WEBVTT

00:00:01.740 --> 00:00:02.730
In this module,

00:00:03.060 --> 00:00:07.460
we went through what this tool is about and what it is capable of.

00:00:08.540 --> 00:00:13.260
We went through techniques associated with this tool. We

00:00:13.260 --> 00:00:16.700
then downloaded the tool from GitHub and extracted the

00:00:16.700 --> 00:00:22.260
contents to an executable path, which was the C:\Python36 folder.

00:00:23.340 --> 00:00:26.870
Remember, if you want to extract the tool to a different path,

00:00:27.110 --> 00:00:30.150
you will need to add that path to the systems variable.

00:00:31.840 --> 00:00:35.410
We then went through the Python and PowerShell scripts that make up this

00:00:35.410 --> 00:00:41.950
tool. We saw blocks of code that get executed when we select a specific

00:00:41.950 --> 00:00:47.750
option in the tool. We then saw how to configure a sender and receiver's

00:00:47.750 --> 00:00:51.260
email address in the Mail.ps1 PowerShell script.

00:00:52.740 --> 00:00:58.290
Next, we configured the allow less secure apps setting in Gmail to allow

00:00:58.290 --> 00:01:02.460
PowerShell to leverage Gmail's SMTP server to send emails.

00:01:03.440 --> 00:01:08.570
Lastly, we demonstrated tool execution and saw what elections the tool

00:01:08.570 --> 00:01:14.120
performs in the back end and how the tool back door uses this activity by

00:01:14.120 --> 00:01:16.860
silently sending screenshots to the attacker.