WEBVTT

00:00:00.240 --> 00:00:04.600
As you probably already know by now, msfvenom is a tool shipped with the

00:00:04.600 --> 00:00:08.119
Metasploit framework which can be used to generate stages.

00:00:08.210 --> 00:00:09.770
When using msfvenom,

00:00:09.860 --> 00:00:15.030
you can pass in various parameters, such as the format, using the dash ‑f flag.

00:00:15.140 --> 00:00:18.360
This will let you specify which format you want to use,

00:00:18.440 --> 00:00:23.480
such as the exe format. By default, when using the exe format,

00:00:23.490 --> 00:00:28.190
msfvenom will use a default executable file which is shipped with

00:00:28.190 --> 00:00:32.700
Metasploit. As we will discover later on, using this default template

00:00:32.710 --> 00:00:36.740
is a bad idea, because the vast majority of antivirus solutions will

00:00:36.740 --> 00:00:40.630
detect it with ease since it is available on the internet and can be

00:00:40.630 --> 00:00:42.660
analyzed to develop signatures.

00:00:43.040 --> 00:00:48.820
We can, however, pass in a ‑x flag and specify a custom executable file,

00:00:48.830 --> 00:00:53.720
which will avoid getting flagged by antivirus. Mileage may vary, however,

00:00:53.750 --> 00:00:58.610
because the exe format is noisy and makes use of hard‑coded shellcode

00:00:58.610 --> 00:01:03.270
stubs which allocate read/write/execute memory sections at runtime and

00:01:03.270 --> 00:01:05.930
copies the stager into it before executing it.

00:01:06.120 --> 00:01:09.660
As we have previously discussed when covering API monitoring,

00:01:09.740 --> 00:01:14.750
making use of these frequently abused APIs is a bad idea. To

00:01:14.750 --> 00:01:18.370
generate a stager using the exe format, we can use the following

00:01:18.370 --> 00:01:21.370
command. When we run this command,

00:01:21.380 --> 00:01:24.500
the default executable template will be used, and the

00:01:24.500 --> 00:01:26.380
stager will be embedded into it.

00:01:26.700 --> 00:01:30.860
Let's generate a stager using this format and upload it to VirusTotal.

00:01:31.100 --> 00:01:35.660
As you can see, this sample was detected by 43 antivirus scanners, nearly

00:01:35.660 --> 00:01:38.650
twice as many detections as our custom shellcode runner,

00:01:38.660 --> 00:01:40.040
which only had 24,

00:01:40.050 --> 00:01:43.460
even though the same stager shellcode was embedded inside the file.

00:01:44.140 --> 00:01:47.700
This is quite interesting, since the stager which we embedded inside

00:01:47.700 --> 00:01:51.190
our shellcode runner is the same as the one which is embedded inside

00:01:51.190 --> 00:01:54.280
the default executable template by msfvenom.

00:01:54.290 --> 00:01:57.820
This can be explained by uploading the executable template to

00:01:57.820 --> 00:02:00.690
VirusTotal without embedding a stager into it.

00:02:00.740 --> 00:02:03.900
As you can see, this file was flagged by 40 antivirus

00:02:03.900 --> 00:02:06.910
scanners, which proves that some scanners have signatures

00:02:06.910 --> 00:02:08.660
for the file, but not the actual.

00:02:08.660 --> 00:02:09.360
stager.

00:02:10.139 --> 00:02:13.630
This default executable template can be avoided using the ‑x

00:02:13.630 --> 00:02:16.800
parameter when generating a stager with msfvenom.

00:02:17.090 --> 00:02:20.810
I chose to use the 7‑Zip executable file as a template.

00:02:20.890 --> 00:02:25.050
One of the reasons I chose this file is because it is not digitally signed.

00:02:25.440 --> 00:02:28.560
If you specify a template which has a digital signature,

00:02:28.750 --> 00:02:32.960
msfvenom will break the signature when embedding the stager into it,

00:02:33.340 --> 00:02:35.810
and may be flagged by some antivirus scanners.

00:02:35.970 --> 00:02:38.110
If we upload this file to VirusTotal,

00:02:38.310 --> 00:02:42.610
we can see that we now only have 20 out of 69 antivirus scanners

00:02:42.620 --> 00:02:45.840
which are flagging the file. You may recall that our custom

00:02:45.840 --> 00:02:48.760
shellcode runner was flagged by 24 scanners.

00:02:49.040 --> 00:02:52.120
This difference is interesting, since the stager shellcode

00:02:52.120 --> 00:02:54.650
embedded inside both file is identical.

00:02:54.940 --> 00:02:58.940
The only difference is the executable file in which the stage was embedded.

00:02:59.100 --> 00:03:02.240
If you look at this from the point of view of a malware analyst,

00:03:02.250 --> 00:03:05.010
if you were to analyze the shellcode runner and the back

00:03:05.010 --> 00:03:07.300
door to the 7‑Zip executable files,

00:03:07.310 --> 00:03:10.050
you would notice that one file imports very little

00:03:10.050 --> 00:03:12.360
functionality from the operating system.

00:03:12.440 --> 00:03:15.490
This is a characteristic which is regularly observed in

00:03:15.490 --> 00:03:18.840
malware which resolves its APIs at runtime.

00:03:18.900 --> 00:03:21.040
As we will discuss later on in the course,

00:03:21.150 --> 00:03:25.240
some antivirus solutions make use of artificial intelligence in an

00:03:25.240 --> 00:03:29.430
attempt to automate a malware analyst's job by attempting to

00:03:29.430 --> 00:03:32.530
classify files based on their characteristics.