Straight into the point, we were asking if we can make a DLL using MSF venom
inside of our
CaliBox. Get it over to our windows however that may be for you and execute it
inside of windows.
Now I've already run pseudo MSF venom inside of my CaliBox here and I'm up to
where it's asking me
if I want to use an exploit. And as you can see here, I have use exploit multi
handler.
That was our first command and all these commands are up further in the skill
because we just
want to reinforce what it is that we're actually doing. Now that handler is the
one that we're using
and you can specifically set the payload for it because now the next part is
what payload do you
want to use and we will be covering multiple or a lot of the different payloads
in future skills
for Metasploit in particular. We're going to be using the payload of reverse
TCP for beta pre
regularize this is up to you in that login. So I'm going to go ahead and set by
L port L host
at L port. And again, these are set up based on the IPs inside of your lab. So
you shouldn't have
too much of an issue with that. And then we'll just simply go with exploit for
that actual listener.
Now I kind of did this backwards. But as I said, shooters preference, right? I
'm actually going
to open up another terminal here and that opens up the listener. Now we need to
go in and create
the actual excuse me, the DLL file for that. And we're going to simply go with
MSF venom.
So doing this in reverse and now I'm creating the actual DLL itself, I've gone
in and said
Windows X 64 meter preeter reverse TCP, I've set all the commands and I made
sure that the file type
was DLL and I've named this one evil two dot DLL as well. So I'm going to go
ahead and execute that.
Go ahead and pop back in and pseudo password execute that. And you can see down
on the bottom
left, it'll create the evil two dot DLL. Now I'll copy that over to my folder
on the desktop
inside of Windows here because I have that shared mount right there. So I'll
say pseudo copy evil
two dot DLL to slash mount Windows. And once I do that, I could go over to my
desktop
inside the actual share itself and see that evil two has been placed there. I'm
trying to zoom in
for you right there evil two dot DLL. All I need to do now is just run it from
the window system
for my listener to be able to capture it. Pull my listener up on top first and
I'm going to go into
command prompt. And as you can see in the command prompt here, I'm actually
leaving it in that folder
and executing it from there. So the full command line is, as I have to tell it
where run DLL 32 is,
along with where the evil two dot DLL is. And as you can see, instead of entry
point, I'm using
comma MSF venom, basically just put in my own placeholder there. So that way,
if there ever is a
memory inspection of this particular system, that they can go in and find it.
And this will
stick out to them. So I'm going to go ahead and run that once I've popped back
in there real quick.
And inside of our console for MSF console, you can see that it's starting to
send sending stage
and open it up that listener to the Kali host and zoom in. I'll show you it's
running a little slow,
but you can see that it has started reverse TCP handler 53 and then sending
stage to zero dot one.
Now there's something I want to point out about this real quick before we close
everything out.
You may notice I didn't run command prompt on here as administrator. And just
so you know,
there's nothing that must leave it finally did load. But now I'm able to go in
say present working
directory and you see that it's in C drive users learner here. But this ran
under regular user
permissions, even though I'm logged in as an administrator, but I didn't have
to run command
prompt any kind of special, which means that if you've been going back into the
previous skills and
using that directory traversal and file file intrusion inclusion techniques
that we've been
practicing, this should come pretty easy to you in some of those other
instances, making it easier
as we continue on to know that there are different ways to skin that rock. This
is just scratching the
surface of DLL manipulation. We're going to be diving a little bit more in
depth and in far
beyond the reason into the dirt for DLL injection in our next skill. I hope
this has been informative
for you and I'd like to thank you for viewing.