Now, in the solution for this challenge,
you may have created the file in MSF Venom,
then encrypted it using OpenSSL
and send it over to the target system,
which is absolutely fine.
But I wanted to use the solution
to also expand on a little bit of more learning
to combine everything that we've done
inside the skill thus far.
So inside of our lab here and codes below in the code box,
I have MSF Venom pulled up
for our command prompt inside a terminal.
And you'll notice that my MSF Venom
has a new syntax addition to it.
And that is encrypt and encrypt key.
So I'm encrypting the contents of the actual file
that I'm creating and not the actual file overall.
What this does is it takes everything inside the payload
and encrypts it in such a way
to where it cannot be detected
through normal inspection means.
So it would have to have the decryption key
and the deep packet inspection system would
to be able to go inside and see
this is something created by MSF Venom.
And don't you worry, we're gonna prove that.
So what we're doing is creating an MSI
called installer.msi that's encrypted with AES-256.
Now let's go ahead and run this real quick.
And we can see that the file will create through MSF Venom.
While at the same time, I'm going to open up MSF console
and run exploit because I already have
the listener configured and ready to go.
So now we're starting up a TCP handler on the Kali box.
We're gonna go and transfer that file,
the installer that we just made
and copy it over to our targeted system.
And after doing so, you can see that it just copied here,
installer.msi.
I wanna go and get the actual hash on this real quick
before I go ahead and run it.
So inside of PowerShell, again, codes below,
you can see up there that I'm going to be doing
a get file hash and path to the actual installer.msi.
What this will do is give me the hash for the actual MSI file
and we can see that in SHA-256, it is,
which is the default method for get file hash in PowerShell.
It is blah, blah, blah, blah.
And we're gonna copy that and go on over to virus total.
I'm going to paste that hash up in the search box
and then I'm gonna press enter.
And you can see here that no results came up.
And this is because the actual payload of that MSI file
that we created inside of MSF Venom is encrypted
and therefore cannot be inspected properly.
By those inspection devices out there.
So nobody's turned this hash in yet
to say that it is malicious.
Now, if I go back over to my Windows system here
and I'm gonna open up the details tab
so you can see that it runs.
I'm gonna double click installer.msi.
You'll see that there's a problem with the MSI file
that for whatever reason, it just can't install, right?
But if I pop on over back to my Kelly box,
you can see that after I ran that file,
there's a session that opened up an MSF console.
Wouldn't you know it, I was able to transfer that file
after creation with MSF Venom
and put it over on a targeted system.
And I know it works because I can do a DIR
and get things sent back to me,
but the connection is open
and therefore we do have a protected connection
between us and them.
There's the directory listing
of them being the target system.
And now, does this mean
that the connection itself is encrypted?
No, it just means that the payload
in the file that we created to send to the targeted system
is encrypted and therefore is able
to evade certain inspection tactics.
So it's important for us to understand
what the packet inspection is,
its purpose in network and system security,
and for us to be able to evade it as pentesters
because there's many reasons why we would want to do this,
but at the same time, many reasons why we would want
to reinforce the understanding of what is being inspected
under that inspection method,
and to make sure that the organization
isn't wasting their time looking for something
that may or may not be or is incorrectly configured
because we have to have that balance
between inspection, security, and availability.
If we inspect too much,
we lower our availability probability.
If we increase our availability up to 100%
and some more, then we're lowering our percentage
of success with the ability to catch malicious things
before they happen.
Just some things to consider,
but also as a pentester to take advantage of.
I hope this has been informative for you,
and I'd like to thank you for viewing.