WEBVTT

00:00:01.740 --> 00:00:02.840
[Autogenerated] Hey, there were better.

00:00:02.840 --> 00:00:03.240
Colin.

00:00:03.240 --> 00:00:04.150
It's virtual machine.

00:00:04.540 --> 00:00:07.030
So let's say you want to execute a malicious code in

00:00:07.030 --> 00:00:08.450
the machine that hasn't a virus.

00:00:08.940 --> 00:00:09.440
For example,

00:00:09.580 --> 00:00:12.320
let's say you want to execute a reverse shell script that he will

00:00:12.320 --> 00:00:14.250
allow you to remotely control the computer,

00:00:15.130 --> 00:00:16.550
their tones of partial screws.

00:00:16.550 --> 00:00:21.430
For that, I personally like the use screws from this get home page in year,

00:00:21.470 --> 00:00:25.590
we can go to the reverse show cheat sheet a year if I

00:00:25.600 --> 00:00:27.830
tones or reverse shell quotes and pretty much any

00:00:27.830 --> 00:00:29.250
scripting language you can think off.

00:00:29.890 --> 00:00:31.850
So let's check the power share ones.

00:00:33.270 --> 00:00:37.170
The year there are three different poor show river shows for this demo.

00:00:37.180 --> 00:00:38.350
I use this middle one,

00:00:38.990 --> 00:00:41.540
and these line contains the whole power show Common to

00:00:41.540 --> 00:00:43.530
launch a power shell and executed code.

00:00:43.880 --> 00:00:46.240
But what I'm interested in here is the actual power

00:00:46.240 --> 00:00:47.650
show called Between the coats.

00:00:48.280 --> 00:00:52.450
So L carpet and paste this into a file in my desktop.

00:00:56.440 --> 00:00:57.430
Then in here,

00:00:57.490 --> 00:01:01.440
I'll just say this I p address that the show we connect to in my case,

00:01:01.520 --> 00:01:02.950
I put in my I P address here.

00:01:04.040 --> 00:01:07.020
Also, I could change the poor that is reverse show use,

00:01:07.260 --> 00:01:08.480
but in my case, I will leave.

00:01:08.480 --> 00:01:11.150
That is, it is which is the port 40 to 42.

00:01:11.810 --> 00:01:12.290
Perfect.

00:01:12.300 --> 00:01:15.040
Now I can saving close this file Now.

00:01:15.040 --> 00:01:16.680
When someone runs is on a machine,

00:01:16.810 --> 00:01:19.650
the computer connected therapy and gives us a show.

00:01:20.210 --> 00:01:21.840
So we needed a listener for the show.

00:01:22.120 --> 00:01:23.850
For that, I'll use the Net cat.

00:01:24.540 --> 00:01:30.280
So let me quickly migrate to root and then type and sea and then dash N

00:01:30.280 --> 00:01:33.520
v L P and then the poor that I want to listen on.

00:01:33.830 --> 00:01:37.250
Remember, in our keys it'll be deported 40 to 42.

00:01:39.010 --> 00:01:41.560
Alison, As you can see, that cat is no listening.

00:01:41.560 --> 00:01:43.550
Import 42 42 for connections.

00:01:44.440 --> 00:01:44.800
Perfect.

00:01:44.800 --> 00:01:45.710
So we are set.

00:01:46.100 --> 00:01:49.550
Let's start by doing a simple test without using an obfuscation.

00:01:50.240 --> 00:01:53.210
So I'll try to run this reverse show cold as it is.

00:01:53.640 --> 00:01:57.850
So first, how copy this code and didn't go to a Windows machine.

00:01:58.600 --> 00:02:02.040
And again, remember, this machine has the Windows Defender enabled,

00:02:02.360 --> 00:02:03.950
as was decent of IRS enabled.

00:02:04.640 --> 00:02:11.160
So I open the command prompt and then run power show in here.

00:02:11.210 --> 00:02:13.150
I would just pass the quoted a cop before.

00:02:13.870 --> 00:02:17.340
Now let's run it awesome.

00:02:17.340 --> 00:02:17.930
Take a look.

00:02:17.950 --> 00:02:19.070
The enter virus detected.

00:02:19.070 --> 00:02:21.950
This is a malicious cold and prevented it from running.

00:02:22.990 --> 00:02:26.050
So let's go back to Colonel Lennox and try to Oprah skate this cold.

00:02:27.340 --> 00:02:29.750
First, let's start the invoke obfuscation.

00:02:30.330 --> 00:02:32.080
For that, I would start power show,

00:02:33.340 --> 00:02:38.670
then loading vocal replication module and then it started.

00:02:38.680 --> 00:02:43.780
Invoke obfuscation, Too awesome.

00:02:43.980 --> 00:02:46.550
Let's start by setting the path for my reverse show script.

00:02:47.240 --> 00:02:52.650
For that, a type set is create a path and then the path for my script.

00:02:54.590 --> 00:02:55.040
Awesome.

00:02:55.270 --> 00:03:00.150
Now let's unlike the obfuscation technique in Year of Select Encoding.

00:03:00.940 --> 00:03:04.000
And then I was like the option five, which includes the script.

00:03:06.140 --> 00:03:06.510
Perfect.

00:03:06.510 --> 00:03:06.970
Take a look.

00:03:07.170 --> 00:03:08.910
Now we have a huge obfuscation string.

00:03:09.340 --> 00:03:13.650
So then let's cop it and then pasted on power show.

00:03:16.430 --> 00:03:19.410
Now I would have to do is cross your fingers and presenter.

00:03:20.940 --> 00:03:21.750
Oh, take a look.

00:03:21.760 --> 00:03:24.650
This didn't work the inter virus to detecting our script,

00:03:25.400 --> 00:03:27.950
and that's why it's really important to always test the commanding

00:03:27.950 --> 00:03:30.250
your lab before executing the target machine.

00:03:30.640 --> 00:03:32.820
If this machine was a production server,

00:03:32.990 --> 00:03:35.640
the anti virus would generate in alerts to the soccer team,

00:03:35.660 --> 00:03:39.190
and you would get caught for this reason a do recommend you

00:03:39.190 --> 00:03:42.200
creating a virtual machine with the same Windows version and

00:03:42.200 --> 00:03:43.900
the same improvise version there.

00:03:43.900 --> 00:03:44.950
Your target machine.

00:03:45.740 --> 00:03:46.310
In this way,

00:03:46.440 --> 00:03:50.060
you confess your risk Asian techniques before sending to the real target.

00:03:50.910 --> 00:03:54.810
Okay, so let's go back to colonise and try some different obfuscation techniques.

00:03:56.680 --> 00:04:00.130
First, let me closing, invoke AFIS cation and reopen it again.

00:04:00.420 --> 00:04:03.950
And these were set out of variables in the too, so we can start fresh.

00:04:05.220 --> 00:04:05.800
Perfect.

00:04:05.810 --> 00:04:07.750
Let me quickly said this creep path again.

00:04:09.040 --> 00:04:12.050
No, we need to experiment with different obfuscation techniques,

00:04:12.690 --> 00:04:16.579
and this process is kind of try on our which means you should explore each

00:04:16.579 --> 00:04:19.250
obfuscation technique and testing your testing server.

00:04:19.839 --> 00:04:21.310
But save us some time.

00:04:21.440 --> 00:04:25.250
I tested the script against few of the presentation techniques and for my tests,

00:04:25.340 --> 00:04:29.970
the ASD technique was successful, and actually from appears experience.

00:04:30.120 --> 00:04:32.750
The ASD technique is really the one that ours works.

00:04:33.640 --> 00:04:37.250
So let's say like the CST option year.

00:04:37.330 --> 00:04:39.290
You see, that are several A S D techniques.

00:04:39.880 --> 00:04:42.870
In my case, I would type or because I want our debt,

00:04:42.870 --> 00:04:46.750
it needs to be applied and to confirm that I want to use all the

00:04:46.750 --> 00:04:50.070
techniques of select Option one and then press enter.

00:04:51.540 --> 00:04:51.950
Awesome.

00:04:52.030 --> 00:04:54.450
As you can see, we have no Oprah skater commander.

00:04:55.040 --> 00:04:57.970
That's saving to a file to make things easier for that.

00:04:58.020 --> 00:05:02.280
I used to coming out and then but the path for the output file.

00:05:03.940 --> 00:05:04.420
Perfect.

00:05:04.520 --> 00:05:07.120
Now let me open new terminal window so we can compare

00:05:07.120 --> 00:05:08.870
the original script and the new one.

00:05:11.640 --> 00:05:11.960
Cool.

00:05:11.970 --> 00:05:12.460
Take a look.

00:05:12.540 --> 00:05:15.860
As you can see, the ASD technique changed the way the power show.

00:05:15.860 --> 00:05:19.200
No, they revoked, and these will help to obfuscate our actions.

00:05:20.140 --> 00:05:23.950
So let me copy this code and quickly confirmed that my next

00:05:23.950 --> 00:05:26.850
cats to running perfect it issue here.

00:05:27.150 --> 00:05:30.260
So now let's go to our Windows machine here,

00:05:30.380 --> 00:05:32.750
let me pay the full scale it cold into power show.

00:05:33.540 --> 00:05:39.290
And then let's cross our fingers and press enter and we got nothing.

00:05:39.460 --> 00:05:40.380
But that's a good sign.

00:05:40.510 --> 00:05:41.750
It means that it was not blocked.

00:05:42.240 --> 00:05:46.780
So let's go to college annex and see if you got something amazing.

00:05:46.780 --> 00:05:47.240
Take a look.

00:05:47.250 --> 00:05:48.950
We got a shelter or Ringo's box.

00:05:49.700 --> 00:05:50.970
If we do it, I p conflict.

00:05:51.070 --> 00:05:55.020
We can see that I have control to the Windows box and if a runner Who am I?

00:05:55.020 --> 00:05:55.520
Comment?

00:05:55.650 --> 00:05:57.300
I can see that I'm logged as a Adami.

00:05:58.140 --> 00:06:00.490
That's really cool rate were able to bypass both

00:06:00.500 --> 00:06:03.900
anti virus and Windows defender, and you've got a show as an ad mean,

00:06:04.250 --> 00:06:05.150
and that's amazing.