WEBVTT 00:00:01.740 --> 00:00:02.520 Hey everyone, 00:00:02.530 --> 00:00:05.220 and thank you for joining me on Pluralsight to learn more about 00:00:05.220 --> 00:00:08.039 defense evasion through the tool called Veil. 00:00:08.039 --> 00:00:12.050 Veil is an open source project released under the GNU General Public License. 00:00:12.060 --> 00:00:14.720 The creators of this tool are Will Schroeder, Chris 00:00:14.720 --> 00:00:19.270 Truncer, and Michael Wright. Currently, Veil is under support by Chris Truncer. 00:00:19.940 --> 00:00:20.560 Above all, 00:00:20.570 --> 00:00:23.280 I want to thank them for their contributions to the community 00:00:23.290 --> 00:00:26.450 and hope this course can showcase their work in such a way that 00:00:26.460 --> 00:00:27.920 others can appreciate it as well. 00:00:28.180 --> 00:00:31.510 This tool is created to automate the generation process of Metasploit 00:00:31.510 --> 00:00:35.590 payloads that bypass as many antivirus solutions as possible by 00:00:35.590 --> 00:00:38.900 combining different techniques and being able to compile the payload in 00:00:38.900 --> 00:00:40.950 a higher level language such as Python. 00:00:41.340 --> 00:00:43.510 And that is exactly what it delivers. 00:00:43.560 --> 00:00:47.520 It's a free and open source shellcode generation and obfuscation framework 00:00:47.520 --> 00:00:51.330 that combines encryption and obfuscation techniques to create repeatable, 00:00:51.330 --> 00:00:54.820 but unique payloads that evade antivirus. It is available through the 00:00:54.820 --> 00:00:58.620 package manager on Kali Linux or by downloading it from the project GitHub 00:00:58.620 --> 00:01:02.430 page here. Operation instructions can be found on the wiki included on the 00:01:02.430 --> 00:01:03.460 GitHub project page. 00:01:03.640 --> 00:01:04.459 Once downloaded, 00:01:04.459 --> 00:01:07.390 the installation of all requirements is handled through the script, 00:01:07.400 --> 00:01:10.500 which is initialized when you first start the tool. Though most the 00:01:10.500 --> 00:01:13.720 installation will finish without issues, I will go through some of the 00:01:13.720 --> 00:01:16.900 installation gotchas shortly. If you haven't picked up on this already, 00:01:16.910 --> 00:01:19.120 Veil is focused on the creation of payloads, 00:01:19.120 --> 00:01:22.820 which can generate from the same shellcode, albeit Meterpreter or 00:01:22.820 --> 00:01:26.280 your own custom back door. By utilizing the combined obfuscation 00:01:26.280 --> 00:01:28.150 techniques used throughout the industry, 00:01:28.180 --> 00:01:32.170 it allows you to create a unique payload every time. As every payload 00:01:32.170 --> 00:01:36.230 has a unique signature, Veil also allows you to check if the blue team 00:01:36.240 --> 00:01:38.270 has submitted the payload to VirusTotal. 00:01:38.280 --> 00:01:40.310 This allows you to keep track of the payloads that 00:01:40.310 --> 00:01:41.950 are burned throughout the campaign. 00:01:42.040 --> 00:01:43.090 At the end of this course, 00:01:43.090 --> 00:01:46.130 you will know how to install the tool and how to solve common issues, 00:01:46.130 --> 00:01:49.150 as well as creating your environmentally keyed payloads 00:01:49.140 --> 00:01:51.310 through the user interface and command line. 00:01:51.320 --> 00:01:53.870 Now, let's take a look where Veil is located on the cyber 00:01:53.870 --> 00:01:57.120 kill chain. Veil is used to obfuscate your payloads 00:01:57.120 --> 00:01:59.000 throughout the operation; therefore, 00:01:59.000 --> 00:02:03.020 Veil would placed on two different points in the cyber kill chain. Veil cannot 00:02:03.020 --> 00:02:06.130 only be used to obfuscate your payloads on initial access, 00:02:06.140 --> 00:02:10.350 but also by creating a new unique payload to help you spread throughout the 00:02:10.350 --> 00:02:14.320 network and reduce the chance that you are booted from a network when one 00:02:14.320 --> 00:02:18.960 implant is caught. Veil is focused on evading AV detections. 00:02:19.030 --> 00:02:21.970 Therefore, the MITRE ATT&CK coverage is rather specific. 00:02:22.840 --> 00:02:26.910 You will find Veil and most of its functions in the Defense Evasion subcategory. 00:02:26.910 --> 00:02:31.410 One of the features that sets Veil apart is the ability to natively compile your 00:02:31.410 --> 00:02:34.030 payloads into a select few high‑level languages, 00:02:34.040 --> 00:02:37.950 allowing Veil to use the advantages of a packaged executable. The use of 00:02:37.950 --> 00:02:42.060 native compilation allows Veil to compile the employed obfuscation and 00:02:42.060 --> 00:02:46.080 encryption techniques in a package granting the ability to create a unique 00:02:46.080 --> 00:02:49.480 signature with every compile allowing for packages to slip past 00:02:49.480 --> 00:02:53.340 signature‑based AV with ease. Another of its features, 00:02:53.350 --> 00:02:57.430 like with several other solutions, allows you to set boundaries to your payloads. 00:02:57.440 --> 00:03:00.740 This function allows you to make sure that the payload does not run 00:03:00.750 --> 00:03:04.190 outside the timeframe scope for the engagement and even checks for 00:03:04.190 --> 00:03:07.780 parameters so that it only executes on the computer of that specific 00:03:07.780 --> 00:03:09.770 user you identified as your target. 00:03:10.140 --> 00:03:13.380 I want to quickly go over what the tool does and how it is 00:03:13.380 --> 00:03:15.280 used within the target infrastructure. 00:03:15.290 --> 00:03:17.610 After that, we will dive into a live demo. 00:03:17.620 --> 00:03:21.310 Veil has the option to create a payload or use your own custom 00:03:21.310 --> 00:03:24.150 code base to further use in its functionality. 00:03:24.640 --> 00:03:27.910 Using your intended back door, you can use the obfuscation and 00:03:27.910 --> 00:03:29.850 encryption techniques available in the tool, 00:03:29.860 --> 00:03:33.690 like Pyherion and XOR single‑bit encryption, or you can send your 00:03:33.690 --> 00:03:37.320 payload through to the manually integrated packages from other tools 00:03:37.320 --> 00:03:39.670 like PE‑Scrambler or the Backdoor Factory. 00:03:39.840 --> 00:03:42.630 With your now obfuscated or encrypted payload in hand, 00:03:42.640 --> 00:03:46.950 Veil gives you the possibility to natively compile it in the language of choice, 00:03:46.960 --> 00:03:50.310 which you selected at the start of the process. How this all fits 00:03:50.310 --> 00:03:52.570 together in the tool I will show you in the demo. 00:03:53.240 --> 00:03:55.260 So, now that we know how the tool operates, 00:03:55.270 --> 00:03:58.770 let's quickly look at how the functions operate within your target environment. 00:03:58.780 --> 00:04:01.110 The payload created by Veil is sent through your 00:04:01.110 --> 00:04:03.070 preferred method to your target. 00:04:03.120 --> 00:04:03.900 In this case, 00:04:03.910 --> 00:04:07.460 let's assume it is sent through an email from your adversarial environment. 00:04:07.940 --> 00:04:10.970 Using the features of Veil, your payload has been keyed to 00:04:10.970 --> 00:04:13.710 only execute on the computer of the HR person you 00:04:13.710 --> 00:04:15.650 identified during your scoping phase. 00:04:16.040 --> 00:04:19.240 The payload is sent through the network to your target PC 00:04:19.250 --> 00:04:21.459 and checked locally by the virus scanner. 00:04:21.529 --> 00:04:23.080 As Veil has done its magic, 00:04:23.090 --> 00:04:27.300 the payload is not detected as malicious and can be executed on the target PC. 00:04:27.310 --> 00:04:28.030 Luckily, 00:04:28.040 --> 00:04:32.050 our HR guy is helpful and falls for our ploy, allowing our payload to run 00:04:32.060 --> 00:04:34.760 and do its job by allowing us access to his system. 00:04:34.940 --> 00:04:36.970 If the payload had been sent to any other user, 00:04:36.970 --> 00:04:40.530 for example the person in finance, it would not have executed as the 00:04:40.530 --> 00:04:43.970 environmental keys did not match with what it was set to look for.