Now that we have our Metasplight frameworks introduction out of the way, we can
actually start looking at tools that separate the usage of Metasploit overall.
And the first one that we're going to be doing is MSF Venom.
And I haven't pulled up if I'm minimized that one real quick.
I have it pulled up here and I wanted to show you this real quick and just a
familiarization.
If you run the command and you see this right away, that means that the
database has been initialized or has loaded for the first time and that you're
ready for use.
The reason this is important is because if this is the first command that you
run inside of the Metasplight framework, it will take a minute to load
everything up just like we talked about in the overall MSF or a Metasplight
framework.
Same for MSF console.
Now, running this for the first time you see all this, this gives you basically
the straightforward help file for how everything needs to be flagged and
addressed inside MSF Venom.
But disregard that because we're going to walk through what it is and how we
use it.
Primarily throughout the course of pin 200 with our time together, we're going
to be using MSF Venom to create payloads to use as an ex inside of our exploit
to do reverse shells or some sort of communication to reach back to us from a
targeted system within the scope of our actual pen test.
MSF Venom is the portion of the Metasplight framework that separates that and
allows us to focus entirely on creating a package to be able to send to distant
target for use.
Now, one of the most common ones that we're going to be seeing and throughout
this course, not the only one, but most common is the reverse TCP, basically
the reverse shell.
And this allows us to be able to package up a exploit in whatever file format
that we so choose, send it to a target, have the target use it, and it opens up
a backdoor communication channel from them to us when we run MSF console.
We'll see an example of that here in the next portion of the skill.
In order to be able to do this, and I will have all the code for this right
below, it pretty straightforward, except I want to add that you need to run
with a pseudo in front of this, because that allows us to be able to go through
and make sure that all administrative permissions are utilized on this.
Now, what I'm doing is I'm filling in and I'm going to zoom in and show you
what's actually going on here.
Okay, and then once I do this, you can start to understand what it is we're
doing because I'm going to explain this bit by bit.
So, pseudo MSF venom, we're calling upon MSF venom to be able to create a
package for us with dash P be in our actual payload.
So, when we look for payloads, and I'll show you the search method here
momentarily, it's in a sub directory of actual payloads.
So, first we start off with windows, then inside of windows there's meter, and
I'm going to warn you, I'm probably mispronouncing that one.
And then inside of that folder is multiple options, and the one we're selecting
is reverse TCP.
Now, if you prefer UDP as your connection, there is a reverse UDP in there as
well too.
The next portion of this is is filling in all the variables for the actual
payload and exploit that we're putting together.
Now, you may be wondering, how do we know all of these different commandments?
Well, you can actually go through and show an actual help file, or I will show
you another method here momentarily.
But this one only uses four variables, and that is the L host, which is the
local host, which is the machine that we're going to be using this off of.
The local port, the port of communication that we're going to be opening for
our returned communication back to us, dash F being the actual file type,
and in this case, I said exe for executable and dash O for the actual output of
said file.
The one I want to point out first and foremost is the dash O for output.
Notice right above where it says Windows, you see tilde slash desktop.
That is our present working directory inside of the user profile that this
terminal is opened under.
So if you say output bad.exe and don't have any other file extensions for
directory browsing in there, bad.exe is going to be created on the desktop or
the present working directory that you're in, according to the actual terminal
session.
So if you want it to go somewhere else, you'll need to put in the full file
path in for that inside of that portion right there.
That being said, different payloads have different options and the easiest
command to be able to use inside of MSF venom to search as the dash L space
payloads.
And what this does is it searches through all the different payloads.
Now this right here is going to list all the actual payloads for us.
And if we remember inside the Metasploit framework overall console that we had
a lot of different options, nearly 3000 if I remember correctly.
So if we did just a regular dash L payloads, there's going to be a lot of
results.
So for instance, I'm just going to hit enter real quick and type in my pseudo
password.
And as it's compiling everything and you have a fair entity inside of Kelly,
you know, it's about to come up with a huge list like it just did.
It's going to list them one by one and go into every single one of them.
Now, you could search through this manually or might I recommend just going
through and doing a pipe with a grip.
And then following the grip, you can actually pick out ones that match the
search criteria that you're looking for.
For instance, if I wanted to look for any payload that involves windows.
It's now going to put me out a list of all payloads, but filtering for windows
as you can see in red.
And it even gives you a little bit more information concerning that in a bit
more represented or makes it easier for us to be able to see.
And so if I zoom in for this real quick, you can see that one of the ones that
we have is a.
The windows slash x 64 slash shell shell slash bind IPV six TCP UUID.
It's a spawn and it's a piped command shell for windows 64 bit that listens to
IPV six connections with UUID support.
That's relatively reasonable.
So the next portion is is like depending on what payload, what exactly do we
need for the options inside of that particular payload.
See, I showed you the one originally at the beginning and I knew after much use
with it in the past, what options were required of it.
So I'm going to select that one that we just talked about, copy that because I
don't want to type all that again.
Hit up and I'm going to replace the dash all with a dash P and then paste in
that actual payload that we selected.
Now at this point, I'm going to type dash dash list dash options and I'll have
this in the code box below as well to.
And when I press enter, it's going to think about it for a second, but now it's
going to show us as I scroll up and show us get ready to zoom in.
Right here.
You can see that the options of this particular payload are being described to
us and what it needs.
So it gives us the actual name itself, the size of it, which is actually good
if you're trying to be discreet in terms of size of packets on the actual
network.
And then the more you scroll down, the more you get the actual basic options of
the requirements.
So let me zoom in right there.
So exit function, what type of exit function is it going to need this one
actually requires that is it going to be an actual process.
A thread or S E H or not.
What listening port and what remote host is it going to be on? And you can see
that they're required or not required.
Now there are other things that you can do inside a different payloads
depending on which ones they are.
The more payloads you explore along with the options and you can see that there
are many advanced options here.
The more you start to understand that certain options are required, certain
ones aren't, which ones are better for your actual pen testing and which ones
aren't.
So it's really just a use over time and gain that experience along with
matching to the vulnerability that you're trying to penetrate.
Now I do want to point out before we move on to the next portion of the skill,
it'll be relevant through the rest of this skill overall.
Tapping is allowed.
And so that cuts down time a whole lot and makes things a heck of a lot easier
for folks like me who are terrible at typing and spelling.