WEBVTT

00:00:00.240 --> 00:00:02.920
Let's now discuss an alternative format,

00:00:02.920 --> 00:00:09.170
which also ships with the Metasploit framework. The exe‑only format can be

00:00:09.170 --> 00:00:14.160
used by passing the ‑f flag and the exe‑only parameter.

00:00:14.540 --> 00:00:20.040
Once again, if no alternative executable file is provided by using the ‑x flag,

00:00:20.050 --> 00:00:22.840
msfvenom will use the default templates,

00:00:22.850 --> 00:00:24.950
which should be avoided at all costs.

00:00:25.440 --> 00:00:27.730
Instead of using a small stub of shellcode,

00:00:27.740 --> 00:00:31.800
which allocates memory and moves the stager into the memory at runtime,

00:00:31.800 --> 00:00:35.980
the exe‑only format simply places the shellcode at the

00:00:35.980 --> 00:00:38.160
entry point of the executable file,

00:00:38.440 --> 00:00:42.260
which means that no calls to VirtualAlloc are performed, and we do not

00:00:42.260 --> 00:00:45.760
have any hardcoded shellcode in the executable file.

00:00:45.840 --> 00:00:48.900
Currently, we actually do have hardcoded shellcode, which

00:00:48.900 --> 00:00:51.670
could easily be detected by antivirus since we have not

00:00:51.670 --> 00:00:53.850
encoded or encrypted our stager.

00:00:55.140 --> 00:00:59.050
Let's now attempt to embed a stager inside the 7‑Zip executable

00:00:59.050 --> 00:01:02.970
file as we did previously, but this time using the exe‑only

00:01:02.970 --> 00:01:06.350
format. As you can see, this time,

00:01:06.360 --> 00:01:09.760
only 16 scanners were able to detect our stager.

00:01:10.540 --> 00:01:14.550
You may recall that 20 scanners had detected the same stager in the

00:01:14.550 --> 00:01:18.060
same executable file when using the exe format.

00:01:19.240 --> 00:01:22.560
This demonstrates how the exe‑only format is more

00:01:22.560 --> 00:01:25.060
evasive than its exe counterpart.