Okay now that we have vild loaded you can see it show us the main commands that you can use with well.
So the first command is you can do exit to exit.
You can do info to get information about specific to.
You can do list to list the available tools you can do update to update.
And this is very very important because you always want to be up to date when it comes to bypass antivirus
programs.
And then you can do use to use a tool.
Now let's start using evasion.
And as we do it it's going to become so easy and you'll be able to understand this more now.
Will has two main tools.
And if we do list you'll be able to see them.
So we have the first one which is the one that we're interested in which is called evasion and that's
the one that generates undetectible backorders for us.
And then there's the second one which is called ordnance and this tool generates the payloads that's
used by evasion so you can look at this as a helper or a secondary tool.
Now what I mean by a payload is a payload is the part of the code of the back door that does the stuff
that we want that does the evil stuff.
If you say so is the part of the code that give us a reverse connection.
It's the part of the code that download and execute something on the target computer.
It's part of the code that allows us to achieve what we want by executing that file.
And this is going to become more clear as we start using Bill now for now we're interested in to use
in evasion.
So we're going to do use one because that's the first tool that's number one.
And as you can see we have a version loaded now.
And as I said before this used to be a standalone tool that you just download it on its own but now
they have it all combined together.
Now as you can see the first thing that we get when we load the television is the commands that you
can run on this too.
So the first thing that we want to do is we want to list to see all the available payloads.
And as you can see we have 41 different payloads and all of these payloads follow a certain naming pattern
and you can see for example let's take this example right here because that's the payload that I'm going
to be using.
You can see the payload is divided into three parts.
The first part right here refers to the programming language that the payload is going to be wrapped
in.
So we have the evil code and then the evil code is going to be wrapped into a certain programming language
that the target computer understands.
And right here you can see that this payload uses Go programming language.
We can see this one uses See we can see these ones you see as we have python we have power shell and
we have Rubie if we scroll down the second part of the payload is really important.
This is the type of the payload the type of the code that's going to be executed on the target's computer.
In this example we're using Mattel Peter which is a payload designed by meatiest Lloyd meter's Floyd
is a huge framework for hackin and it allows you to do a lot of things.
But in this lecture we're focusing on creating a payload called interpolator.
And what's really cool about Mr. Patel is it runs into memory and it allows us to migrate between system
processes so we can have the payload or the back door running from a normal process like Explorer for
example.
And this payload will allow us to gain full control over the target computer.
So we'll be able to navigate through the file system download upload files turn on the mike turn on
the webcam even use that computer to hack other computers install a key log or you can literally do
anything you can think of.
And all of this will be running from the memory from a normal process on the system.
So it's very hard to detect.
And it doesn't leave a lot of footprints.
That's why it's a really really cool payload and we'll be using it a lot.
The third part of the name is the method that's going to be used to establish that connection.
So in here we can see that this is called Drive Hastey CPS.
So register stands for reverse and hasty T.P. as is the protocol that's going to be used to establish
the connection so we can see that this payload will create or reverse hasty CPS connection.
You can see this one right here for example it creates a reverse ETP connection and we have this one
in here that creates a reverse TCAP connection.
Now what I mean by reverse is the connection is going to come from the target computer to my own computer.
So I want to be connected to the computer that I want to hike.
What's going to happen is once the person double clicks the back door the back door will connect back
to me from the target computer.
What's cool about this is I'll be able to bypass antivirus programs because the connection is not going
to the target computer is coming back to my computer.
So it's literally as if the target person is just connecting to a normal website.
I'm going to use aport that sites use which is 80 or 88.
So again if the person analyzes the connection it will look as if they're literally just connecting
to a normal web.
Also if the target's computer is hidden behind a router or behind a network.
Again this is going to work because the connection is coming from the target computer to me instead
of me connecting to the target computer.
So using a reverse connection is really really handy.
And I think this is really the only practical way of gaining access to a computer because there is a
lot of things that can stop you from connecting to a certain computer.
Now this is the general naming pattern.
You'll see some payloads like this one right here which doesn't follow that general naming pattern.
And basically what these payloads do for example we can see this one is called shellcode inject.
So what is going to do is it's going to create a payload that injects your other payload.
So it's going to create a normal payload and that normal payload injects interpretor payload for example.
Now what does this to try to bypass more security.
But usually they want bypass more things than the normal payloads would bypass.
So that's why I usually just use one of the normal payloads in here.
So this is it.
This is all about the payloads.
So I took a bit of time but I wanted to make sure that you guys understand the naming pattern.
I wanted you to understand what a payload is and the difference between a reverse and a bind and a TCAP
payload.
This way the rest of the cars will become more clear to you and I can just use the payload that I want
without explaining what it is.
Now in the next picture we're going to be generating a payload and we'll be testing it against antivirus
programs.