WEBVTT 00:00:00.410 --> 00:00:03.070 To be able to use Veil, you will need to install it. 00:00:03.440 --> 00:00:05.360 Installation is pretty straightforward. 00:00:05.840 --> 00:00:07.460 You can get Veil in two ways, 00:00:07.610 --> 00:00:11.340 through downloading and installing the package from the GitHub page or, 00:00:11.340 --> 00:00:14.640 arguably, the easiest option, installing through the package manager. 00:00:14.650 --> 00:00:17.660 And that is exactly what I'm going to show you in this demo. 00:00:19.340 --> 00:00:22.370 I will make use of the Kali Linux operating system as it is 00:00:22.370 --> 00:00:24.760 an OS of choice for red teamers; however, 00:00:24.770 --> 00:00:26.350 there are several other options, 00:00:26.500 --> 00:00:30.350 like for example building your own setup once you know which tools you like. 00:00:30.350 --> 00:00:34.080 You can install the Veil package by running apt‑get install veil. 00:00:34.090 --> 00:00:36.930 This will download and install the tool directly from the 00:00:36.930 --> 00:00:39.550 repository of Kali Linux onto your system. 00:00:40.140 --> 00:00:43.990 I chose to do this demo on the Kali Linux operating system as it is a 00:00:43.990 --> 00:00:47.720 well‑known operating system for pen testers and red teamers alike, 00:00:47.730 --> 00:00:49.910 which makes it easier for you to follow along. 00:00:50.730 --> 00:00:54.190 Kali Linux is a Linux distribution based on Debian, 00:00:54.240 --> 00:00:58.700 so settings and configurations carry over to another Debian distribution and, 00:00:58.700 --> 00:01:00.750 in many cases, to Ubuntu as well. 00:01:01.740 --> 00:01:04.970 Now that the installation through the package manager has been completed, 00:01:04.980 --> 00:01:08.680 we will run the tool by just typing veil. 00:01:08.680 --> 00:01:11.670 As this is the first time running Veil, 00:01:12.320 --> 00:01:15.220 it will automatically start the first run script, 00:01:15.230 --> 00:01:18.330 which allows you to automatically install all the prerequisites, 00:01:18.340 --> 00:01:21.400 which will enable Veil to live up to its full potential. 00:01:21.410 --> 00:01:24.180 You can choose to either install in interactive or 00:01:24.180 --> 00:01:26.860 silent mode by choosing yes or silent. 00:01:27.040 --> 00:01:30.050 The interactive mode allows you to change the settings of 00:01:30.060 --> 00:01:34.150 all packages which will be installed, like installation directories and such. 00:01:34.160 --> 00:01:38.220 While the silent mode will install everything in its default configurations, 00:01:38.940 --> 00:01:42.420 doing the silent installation will have it as an added bonus that you won't 00:01:42.420 --> 00:01:45.050 have to change any configuration settings within Veil. 00:01:45.060 --> 00:01:45.890 We will, however, 00:01:45.890 --> 00:01:49.480 still look at where to set them if you need to do so after 00:01:49.480 --> 00:01:51.020 the installation has been completed. 00:01:51.280 --> 00:01:52.170 In some cases, 00:01:52.170 --> 00:01:54.800 the installation of Veil will not complete successfully 00:01:54.810 --> 00:01:56.850 and Veil will not work correctly. 00:01:57.300 --> 00:02:03.150 In this case, you can restart the first run setup process by typing veil ‑‑setup. 00:02:03.740 --> 00:02:06.040 You can also add the silent switch if you wish to 00:02:06.040 --> 00:02:07.860 run it with all default settings. 00:02:08.130 --> 00:02:11.540 Now that the package manager has downloaded and installed the tool for us 00:02:11.550 --> 00:02:14.390 and the first run setup has completed without any issues, 00:02:14.390 --> 00:02:16.460 let's have a look at the installation directory. 00:02:17.140 --> 00:02:20.590 Veil has been installed in its own directory in /usr/share. 00:02:21.540 --> 00:02:23.030 There you will find the main file, 00:02:23.040 --> 00:02:26.100 as well as a directory containing the configuration files. 00:02:26.100 --> 00:02:29.400 If you chose not to install with the silent switch and have 00:02:29.410 --> 00:02:32.280 changed any of the prerequisite default paths, 00:02:32.280 --> 00:02:36.150 this is where you have the option to tell Veil the location of these files, 00:02:36.240 --> 00:02:40.170 as well as the directories where Veil will output the files it has generated. 00:02:40.180 --> 00:02:43.320 You can run the configuration file as any other Python script to get 00:02:43.320 --> 00:02:45.620 a nice overview of what can be configured in it. 00:02:45.740 --> 00:02:48.330 What you see here is the default configuration as it comes 00:02:48.330 --> 00:02:50.540 with the tool when it is freshly installed. 00:02:50.540 --> 00:02:53.460 There are two main directories Veil operates in, 00:02:54.040 --> 00:02:56.780 /var/lib/veil and /usr/share/veil. 00:02:56.780 --> 00:02:59.450 To allow Veil to operate correctly, 00:02:59.460 --> 00:03:01.340 we need to make sure that it has the correct 00:03:01.340 --> 00:03:03.220 permissions to write in those directories. 00:03:03.520 --> 00:03:06.040 We can do this by making our current user the owner of 00:03:06.040 --> 00:03:07.890 these and all underlying directories. 00:03:07.890 --> 00:03:09.260 Do this for both the directories, 00:03:09.260 --> 00:03:12.640 and don't forget the ‑r to make sure that all underlying 00:03:12.640 --> 00:03:15.460 directories and files are changed to this owner as well. 00:03:15.740 --> 00:03:17.910 Now that we have seen where you can make changes to the 00:03:17.910 --> 00:03:20.710 configuration and have made sure that Veil is allowed to write 00:03:20.710 --> 00:03:24.080 to the directories which it works in, let's have a look at the tool itself. 00:03:24.080 --> 00:03:28.470 From the main menu of Veil, we can see that Veil is divided into two tools, 00:03:28.670 --> 00:03:30.160 Evasion and Ordnance. 00:03:30.640 --> 00:03:33.260 Ordnance is used to generate shellcode to either using in an 00:03:33.260 --> 00:03:35.770 exploit or as input for the Evasion part. 00:03:36.340 --> 00:03:39.250 Evasion is the part of the tool where you can apply the different 00:03:39.250 --> 00:03:42.780 techniques Veil offers to make sure that your payload will bypass as 00:03:42.780 --> 00:03:46.040 many AV solutions as possible. As we will be using a default 00:03:46.040 --> 00:03:49.750 Meterpreter payload for this course, we don't have to generate our own shellcode. 00:03:50.140 --> 00:03:51.180 At the end of this course, 00:03:51.180 --> 00:03:55.340 I will provide a link to information regarding working with this specific tool. 00:03:55.470 --> 00:03:58.070 Now let us dive into the Evasion part. To go into the 00:03:58.070 --> 00:03:59.890 submenu for either of these tools, 00:03:59.900 --> 00:04:03.780 you can type use, and either 1 for Evasion or 2 for Ordnance. 00:04:04.040 --> 00:04:07.600 Typing use evasion or ordnance will work as well. At any moment 00:04:07.600 --> 00:04:11.080 in the tool, you can type back to go back one step or menu to be 00:04:11.080 --> 00:04:12.450 returned to the main menu. 00:04:12.460 --> 00:04:14.230 With basic navigation out of the way, 00:04:14.240 --> 00:04:16.370 let's continue on creating our first payload. 00:04:16.390 --> 00:04:19.980 Currently, there are 41 payloads available within Veil by default. 00:04:19.990 --> 00:04:23.280 A lot of them are added by scanning the installation directory of 00:04:23.280 --> 00:04:26.660 Metasploit and adding the readily available options you have there 00:04:26.660 --> 00:04:28.570 to this tool for further obfuscation. 00:04:28.740 --> 00:04:31.540 To view all the payloads, you can type list payloads, 00:04:31.550 --> 00:04:33.750 which will list all the options on your screen. 00:04:33.760 --> 00:04:36.060 As you can see, there are a lot of flavors. 00:04:36.040 --> 00:04:37.780 All payloads have its pros and cons. 00:04:37.780 --> 00:04:41.620 For instance, if you are attacking an older or stripped down version of Windows, 00:04:41.630 --> 00:04:44.770 you could choose to go for PowerShell or a C# variant. 00:04:45.140 --> 00:04:49.740 Linux environments are easier compromised by using either C, Go or Python, 00:04:49.740 --> 00:04:50.500 for example. 00:04:50.510 --> 00:04:53.700 I have identified that our target machine is running Windows 10, 00:04:53.830 --> 00:04:54.830 and from experience, 00:04:54.830 --> 00:04:58.540 I have found that a packaged Python payload does very well here, so 00:04:58.540 --> 00:05:02.240 let's go for that and we will choose the Python Meterpreter version of 00:05:02.240 --> 00:05:07.410 the reverse HTTPS connection. We chose the HTTPS option to add a layer 00:05:07.410 --> 00:05:10.620 of encryption over the traffic, as well as trying to blend in with our 00:05:10.630 --> 00:05:11.760 other web traffic. 00:05:12.340 --> 00:05:15.760 So, we will use option 27 for our preferred payload. 00:05:16.940 --> 00:05:18.000 Choosing this payload, 00:05:18.010 --> 00:05:21.480 we are taken directly to the screen where we can configure the settings 00:05:21.480 --> 00:05:24.220 for it. At any time during this configuration step, 00:05:24.230 --> 00:05:28.250 you can type options to view the currently set configuration for this payload. 00:05:28.640 --> 00:05:31.220 You can change any of the options by typing set, 00:05:31.230 --> 00:05:34.680 followed by the option name, and the value you want to set it to. 00:05:35.000 --> 00:05:39.240 The options can be divided into three sections. Payload settings so 00:05:39.240 --> 00:05:42.300 the implant knows where to go back to and through what method to 00:05:42.300 --> 00:05:45.020 execute. Environmental key settings. 00:05:45.180 --> 00:05:49.460 These make sure that the payload is executed on the machine you wanted to. And, 00:05:49.460 --> 00:05:51.640 lastly, anti‑analysis settings. 00:05:51.890 --> 00:05:54.940 These are the settings which allow your payload to try and check if 00:05:54.940 --> 00:05:59.130 it is run within an analysis environment. Before you continue to 00:05:59.130 --> 00:06:01.990 set up the options for our payload, I do want to explain the 00:06:01.990 --> 00:06:05.350 differences between the injection methods which can be utilized to 00:06:05.350 --> 00:06:06.760 execute our payload. 00:06:06.960 --> 00:06:11.070 You can choose for virtual allocation, void pointer casting or heap allocation. 00:06:11.540 --> 00:06:12.790 All have their uses, 00:06:12.800 --> 00:06:16.760 especially when you are using the code injected into other forms of delivery 00:06:16.760 --> 00:06:20.150 besides our compiled Python payload. First off, virtual alloc. 00:06:20.210 --> 00:06:24.650 Virtual allocation is the most used option as it allocates memory as read/write, 00:06:24.780 --> 00:06:28.670 copies in its code, calls on the Windows API to set it to read execute, and 00:06:28.670 --> 00:06:32.070 starts a threat. Void pointer casting is a tough one. 00:06:32.440 --> 00:06:35.630 It casts your payload to a raw chunk of memory, invokes 00:06:35.630 --> 00:06:38.930 execution on it, and jump executes straight to that. 00:06:38.940 --> 00:06:41.670 The downside to this method is that there is no guarantee 00:06:41.670 --> 00:06:45.690 that a memory region is executable, so depending on available protections, 00:06:45.700 --> 00:06:46.440 it might fail. 00:06:46.540 --> 00:06:50.870 Heap allocation will create a heap object and then manually allocate memory 00:06:50.870 --> 00:06:54.960 space for it, copy in the shellcode, and do the same kind of approach as the 00:06:54.960 --> 00:06:57.510 first option. With the different options out of the way, 00:06:57.520 --> 00:07:00.670 let's proceed with configuring the settings for our payload, starting 00:07:00.670 --> 00:07:04.300 with the IP and port the implant needs to connect back to. So let's 00:07:04.300 --> 00:07:06.750 set the localhost IP and the local port. 00:07:06.840 --> 00:07:10.210 The localhost IP is that of the system in our demo environment, 00:07:10.220 --> 00:07:14.360 and we will use port 443 to blend in with regular web traffic as much 00:07:14.360 --> 00:07:17.000 as possible. During our investigation of our target, 00:07:17.140 --> 00:07:21.890 we identified that the person to attack has the username hr, so let's set that 00:07:21.900 --> 00:07:26.220 as our environmental key to make sure that it is only executed on his PC. As 00:07:26.220 --> 00:07:29.900 we would like to have our payload compiled to an executable, this is set to 00:07:29.900 --> 00:07:33.660 true by default in the payload options, we get the following question. 00:07:33.670 --> 00:07:38.630 We can choose between PyInstaller or py2exe. PyInstaller is default; however, 00:07:38.630 --> 00:07:41.050 there are some known issues with the default installation where the 00:07:41.050 --> 00:07:43.680 payload works well when you run the Python file manually, 00:07:43.690 --> 00:07:46.630 but when compiled it would not execute on the target system. 00:07:46.640 --> 00:07:50.050 This is due to that the out‑of‑the‑box installation of PyInstaller 00:07:50.040 --> 00:07:54.530 defaults to opt in to data execution prevention. As PyInstaller is an open 00:07:54.530 --> 00:07:58.310 source package, there are ways to disable this and open it up for a wider 00:07:58.310 --> 00:08:00.250 range of shellcode injection techniques. 00:08:00.640 --> 00:08:04.030 A link to a guide on how to do this will be provided at the end of this course. 00:08:04.110 --> 00:08:06.500 We will choose to continue with the default and let 00:08:06.500 --> 00:08:08.260 Veil work on creating our payload. 00:08:09.640 --> 00:08:12.050 With the payload generation successfully completed, 00:08:12.050 --> 00:08:15.970 we are presented with an overview of what has been created and where to find it. 00:08:16.440 --> 00:08:19.370 We see that three files have been created, an executable, 00:08:19.380 --> 00:08:22.180 the Python source code, and the Metasploit resource file. 00:08:22.190 --> 00:08:25.860 The executable is the one we are going to send to our target through a 00:08:25.860 --> 00:08:29.620 clever ploy so he will execute our totally legit payload. The python 00:08:29.620 --> 00:08:32.429 source code we can use to customize the payload even more and 00:08:32.429 --> 00:08:34.789 eventually manually compile it, if needed. 00:08:34.799 --> 00:08:37.530 The Metasploit resource file we can use to quickly spin up our 00:08:37.530 --> 00:08:40.640 Metasploit listener with the settings we set for this specific 00:08:40.640 --> 00:08:45.100 payload. During your engagements, you most likely generate several payloads, 00:08:45.110 --> 00:08:48.560 and the blue team will inevitably upload a sample to VirusTotal. 00:08:48.570 --> 00:08:51.430 The creators of Veil have also accounted for that by adding a 00:08:51.430 --> 00:08:55.220 little function initially created by XXX. In the Evasion menu 00:08:55.230 --> 00:08:57.110 where you end up after pressing return, 00:08:57.120 --> 00:09:00.960 we can call the function CheckVT to check the hashes of the payloads we 00:09:00.960 --> 00:09:04.950 generated against the entries in the database of VirusTotal. When a 00:09:04.950 --> 00:09:08.340 payload shows up, we know that a particular implant has been burned and 00:09:08.340 --> 00:09:11.720 cannot be used anymore for further engagement. Running it now, you can 00:09:11.720 --> 00:09:15.090 see that the two reports that are payloads are unique and not yet known 00:09:15.090 --> 00:09:16.180 to VirusTotal. 00:09:16.190 --> 00:09:19.350 All right, let's continue and start our listener and move on to our target 00:09:19.350 --> 00:09:22.710 machine to see if the payload is detected by Windows Defender. 00:09:28.440 --> 00:09:31.800 Now that we're on a target system, we can see that the payload we 00:09:31.800 --> 00:09:33.990 created has magically appeared on the desktop. 00:09:34.000 --> 00:09:37.280 Getting your payload onto the target system is not part of this course. 00:09:37.550 --> 00:09:39.760 Let's execute the payload and see if a connection is 00:09:39.760 --> 00:09:41.970 returned or that it is stopped by the AV. 00:09:42.540 --> 00:09:43.300 As we can see, 00:09:43.300 --> 00:09:46.370 a connection is returned to our listener in Metasploit. As the 00:09:46.370 --> 00:09:48.460 payload has been executed on the target host, 00:09:48.470 --> 00:09:51.440 we might conclude that the payload was not marked by the antivirus 00:09:51.440 --> 00:09:54.280 as being malicious and executed perfectly fine. 00:09:54.290 --> 00:09:57.470 Now that we have seen how to create a payload through the user interface, 00:09:57.660 --> 00:10:00.720 let me show you how it's done through the command line, as this can be 00:10:00.720 --> 00:10:04.670 very helpful when integrating Veil into your own tools and workflow. 00:10:04.670 --> 00:10:06.890 From inside the installation directory, 00:10:07.040 --> 00:10:09.690 we can run veil with the help switch to get a printout 00:10:09.700 --> 00:10:11.380 of all the options available to us. 00:10:11.380 --> 00:10:14.080 Here we can see that both Evasion and Ordnance are 00:10:14.080 --> 00:10:15.480 available through the command line. 00:10:15.490 --> 00:10:18.860 Let's build up the payload we previously generated through this method. 00:10:18.870 --> 00:10:21.940 The t switch allows us to choose between the two main 00:10:21.940 --> 00:10:24.950 parts of Veil, being Ordnance and Evasion. 00:10:25.440 --> 00:10:27.780 As we are recreating our payload through this method, 00:10:27.790 --> 00:10:31.060 let's go for Evasion. Adding the p switch, which we configure Veil 00:10:31.060 --> 00:10:34.340 to use our python/meterpreter/rev_https payload. 00:10:34.490 --> 00:10:36.320 Don't forget the .py at the end. 00:10:36.330 --> 00:10:37.360 For our payload, 00:10:37.370 --> 00:10:42.380 we will be setting our IP and our port number, as well as our environmental key, 00:10:42.380 --> 00:10:44.550 which is the username of our target. 00:10:45.040 --> 00:10:46.230 With all the options set, 00:10:46.240 --> 00:10:48.930 we specify that we want our payload compiled through the 00:10:48.940 --> 00:10:52.790 PyInstaller and add a ‑o to give the output a name. 00:10:52.960 --> 00:10:56.630 This is all that is needed to configure the same payload we created in the 00:10:56.630 --> 00:11:00.020 user interface through the command line. Having the option to generate a 00:11:00.020 --> 00:11:03.200 payload through the command line allows you to integrate it into your 00:11:03.200 --> 00:11:06.360 workflow and generate new payloads in an instant, 00:11:06.370 --> 00:11:09.870 speeding up the time it takes to react to a changing environment. 00:11:10.340 --> 00:11:13.550 So, we have learned where Veil fits into your workflow and the MITRE 00:11:13.550 --> 00:11:16.730 ATT&CK chain and how to create a unique payload through the user 00:11:16.730 --> 00:11:18.460 interface, as well as the command line. 00:11:18.770 --> 00:11:21.370 Let's continue in the next section to review some additional 00:11:21.370 --> 00:11:23.900 documentation on tools integrated into Veil, 00:11:24.130 --> 00:11:26.490 as well as guides to developing your own payload.