WEBVTT

00:00:01.040 --> 00:00:04.310
In this demo, we'll execute the payloads on the remote host

00:00:04.320 --> 00:00:06.560
and obtain access using reverse shells.

00:00:07.540 --> 00:00:11.100
We will utilize the HTA and macro payloads generated in the previous

00:00:11.100 --> 00:00:13.950
demo and observe the results in our lab environment.

00:00:15.040 --> 00:00:17.960
Testing the payloads allows us to see the results of the attacks we

00:00:17.960 --> 00:00:22.080
generated with Unicorn and know what modifications we may have to make to

00:00:22.080 --> 00:00:24.060
make them more effective in a live environment.

00:00:25.340 --> 00:00:27.350
Let's head over to our lab and get started.

00:00:28.540 --> 00:00:32.560
For our first test, we'll use the HTA attack on our Metasploitable host.

00:00:33.340 --> 00:00:36.790
The first thing we need to do is set up a web server on our Kali VM that

00:00:36.790 --> 00:00:40.750
we can access from our target. To do that, we just change the directory

00:00:40.750 --> 00:00:45.460
to the hta_attack directory that Unicorn created. From here, we can use

00:00:45.460 --> 00:00:52.550
Python to start a simple HTTP server using python ‑m http.server,

00:00:53.040 --> 00:00:54.260
followed by a port number.

00:00:54.740 --> 00:00:56.860
Let's use 8080 for this example.

00:00:58.640 --> 00:01:00.050
Now that we have our server set up,

00:01:00.230 --> 00:01:02.660
we need to set up a listener to capture the reverse shell.

00:01:03.540 --> 00:01:07.050
To do that, we can open a second tab and navigate to the same directory.

00:01:07.840 --> 00:01:11.460
Unicorn makes it easy to set up a listener using Metasploit. We can

00:01:11.460 --> 00:01:16.450
just type msfconsole ‑r, followed by unicorn.rc.

00:01:19.340 --> 00:01:21.620
Now we're ready to test. Let's head over to our

00:01:21.620 --> 00:01:24.150
Metasploitable VM and access our web server.

00:01:27.640 --> 00:01:30.250
Normally, to attack a target with this type of method,

00:01:30.840 --> 00:01:34.340
you could send a link as part of a phishing attack. To simplify

00:01:34.340 --> 00:01:38.220
our environment, I didn't set up an email server. Accessing this

00:01:38.220 --> 00:01:41.520
link validates our exploit and allows us to observe the behavior

00:01:41.520 --> 00:01:42.560
the user has to take,

00:01:43.140 --> 00:01:46.540
which we could use to craft a more convincing phishing attack and further

00:01:46.540 --> 00:01:51.110
increase our chances of success. Immediately after entering the address,

00:01:51.110 --> 00:01:53.550
we're asked to take action with the HTA.

00:01:54.340 --> 00:01:57.690
If we accept to download the file and click Run,

00:01:57.700 --> 00:02:03.180
the payload will execute. We don't really see any other behavior here, but

00:02:03.190 --> 00:02:08.820
let's check back in with our Kali machine. And we have our shell. Although

00:02:08.820 --> 00:02:11.820
we have some work to do to increase the likelihood that a phishing attack

00:02:11.820 --> 00:02:16.230
will succeed and minimize suspicion, Unicorn did some heavy lifting for us

00:02:16.240 --> 00:02:19.460
to generate a working exploit, which certainly saves us some time.

00:02:21.040 --> 00:02:23.640
I'll let you know now that this HTA is detected by

00:02:23.640 --> 00:02:25.320
Windows Defender in Windows 10.

00:02:26.940 --> 00:02:38.580
Let's try accessing it from our Windows 10 machine. And there we see

00:02:38.580 --> 00:02:41.610
that it did try to download our Launcher file, but it was immediately

00:02:41.610 --> 00:02:44.060
blocked because it could harm our device.

00:02:46.440 --> 00:02:53.460
Even if we try to keep the file, Windows Defender will detect it as a virus.

00:02:55.040 --> 00:02:58.660
At the time of some of my initial tests, I could rearrange

00:02:58.670 --> 00:03:01.790
the text in the word PowerShell to get past the initial

00:03:01.790 --> 00:03:03.760
scan and enable it to download.

00:03:04.240 --> 00:03:04.980
However,

00:03:04.990 --> 00:03:07.870
once my Windows 10 machine updated, this no longer

00:03:07.870 --> 00:03:09.960
worked and it detected it every time.

00:03:11.040 --> 00:03:14.290
Even if I got it past the initial detection on download, the

00:03:14.290 --> 00:03:16.620
reverse shell does not appear to make it past the runtime

00:03:16.620 --> 00:03:18.150
execution for Windows Defender.

00:03:18.640 --> 00:03:20.950
Custom shell code might help you out in this section,

00:03:21.340 --> 00:03:24.250
but generating our own shell code is outside the scope of this course.

00:03:25.340 --> 00:03:28.160
For now, let's see if we can solve this problem with our next attack,

00:03:28.540 --> 00:03:32.850
the macro payload. We'll target our Windows 10 host specifically for this one.