Earlier in our example, we said we were going to send a file from point A to point B,
and we captured it by using DeepPak Inspection in Wireshark. The file that we sent was HashChallenge.
It's here on the desktop. I have it highlighted. I'm going to right-click on it and go into
edit with Notepad++ because I want to see the contents of it. As you can see,
if you're familiar with the previous skills in this course, that is in fact the proper contents
of that HashChallenge file. It's plain text for us to see. No problems whatsoever.
Well, as a pentester, how to evade DeepPak Inspection needs to be considered up at the top
because if we are intending on actually successfully pentesting a network, we need
to be able to evade some of these things. One surefire method to be able to get through it
is DeepPak Inspection evasion through encryption. I know a lot of words there. Bear with me.
Inside of Kali, yes, you again. First, we're going to be creating a MSF Venom file for an
MSI. The reason I'm picking MSI is because it's Windows-based. Inside of MSF Venom,
I'm going to have all the commands below to create this for the actual code box.
We're going to create it on the actual system itself and have it on the desktop.
Once that file is created, we have a couple of options here. We can either send it straight over
to the actual targeted system, which is the host VM overall, or we can encrypt it and send it over.
Well, let's send it over in plain text first. First thing we need to do is go into sudo.
After I get back in terminal, sudo copy. Then we're going to say this time, inspection MSI
and copy it over to mount Windows. Now, I have that opened here. I'm going to zoom in to show
you. It's right there on the left to show you that there's nothing up my sleeve. Then press
enter. You can see that that copied over just like that. Inside of Wireshark, we can see that there
was a lot of SMB traffic. We can do the same thing by going to file, export objects, go into SMB,
and see that inspection.msi has come up. Now, this is plain text because I can sit here and save
to the desktop. One thing I do want to point out, though, is that it saves it as a general file,
not really with the MSI extension on it. Just keep that in mind as well, too.
I saved it to the desktop. Oh, would you look at that? It saved it as MSI,
a runnable program. That's because file extensions and all that. As you notice,
it went through just like that. I can even right click on it and see that there is an installer.
This is expected because it's MSF Venom program. If I had my listener in MSF console opened up,
we would have connected. How to evade, you say, because this Wireshark capture,
us being the IDS or IPS in this particular case, have caught it. Endpoint security will catch it
as well, too. You've seen that in previous skills where I've had to turn off the endpoint security
to get around being able to move these files back and forth across these different VMs.
Well, I'm glad you asked all those questions. Now, to get around the ability for people to see
plainly what's inside of each and every packet, we can use encryption. We're going to be using
a tool that's inside of most POSIX-based operating systems, OpenSSL. We're going to
basically take inspection.msi, convert it to AES250 or encrypt it with AES256 into an output
file. Inspection.msi will still exist. We're going to create a new inspection.aes to be able to send
across the wire to see if people can see the contents of it like we did a while ago. Can we?
Yes, we can. The command, which will be in the code box below, once we enter it, will ask for
an encryption password. Password is going to be it. Therefore, you just saw on the desktop of Kali
I have highlighted for us and zoomed in on, inspection.aes was created and now is encrypted.
Now, I can go through and have Wireshark open and I'm going to run it.
There we go. Go back to my Kali box. This time, I'm going to copy
inspection.aes over to mount windows.
When I do that, you can see we have the exact same thing come up because we're able to see
all the packets, all the to and from, and all the information there within,
except when we start getting into the inspection.aes. Let me stop that capture real quick.
Go into file, export objects, SMB. Right there is the actual file itself,
but instead of being able to run it like we were before and see the contents inside like we did
with Hash Challenge, this is encrypted. Any further efforts to see what's inside of that
file are going to be hindered by the fact that usually the inspector or inspecting device does
not know the password to open that up. We can still save that file to the desktop, which I am
doing so right now. Once we go and take a look at it on the desktop right there, what do we do with
it? If we don't know the way to decrypt it or actually take a look at it any further, then
deep packet inspection kind of comes to a grinding halt. We can either A, deny the traffic based on
the fact that it's encrypted, or B, force people to come in and give us their encryption keys to
be able to go through and take a deeper look at it even further, which does happen on DoD side
sometimes. Now before I close this out, I have installed OpenSSL on the actual Windows host VM,
and I will have the link for that below in case you want to do this at home,
because it's not native to Windows environment. What we're doing now in code below is decrypting
the actual file itself. I'm going to make sure that there's no MSI file on the desktop. I'm going
to delete that real quick. You can see here that what I'm doing is taking that inspection.aes and
converting it to inspection.msi. Now before I do so, notice that inside of my command prompt here
for OpenSSL, I said inspection.aes. You'll have to make it match that file name, so either change
the file name or change it inside of your command line. What I'm going to do here is change it and
remove that parentheses, or excuse me, %5c and change it to inspection.aes. When I run this
command, it'll ask for the actual decryption password for the AES that we did on the Cali
side. If we remember, that's password. Where did it go? It went into the share folder, of course.
So there it is right there. Now we have the same MSI file that we had earlier,
except it was decrypted on the actual user's end.