WEBVTT

00:00:00.940 --> 00:00:03.190
Before we get into the defense evasion topics,

00:00:03.200 --> 00:00:05.560
we need to ensure that we understand how a Meterpreter

00:00:05.560 --> 00:00:07.860
shell actually works under the hood.

00:00:08.440 --> 00:00:11.430
This is important because we will have to customize the tool to

00:00:11.430 --> 00:00:14.620
get past antivirus, and customizing something we don't fully

00:00:14.620 --> 00:00:16.149
understand would be challenging.

00:00:17.340 --> 00:00:20.920
We will briefly cover Meterpreter's main components, and I will explain some

00:00:20.920 --> 00:00:23.660
of the techniques which are used during its initialization.

00:00:24.440 --> 00:00:24.960
Finally,

00:00:24.960 --> 00:00:28.260
we will go for a demo, where we will write our own custom shell

00:00:28.260 --> 00:00:30.950
code runner and analyze it during execution.

00:00:32.940 --> 00:00:35.760
A Meterpreter shell consists of three main components.

00:00:36.440 --> 00:00:40.680
First we have the stager. The stager is a piece of code which can

00:00:40.680 --> 00:00:43.960
be embedded inside a file and sent to a victim.

00:00:44.640 --> 00:00:47.260
It can also be used in memory corruption exploits,

00:00:47.260 --> 00:00:51.390
targeting vulnerable software. When the stager executes, its

00:00:51.390 --> 00:00:53.400
job is to connect back to the handler,

00:00:53.480 --> 00:00:56.360
which, in turn, will send back the payload, which

00:00:56.360 --> 00:00:58.360
can be bootstrapped by the stager.

00:00:59.340 --> 00:01:02.130
Some stagers do not connect back to the handler and simply

00:01:02.130 --> 00:01:04.540
open a network port on the victim's machine,

00:01:04.540 --> 00:01:05.960
which we can then connect to.

00:01:06.640 --> 00:01:07.880
In this course, however,

00:01:07.890 --> 00:01:11.650
we will be focusing on reverse payloads that connect back to the handler.