WEBVTT 00:00:01.140 --> 00:00:04.650 In this demo, we're going to cover the command generation process with Unicorn. 00:00:05.240 --> 00:00:07.930 We'll start with a lab overview so you can see the environment 00:00:07.930 --> 00:00:10.160 I'm using and replicate it in your own machine. 00:00:10.840 --> 00:00:14.050 Next, we're going to explore the options in Unicorn that we use 00:00:14.050 --> 00:00:16.450 to generate commands from Metasploit payloads. 00:00:17.040 --> 00:00:17.580 Finally, 00:00:17.590 --> 00:00:20.040 we'll explore the additional built‑in tools that will help us 00:00:20.040 --> 00:00:22.650 leverage Unicorn to execute payloads on our targets. 00:00:23.240 --> 00:00:25.850 Let's head over to our lab and get started with the overview. 00:00:29.840 --> 00:00:34.280 The lab I'm using consists of a Kali Linux machine, one Windows 10 target, 00:00:34.280 --> 00:00:37.460 and the Metasploitable 3 machine running in VirtualBox. 00:00:38.440 --> 00:00:41.160 The Windows 10 target is a Microsoft developer image. 00:00:41.740 --> 00:00:44.790 Metasploitable 3 was loaded using Vagrant by following the 00:00:44.790 --> 00:00:48.800 instructions on Github. There's a link to obtain all these in the 00:00:48.800 --> 00:00:53.920 demo files. On the Windows 10 host, I also installed OpenOffice and 00:00:53.920 --> 00:00:56.360 Java for the macro attack simulation. 00:00:57.140 --> 00:01:00.360 Links to obtain the software are also found in the demo files. 00:01:00.360 --> 00:01:04.090 For Unicorn, I used Git to clone the repository into a folder 00:01:04.090 --> 00:01:05.860 called Unicorn in my home directory. 00:01:06.640 --> 00:01:07.370 Once cloned, 00:01:07.410 --> 00:01:11.950 you can run Unicorn straight from this directory. Now that our lab is ready, 00:01:11.950 --> 00:01:16.440 we can check out Unicorn's features. By running Unicorn from the command line, 00:01:16.440 --> 00:01:19.930 we can view the command options. To run Unicorn, 00:01:19.940 --> 00:01:25.550 you type python unicorn.py ‑‑help. After the image, 00:01:25.550 --> 00:01:28.830 credits, and guides to each of the options, you can see some example 00:01:28.830 --> 00:01:33.440 commands. We have PowerShell command generation, macros, HTML Applications, 00:01:33.440 --> 00:01:38.280 or HTAs, Dynamic Data Exchange, or DDE, which Office uses to share data 00:01:38.280 --> 00:01:42.660 between applications, assert util method, and multiple options for custom 00:01:42.660 --> 00:01:44.850 PowerShell files, and shell code payloads. 00:01:45.540 --> 00:01:47.460 Let's create our first PowerShell command. 00:01:48.440 --> 00:01:50.450 Before we run that, we'll need a payload. 00:01:51.040 --> 00:01:55.270 Unicorn can use the MSFVenom payloads to generate commands quickly and easily. 00:01:55.270 --> 00:02:00.810 To see the available payloads, you can type msfvenom ‑‑list payload, and 00:02:00.810 --> 00:02:02.760 select the appropriate payload for your environment. 00:02:04.240 --> 00:02:07.160 An important note, for Unicorn attacks to work correctly, 00:02:07.370 --> 00:02:09.360 you will need to use 32‑bit payloads. 00:02:09.940 --> 00:02:13.120 Unicorn is designed for downgrades to a 32‑bit process 00:02:13.130 --> 00:02:16.560 through SysWOW64 on 64‑bit Windows systems. 00:02:17.440 --> 00:02:21.020 You can run the 32‑bit payloads on 64‑bit Windows operating systems 00:02:21.020 --> 00:02:25.780 without any issues. Within the 32‑bit payloads, let's try 00:02:25.860 --> 00:02:31.240 windows/shell/reverse_tcp. Before we start creating attacks, 00:02:31.240 --> 00:02:34.170 there's one setting we need to change. We're going to turn off the 00:02:34.170 --> 00:02:37.760 AMSI_BYPASS by going into unicorn.py and setting it to OFF. 00:02:39.440 --> 00:02:43.340 Once you change the option to OFF, as this displayed here, you just save 00:02:43.340 --> 00:02:48.600 the file using CTRL+O, Enter, and exit using CTRL+X. 00:02:49.740 --> 00:02:53.010 We're making this change because in my testing, the AMSI_BYPASS 00:02:53.020 --> 00:02:56.220 either didn't function correctly for some attacks, or it broke 00:02:56.220 --> 00:02:59.420 the attack. In the cases where it didn't break the attack, the 00:02:59.420 --> 00:03:01.120 AMSI_BYPASS had no effect. 00:03:01.130 --> 00:03:06.100 So for our demos, we'll turn it OFF. Now we're ready to generate our 00:03:06.100 --> 00:03:12.360 first PowerShell command. For that, we start with python unicorn.py, 00:03:12.740 --> 00:03:18.870 followed by our payload, windows/shell_reverse_tcp. After the payload, 00:03:18.870 --> 00:03:22.420 we will need to specify the IP address of our Kali Linux machine for 00:03:22.420 --> 00:03:23.160 the reverse shell. 00:03:23.840 --> 00:03:28.060 In my case, that is 192.168.2.36. 00:03:28.540 --> 00:03:32.050 We also need a port number, so let's use 4444. 00:03:33.840 --> 00:03:36.730 Once it's generated, we can open the file using the built‑in text 00:03:36.730 --> 00:03:41.550 editor for Kali mousepad. In order to run it on our target, all we've 00:03:41.550 --> 00:03:43.960 got to do is copy the text of this file. 00:03:46.040 --> 00:03:47.350 One last step to prepare, 00:03:47.640 --> 00:03:52.900 we need to set up a listener. For this demo, we just use netcat. Now to 00:03:52.900 --> 00:03:56.670 run the attack, all we've got to do on our Metasploitable VM is simply 00:03:56.670 --> 00:04:04.130 paste the PowerShell command into PowerShell. And we hit Enter. The 00:04:04.130 --> 00:04:10.050 window will disappear, and back on Kali, we have our shell. For a quick 00:04:10.050 --> 00:04:11.290 recap, in this demo, 00:04:11.430 --> 00:04:13.680 we went through a brief overview of the lab environment 00:04:13.680 --> 00:04:14.950 we'll use throughout this course. 00:04:15.540 --> 00:04:18.750 Next, we installed Unicorn and looked at the available options. 00:04:19.140 --> 00:04:19.600 Finally, 00:04:19.610 --> 00:04:22.370 we used Unicorn to generate a PowerShell command that opened 00:04:22.370 --> 00:04:24.450 a reverse shell on one of our targets.