WEBVTT

00:00:00.140 --> 00:00:02.860
When you're going to use Veil as your payload obfuscation

00:00:02.860 --> 00:00:06.580
framework, make sure to check out Ordnance to also be able to

00:00:06.580 --> 00:00:08.420
generate and encrypt shellcode,

00:00:08.430 --> 00:00:11.530
which allows you to also filter known bad characters

00:00:11.530 --> 00:00:13.370
to use directly in the same tool.

00:00:13.740 --> 00:00:17.910
If you're using Python as your main means of execution, check out Pyherion.

00:00:18.230 --> 00:00:21.810
This encryption implementation is heavily inspired by Hyperion

00:00:21.810 --> 00:00:25.470
PE‑encrypter by Null‑Security, hence the name similarities,

00:00:25.540 --> 00:00:29.520
which also looks at changing the obfuscation decryption stops by encrypting the

00:00:29.520 --> 00:00:33.060
whole payload with AES and a random single character key,

00:00:33.070 --> 00:00:36.750
which is brute forced on runtime for even more randomized end

00:00:36.750 --> 00:00:38.860
results generated by this amazing tool.

00:00:38.940 --> 00:00:42.530
If you're looking for more information on how to set up PyInstaller to

00:00:42.530 --> 00:00:46.310
disable the DEP opt in, take a look at the following link for a detailed

00:00:46.310 --> 00:00:48.670
explanation on how to recompile it for yourself.

00:00:48.680 --> 00:00:49.280
Lastly,

00:00:49.290 --> 00:00:51.810
I would like to give you some information on the techniques

00:00:51.810 --> 00:00:54.320
used by this tool to obfuscate the payloads.

00:00:54.410 --> 00:00:55.150
Lastly,

00:00:55.160 --> 00:00:59.060
I would like to give you some information about how to create your own payload.

00:00:59.440 --> 00:01:02.280
You can use this information to further improve your knowledge on

00:01:02.280 --> 00:01:05.330
how these tools function and make adjustments so your payloads are

00:01:05.330 --> 00:01:07.270
truly as unique as you are yourself.

00:01:07.840 --> 00:01:10.940
Thank you for watching Defense Evasion with Veil on Pluralsight, and I

00:01:10.940 --> 00:01:14.730
hope you join me and the other authors to learn about more tools to add

00:01:14.730 --> 00:01:16.660
to your red team arsenal in the future.