Now the challenge we were testing your knowledge of Metasploit payload tactics
and leaving it to
you to choose your own adventure into the tactic that you wanted to do to get
the target system
to be able to communicate back to you. Now I have a preferred method that I
like to use and
there's a few reasons for it as we'll discuss a long way. But as you can see up
there on the screen
and I'm going to zoom in for you. What I did was is I used MSF Venom to create
a reverse TCP payload
with all the parameters of LO, Lhost, and Lport and I did it in DLL format
and exported it as dummy.dll which you could see on the bottom left dummy.dll.
I then, as you can see in the command above, copied it over to dummy or copied
dummy DLL over
to my mount windows which goes to that shared folder on the desktop. Now I do
want to explain
this real quick because up to this point we've just been copying it over to the
host, Willy Nilly
and executing it from the host to demonstrate what it does. In the real world
it's up to you,
the adventurer, to figure out how you're going to get dummy.dll executed on
that particular system
or some sort of exe or macro or whatever the case may be. And this is where
exploitation comes
into play at in form for me for social engineering. dummy. if I let's say I did
it as a exe or a macro,
I can send it through email, I can put it on a USB thumbstick, I can put it on
an SD card,
many different objects here. I can even embed it inside of a PNG or whatever
the case may be
with code injection. And it's through social engineering that we're able to get
the user
to be able to open that file up thinking that it is a legitimate file and safe
to be able to use
because one thing you may have noticed in the skill, no security alerts ever
popped up on that
host VM window system indicating it might be a good or a bad file. Now in
previous skills,
we take those files and run them against virus totals to see if there's
anything malicious inside
of it to help virus total continued building the database out and using that
same database to test
the breakdown of our file that we're making to see if it pops hot. And we've
seen we're doing
this right here does pop up in virus total and should trigger some sort of
response
if the host system has an endpoint detection system installed like semantic or
mackerel.
But it doesn't and we're using the basic windows security. Now we've lightened
the security on this
particular window system as you've seen in previous skills as well. And that's
in part to why
the security alerts didn't pop up. But in past, you've seen where we had to go
through and fix some
of that. Now, the more effort you put in into obfuscation of the actual code
within the file
itself plays into that social engineering of making the user think it's a
legitimate file.
So for all intensive purposes, we're essentially skipping the step and going
elbow to hand
on how to take a file that we've created in our stages section that I'm doing
and getting the
user to do it. And this is why it's two part and not in line in this particular
solution. So just
keep that in mind. And as we continue to go throughout the course, you'll start
to see how we get these
files or other methods of attack on those target systems as we go through and
try to
get the user to in some form, execute that to be able to connect back to us.
And speaking of
connecting back to us, if you go and into the actual host system, I did this
through run DLL
32 EXE with the WDL file. And again, this is a spooler for a couple of skills
that are coming up
later on to be able to create DLLs like this. So be patient. It's coming, I
promise.
Now, once that DLL was ran, you can see as I alt tab over, excuse me, right
there, that the
session did connect using that particular exploit. And I already have the MSF
console, sorry for the
starter there, configured to be able to do this. And I can simply go into show
options and see
that all the stuff for our payload listener has already been configured, which
is why when I
ran exploit for the actual kind of run for that, that it went ahead and
connected. Now, I went with
the stages and a singles, you can very well do this with inline and stages. So
just keep that in mind
that when you're dealing with MSF venom, MSF console, mid-display this whole,
we actually have to
incorporate tactics on how we're going to develop that exploit to maybe it's
leveraging against
the vulnerability. But we also have to consider how we get the actual end user
to be able to execute
some of those things that we create to do what it is we need them to do.
Because if we send a file
and they actually do what they're supposed to do and call the CISO or whoever
the security manager is,
we're going to have to wait a little bit longer before we can get access to the
system using this
methodology. Now there are other ways to get in the system, we'll talk about
those later and
upcoming skills. But I hope this has been informative for you. We'd like to
thank you for viewing.