> 00:01:23.260
I also downloaded Process Explorer, a Sysinternals tool.

00:01:23.940 --> 00:01:26.600
There's a link to that as well in the demo files.

00:01:26.600 --> 00:01:30.150
Now that our lab is ready, we can check out Donut's features.

00:01:30.150 --> 00:01:33.860
By running Donut from the command line, we can view the command options.

00:01:35.440 --> 00:01:38.860
The options we will leverage in this course are within the shell code section.

00:01:39.540 --> 00:01:43.050
We have a few options that we will use to determine the payload output.

00:01:43.740 --> 00:01:47.360
The first is ‑a, which selects the target architecture.

00:01:48.040 --> 00:01:54.060
1 is x86, 2 is AMD64, and 3 is both, which is the default.

00:01:55.140 --> 00:01:56.960
‑b sets the bypass level.

00:01:57.440 --> 00:01:59.560
The default is continue upon fail.

00:02:00.540 --> 00:02:02.360
‑o sets the output path.

00:02:02.940 --> 00:02:05.930
The default is to set the file name two loader and place it

00:02:05.930 --> 00:02:07.860
in the same directory Donut was run from.

00:02:09.039 --> 00:02:11.050
‑f sets the output format.

00:02:11.840 --> 00:02:13.960
Donut has eight formats to choose from.

00:02:14.440 --> 00:02:17.650
For this course, we'll be using Base64 for both demos.

00:02:18.840 --> 00:02:21.390
There are two built‑in programs that we will use in

00:02:21.390 --> 00:02:26.450
other demos to inject our payloads, ProcessManager and DonutTest.

00:02:27.140 --> 00:02:29.450
We'll use the DonutTest program for injection.

00:02:30.240 --> 00:02:33.660
The only issue here is we cannot truly evade defenses.

00:02:34.240 --> 00:02:35.730
As with most built‑in tools,

00:02:35.730 --> 00:02:38.950
this program will trigger Windows Defender when we run it,

00:02:38.950 --> 00:02:42.540
so we'll have to allow DonutTest to run in Defender.

00:02:42.540 --> 00:02:45.570
Creating our own injector is beyond the scope of this course,

00:02:45.570 --> 00:02:49.460
as our focus is on the shell code generation and use with Donut.

00:02:50.140 --> 00:02:52.670
Let's move both of these programs to one of our

00:02:52.670 --> 00:02:54.760
targets so we can finish the lab setup.

00:02:55.640 --> 00:02:59.260
I have a payloads directory that I will use to stage the files we want to move.

00:02:59.840 --> 00:03:02.060
Let's copy the programs to that directory.

00:03:06.940 --> 00:03:09.060
Once we move the files to the payloads directory,

00:03:09.330 --> 00:03:13.860
we can use Python's built‑in SimpleHTTPServer to enable us

00:03:13.860 --> 00:03:15.990
to download our payloads on our target.

00:03:15.990 --> 00:03:20.810
To do this, we'll run python ‑m SimpleHTTPServer,

00:03:20.810 --> 00:03:23.860
followed by the port we want to run this on.

00:03:23.860 --> 00:03:26.110
In my case, I'll use 8000.

00:03:26.110 --> 00:03:30.260
Now we just need to go to our target, and then we can download the files.

00:03:32.040 --> 00:03:37.100
Once we access our Kali Linux machine, we just click each one to download it,

00:03:37.100 --> 00:03:40.070
and then we're all set to compile.

00:03:40.070 --> 00:03:41.950
In its current state,

00:03:41.950 --> 00:03:44.870
the DonutTest program will execute the Notepad and

00:03:44.870 --> 00:03:46.960
Calculator programs using injection.

00:03:47.440 --> 00:03:49.930
Let's compile the program and run it so we can enable the

00:03:49.930 --> 00:03:51.660
function that triggers Windows Defender.

00:03:55.240 --> 00:03:58.360
Let's also compile ProcessManager as well for the next step.

00:04:01.240 --> 00:04:05.010
Now we need to use ProcessManager to select the process for injection.

00:04:05.010 --> 00:04:09.260
To do that, all we do is just run ProcMgr.exe.

00:04:12.340 --> 00:04:15.310
This built‑in tool with Donut gives us the process name of

00:04:15.310 --> 00:04:18.459
every process running on the computer, the process ID,

00:04:19.240 --> 00:04:23.260
the architecture, whether it's managed, the session that it's on,

00:04:23.740 --> 00:04:25.450
and the integrity.

00:04:25.450 --> 00:04:26.790
Scrolling through,

00:04:26.790 --> 00:04:30.250
we can see a number of processes we may be able to inject our code into.

00:04:31.640 --> 00:04:35.520
Free to the examples in this course, let's use explorer.exe,

00:04:35.520 --> 00:04:39.660
currently running with the processor ID of 3092.

00:04:40.640 --> 00:04:44.960
To run this, we just type Program.exe, followed by the process ID.

00:04:46.840 --> 00:04:48.900
You should get a Windows Defender notification.

00:04:48.900 --> 00:04:51.650
I already cleared it in my environment by allowing it.

00:04:52.240 --> 00:04:54.060
Windows Defender will remove your program,

00:04:54.060 --> 00:04:57.810
so once you clear the notification and allow future runs of this program,

00:04:58.140 --> 00:05:03.040
you'll need to recompile from program.cs and run it again. On your second

00:05:03.040 --> 00:05:07.260
run, you should see Notepad and Calculator like you do here.

00:05:08.540 --> 00:05:11.750
Once you get to this step, you're all set to continue with this course.