WEBVTT

00:00:02.140 --> 00:00:02.710
[Autogenerated] Hey there.

00:00:02.720 --> 00:00:04.820
Welcome to our color Lennox Virtual Machine,

00:00:05.050 --> 00:00:07.750
D's or machine that will be using his attacker machine.

00:00:08.340 --> 00:00:11.510
So let's get started by taking a look at the invoke of sophistication.

00:00:11.510 --> 00:00:12.050
Get Hub.

00:00:12.740 --> 00:00:16.450
You can access it by searching the two on Google or by typing this euro.

00:00:18.700 --> 00:00:19.660
They get her page.

00:00:19.760 --> 00:00:22.350
Was he a very detailed description for the two and

00:00:22.350 --> 00:00:24.540
how to use it and take a look here.

00:00:24.690 --> 00:00:27.110
You said that it, too, is developing power show,

00:00:27.120 --> 00:00:29.080
which is usually for Windows environment.

00:00:29.740 --> 00:00:31.880
But what you may not know is that it can actually

00:00:31.880 --> 00:00:33.750
stole power shell in color Lennox.

00:00:34.340 --> 00:00:37.160
In this way, I don't have to have an extra Windows virtual machine.

00:00:37.320 --> 00:00:40.450
I can simply use my normal right inversion machine for this task.

00:00:41.200 --> 00:00:44.760
So you stole Persian colonics, which isn't to open a terminal,

00:00:46.340 --> 00:00:49.710
then escalator privileged to route by typing pseudo dash.

00:00:49.720 --> 00:00:55.000
I then doing at a P T get update to update on my report stories.

00:00:56.130 --> 00:01:00.970
And when that's finished, I would just type a PT yet install power show.

00:01:01.840 --> 00:01:04.790
And this comment would don't know the power show installing

00:01:04.790 --> 00:01:08.070
colonics simple is that so I could just press,

00:01:08.080 --> 00:01:11.400
enter and wait this process may take a few minutes,

00:01:11.470 --> 00:01:13.650
but I speed up these videos so we don't waste time here.

00:01:15.040 --> 00:01:15.690
Perfect.

00:01:15.730 --> 00:01:17.890
Then now partials installed.

00:01:18.090 --> 00:01:22.650
I can run it by tapping P W A S h and then precedent there.

00:01:23.760 --> 00:01:24.140
Awesome.

00:01:24.140 --> 00:01:24.580
Take a look.

00:01:24.710 --> 00:01:28.550
Now we have the power sharing Kalinic's and this will save us a lot of time.

00:01:28.980 --> 00:01:29.630
I can even time.

00:01:29.630 --> 00:01:31.610
So in Commons, here to testify is working fine.

00:01:32.540 --> 00:01:34.550
When I'm done, I just have to talk to exit.

00:01:35.640 --> 00:01:39.650
Not that we have the partial installed as downloaded invoke obfuscation.

00:01:40.290 --> 00:01:43.250
First, let me go to the folder in which you want to save the files.

00:01:43.610 --> 00:01:45.150
In year, I'll use my desktop.

00:01:46.240 --> 00:01:50.590
Then we can go out the faster and get her by using this common Geet

00:01:50.900 --> 00:01:53.680
clone and the euro for the invoke obfuscation.

00:01:53.690 --> 00:01:54.250
Get Hub!

00:01:55.400 --> 00:01:55.900
Awesome!

00:01:56.120 --> 00:01:59.110
Now I just press enter and he don't look out the files

00:01:59.110 --> 00:02:00.970
from get help in saving on my desktop.

00:02:02.640 --> 00:02:04.030
If we take a look on the desktop,

00:02:04.120 --> 00:02:06.460
you see that a folder was created and inside of this

00:02:06.460 --> 00:02:08.259
folder I would invoke obfuscation.

00:02:08.259 --> 00:02:09.150
Files are saved.

00:02:09.789 --> 00:02:12.100
So let's use the tool for that.

00:02:12.230 --> 00:02:13.350
Let's start power show.

00:02:14.740 --> 00:02:17.740
Then we have to use the partial comment in portion module

00:02:17.920 --> 00:02:22.300
to low the two on power show for that I type import module

00:02:23.010 --> 00:02:25.000
and then invoke obfuscation.

00:02:25.130 --> 00:02:30.180
Dar psd one Awesome.

00:02:30.400 --> 00:02:31.590
Now the truce installed.

00:02:31.610 --> 00:02:38.560
I can just type invoke dash obfuscation and then press enter cortical Look,

00:02:38.680 --> 00:02:41.090
the two is now working, and one of things that I love.

00:02:41.090 --> 00:02:41.520
This, too,

00:02:41.650 --> 00:02:45.050
is that it's really easy to use and there's tons of details on the screen.

00:02:45.840 --> 00:02:48.130
So to get you started on how the two works,

00:02:48.310 --> 00:02:54.570
let's take a look on the tutorial for two for that teletype tutorial in here,

00:02:54.620 --> 00:02:56.850
we can see there are five steps to use this to.

00:02:57.810 --> 00:02:59.370
First we defined the common.

00:02:59.370 --> 00:03:00.550
There we went to obfuscate.

00:03:01.240 --> 00:03:04.250
We can type the common on the screen by using SAT script block,

00:03:04.640 --> 00:03:08.550
or we can point to a script file using the set script path.

00:03:09.910 --> 00:03:13.450
Then the second step is to say, like what kind of sophistication we want to do.

00:03:14.240 --> 00:03:16.690
Then the tail stamp is to test the common if you want,

00:03:17.280 --> 00:03:21.050
and once the common is obfuscated, we can copy it or saving the file,

00:03:21.600 --> 00:03:24.660
and if you want, we can resent it, too, and start all over again.

00:03:25.840 --> 00:03:26.330
Awesome.

00:03:26.330 --> 00:03:27.340
So let's get started.

00:03:27.540 --> 00:03:29.650
Let's a very basic ____ Road example.

00:03:30.380 --> 00:03:34.280
First set of screws by typing set script block and

00:03:34.280 --> 00:03:35.650
then the common that I want to run.

00:03:36.240 --> 00:03:38.890
In my case, I just want to print a phrase on the screen.

00:03:39.210 --> 00:03:42.750
So type right host and then hello road.

00:03:43.450 --> 00:03:45.350
And also, I was said the phone to Green.

00:03:46.340 --> 00:03:49.580
Once I press enter to to tell me that it's Crete was set.

00:03:49.910 --> 00:03:52.190
And then now we need to select another obfuscation

00:03:52.190 --> 00:03:55.230
technique for this hello world demo of select.

00:03:55.290 --> 00:03:58.930
According here, you can see there are several options for including,

00:03:59.150 --> 00:03:59.700
for example,

00:03:59.710 --> 00:04:03.620
we can do it asking cold or a packs a decimal in code or

00:04:03.620 --> 00:04:06.070
even encrypting the string in here.

00:04:06.150 --> 00:04:08.050
It's like the 1st 1 which is an asking,

00:04:08.050 --> 00:04:13.600
quoting so a type one and the press enter Awesome.

00:04:13.600 --> 00:04:16.160
Take a look they took Give me this Oprah skated string.

00:04:16.260 --> 00:04:18.750
That is exactly the same thing as original comment.

00:04:19.279 --> 00:04:22.089
As you can see, it looks totally different from a regional command,

00:04:22.990 --> 00:04:24.600
so let's no test this.

00:04:24.870 --> 00:04:27.860
Let's go to your Windows machine here.

00:04:27.870 --> 00:04:29.260
As you can see, I have a window.

00:04:29.260 --> 00:04:33.150
Several machine with the Windows defender active also on

00:04:33.150 --> 00:04:35.220
installing antivirus to simulate a real road.

00:04:35.220 --> 00:04:39.450
Example in my point is not to prove that this specific in the virus bad,

00:04:39.840 --> 00:04:42.250
but that virtually any inter virus can be bypassed.

00:04:42.640 --> 00:04:44.500
And actually, the center fire is a really good one.

00:04:45.580 --> 00:04:47.650
Okay, Now let me open the comments prompt.

00:04:48.130 --> 00:04:49.850
And then let's launch power show.

00:04:52.240 --> 00:04:52.770
Amazing.

00:04:52.880 --> 00:04:54.000
Now just testing.

00:04:54.130 --> 00:04:56.590
Let me copy and paste original common So you can see

00:04:56.590 --> 00:05:01.390
the output then Pretty simple, right?

00:05:01.640 --> 00:05:06.130
We got a hello world No, let's go back and copy and paste the opus.

00:05:06.130 --> 00:05:12.190
Katie Command, take a look.

00:05:12.200 --> 00:05:13.790
The output is exactly the same.

00:05:14.110 --> 00:05:17.300
And these shows that even though both comments look totally different,

00:05:17.490 --> 00:05:18.350
they do the same thing.

00:05:19.290 --> 00:05:21.210
Now, before we go to real road scenario,

00:05:21.410 --> 00:05:23.190
let me show you one more feature of this too.

00:05:23.940 --> 00:05:27.590
Let's say you have a long parish escrito obfuscate as example.

00:05:27.760 --> 00:05:31.910
L created this file called my script in and out of my common

00:05:31.910 --> 00:05:37.260
lining there then on the evoque obfuscation to instead of

00:05:37.260 --> 00:05:38.980
using a single common as input,

00:05:39.110 --> 00:05:42.760
I can use the whole fire was in good by typing set script

00:05:42.770 --> 00:05:45.150
path and then the path for the script.

00:05:46.380 --> 00:05:49.560
And then when I press enter, the two tells me that this cruise was loaded.

00:05:49.720 --> 00:05:54.180
And then we can now chose on AFIS cation method in here of select in courting.

00:05:54.890 --> 00:05:57.450
And then one of the options just secure string,

00:05:59.300 --> 00:06:02.250
then the to read the whole script and recorded for us.

00:06:02.740 --> 00:06:04.980
No, Instead of copying paste their output,

00:06:05.080 --> 00:06:07.800
I can just save this into a file by typing out,

00:06:08.390 --> 00:06:09.270
impressing enter.

00:06:10.220 --> 00:06:12.760
Then we need to type the path for the output file.

00:06:13.030 --> 00:06:14.650
In my case, it's my desktop.

00:06:15.800 --> 00:06:16.220
Perfect.

00:06:16.390 --> 00:06:18.550
Now we just have to press enter and that's it.

00:06:19.140 --> 00:06:21.870
Now we have the Oprah skated Carmen it into this fire in my desktop,

00:06:22.700 --> 00:06:25.290
and here you can transfer this fight to your victim machine.

00:06:25.480 --> 00:06:29.980
Or you can copy the content of this file and pasted in the power show.

00:06:31.840 --> 00:06:34.380
Once you executed, you see that it works perfectly.

00:06:35.390 --> 00:06:36.170
Pretty cool, right?

00:06:36.310 --> 00:06:38.500
But I just the basics in or next demo.

00:06:38.510 --> 00:06:42.950
You see how to use this to to bypass and devise attractions, so stay tuned