Our challenge was pretty straightforward.
We're going to be creating a fake DLL using MSF Venom
and then working our way to injecting it
inside of a legitimate and running process
in our target system.
So we start out by doing what's in the code box above this video
and that is MSF Venom and however you decide to craft this fake DLL.
In this particular case, I'm using the 64-bit version of this
because I know that I'm dealing with 64-bit systems
due to my reconnaissance so far inside of this skill and course.
I'm going to be pointing it back to this Kali box for us
to be able to exploit once this is created.
And then once I go ahead and execute this
and input my pseudo password, you'll see that on the desktop,
there we go, fake DLL has been created.
And now we need to be able to get it over to the other system.
Now, I've given you code to be able to simply move it over
to a share folder that I have between the Kali box here
in the lab and also the host VM environment overall.
Realistically, we would use directory traversal,
our file inclusion, attacks to be able to get the DLL over
to the distant system and be able to remote in and execute
the commandlet that we need to do to inject it.
We're going to be bypassing that since that isn't really
the focus here and I'm going to minimize this command window here.
And you can see that I have pseudo copy fake DLL over to the
mount windows directory that I have created.
And once I go ahead and run that, I can pop on over to the host
VM itself inside of the actual share folder
and you can see that it did not create.
You may need to reestablish the mount.
And if that's the case, you'll need to be putting in the password
that you get from the actual a depth lab.
I'm going to show you what I'm talking about here for a second.
I'm going to move it over here momentarily.
And you could see, there we go, I can see it now.
I'm going to zoom in for you right here.
It's the password that's directly above me.
I know that's a long string of text and you'll have to hand
jam it.
But this is how you put in the password for the actual mount
to create between Cali and the actual host VM itself.
And once that password has been entered, you can see that the--
it just gives us the next prompt.
You can also see where I messed up the password
in a previous attempt.
And then I just go up and try to copy it over again.
And now, if I go back over to my host VM,
you can see that fake DLL is, in fact, there.
So moving over to my PowerShell window,
I'm going to go ahead and fire up the DLL-injector.
Going to be using fake DLL to do this.
And now I'm going to pick a process ID.
You can see that I still have notepad open, or do I.
We'll be addressing this momentarily.
But inside of my task manager, you
can see that I have two instances of notepad running.
If I zoom in for us here, you can
see that the original one that we did earlier in the skill
was 5392, we're going to be attacking 5364.
Now, I'm going to go ahead and just type it in there.
But before I do, I need to go back over to my Cali box
and make sure that my listener is going in MSF console.
So we're going to go ahead and fire up MSF console.
And then this may take a second, depending on if this
is the first or not first time that you're actually
starting it up.
And that once you have all your parameters put in,
a good practice is to do a show options.
Not only does this verify our information that's
been put in, but it will also let us
know if we have any other parameters that we need to fulfill
before we could actually run this by using exploit.
Now, for instance, this one only
has two parameters that we need to three, really,
that we need to fill in.
And that's the payload, the local host, and the local port.
And all three of those have been addressed.
And if there were more, it would let us
know here in the show options if it was optional
or if it was required in what we would actually
need to be able to fill that in.
So now I'm just going to go ahead and type in exploit
to start my listener up.
And I'm going to go back over to my Windows system
and inject fake DLL in process 5364.
Go ahead and press Enter on that.
And you can see that the memory has been allocated.
And walk over to my CaliBox.
This may take a second, but we will get a payload to open up
and be able to reverse shell into it.
So to just love it when the VM just randomly shuts down.
Now we're inside of our actual reverse shell here.
And we can see that we have everything open and running
for our actual solution here.
So we were able to start from beginning to end,
create the MSF Venom file, send it over to the remote system,
inject that DLL into a running process,
and see that we were able to connect through our handler
over to the remote system using a process ID
to mask our true intention of what's actually going on.