Welcome back.
Let's get back to our Paillot creation.
So in the previous video, we saw how we can create a simple Trojan using NSF.
Wynnum for you, the basic options where we only set local host and local port.
Now let's check out some other options that we have available.
If I go and open up my terminal and run the command MSF, why not Dash H.
We will get our help menu and the purpose of all of these other options that we can see right here will
usually be to either bypass an antivirus or to make your pay a lot smaller in size or something similar
to that.
Basically, it is used for creating a payload for your own needs.
For example, in the previous video, we created the payload that was a windows Metropia.
But there Shell as in the file.
But we can create other file types if we want to check out what other file types can recreate.
We can run the command MSF one on dash dash list formats.
And it tells us that right here under the dash of command, we can use that Ashlee's format to list
all of the available formats.
So let's do that real quick dash dash list and then formants.
This will take a few seconds to execute and this will be really useful.
Why?
Well, imagine you were sending a payload to a Linux machine and the file wouldn't be much useful then,
right?
However, a Python file could be of use in that case.
Well, MSF allows us to create any file type that we want.
So let's check out all of the available file types.
So up here, we can see if we can create a spe, e, c, some other file types as well.
We can go down here.
We can see different programming languages such as C, C, sharp, we can create in Perl, in power
Shell, in Python.
We can also do Ruby s h and many other file formats if we want.
And what I also want to show you besides this is different options that are also useful, whether it
is for bypassing antivirus or changing the size of your payload.
Let us check them out.
So let's create a couple of payloads right now and compare them.
Let me clear the screen first.
And to compare them, we're going to use a site called Virus Total.
And to do that and to visit the site, we must open the Firefox and what viruses total is, is a website
where you upload your viruses and they will tell you how many antivirus vendors are able to detect it
as a malicious program.
So if I open fire, it's total by typing words total right here.
Go to the first link, which is this one was dot com, and one thing to keep in mind is that every file
you upload to this website is sent to the antivirus vendors.
So something that might be undetectable today after uploading it to this website, it will for sure
become detectable in a few days or a week.
Are there other websites that don't send your files to antivirus vendors?
Yes, but they are not as good as far as total.
And we already know that undetectable virus is a game of cat and mouse to date.
It's undetectable tomorrow it isn't.
So this isn't really something to worry about right now.
Let's create two payloads real fast.
So the first one that we are going to create is going to be the one from the previous video.
So let's do it real fast.
We already know how to do that.
It will be a 64 bit payload interpretor reverse DCP.
Our host will be equal to the IP address.
So let's check it out real quick.
That one to 12, and if I specify it right here, outport can be five five five five.
It doesn't really matter.
The format will be ACCE and the output.
We can save it as shell one that the XY.
And as soon as this finishes, we are going to upload this payload to the virus total to see how many
antivirus is detected as a malicious program, so it has finished.
Let us go to the virus website, click and choose a file, navigate to the desktop directory and select
Shelbourne that I will double click it.
I will confirm the upload and it will upload this channel for me.
Now, this scan will take a minute or two.
So while that is doing, what we can do is we can create our second payload and to create the second
payload, we're going to use some additional options.
So I'll clear the screen right here and I will type a massive one on Dash H right here.
So we have the help menu available.
Then I will go right here and run the command NSF.
We will use the same payload, which is Windows 64 interpretor slash reverse DCP.
We will select the localhost wanted to do the 2068 fund, the 12 local port will be five five five five.
After this, we can use the dash, a option to select the payload architecture.
As we can see right here, there's a stands for the architecture to use for the payload.
So let's go and select X 64, because in my case, I'm attacking of Windows 10 64 bit machine.
If your Windows machine is 32 bit, you can proceed with x 86, OK?
The next thing that we are going to use is a very interesting thing and that is an encoder.
And what is an encoder?
Well, let's go right here and find Dashi option, which says right here the encoder.
And what we need to specify after it is the encoder that we want to use and can help us bypass some
of the anti viruses to list all of the encoders that we have.
We can use that at least encoders.
So let's do that first.
So MSF, when I'm.
That's that list and then encoders.
And here they are, we get a bunch of encoders, four x eight, six or four, 32 bit architecture,
we get some 40 x sixty four or 64 bit architecture, and we get some other encoders up here as well.
Now, the ones that we're interested in at the moment are these X sixty four ones.
So we're going to go with this one X 64.
Suto underscored the Chihiro so let's go Pete's name.
Right here and pasted after the Dash eight.
Now, if we go back to the help menu and go back to the encoder, another option that is closely linked
to the encoder is this Dash I option, and it is the amount of iterations, as it says in the description.
This is the number of times to encode the payload.
So if I go right here after selecting the encoder, we want to select Dash.
I specified the number of iterations that we want to encode our payload.
Now, the more iterations, the bigger the payload will be in size.
But it also might mean that it will be less detectable to the antivirus vendors.
So let's specify Dashi and then let's perform 15 iterations, for example, after it, we're going to
specify the platform on which the payload will run, which is Windows and Astrid.
We are going to use the dash and option and select five hundred now to see what this dash and option
is.
We can go right here and in the dash and we can see it is not slight.
It will prevent another set of lenses onto the payload.
Remember what a knob is.
A knob is an obstruction for the processor to not do anything.
And here we are simply just telling how many knobs we want to add to our payload.
Once we select a bunch of these options, we can add at the end dash F to be a nixey and dash o to be
shelp to that.
So this is our second shell.
Let's run it and wait for Mr. Farnham to create our payload.
And while it is creating the payload, let's go to the various total and see how many detections we
got with the regular Mehtar potential.
So of sixty eight antivirus 43 detected this as a malicious program and here we can see which ones detected
it as a malicious program and which ones didn't.
Hmmm, let's see what if we get any better result using the second shell so we can see right here,
it has been created successfully, add a number of sites.
Five hundred from X, sixty four.
Simple.
The final size of the file is eight thousand bytes.
So let's go to our total and remember this number forty three out of 68 and let's see whether we can
at least bypass a little bit more antivirus.
Then from this first scan let's select the at the confirm the upload.
Now, while this is happening, let me tell you something real quick with the MSF options, don't expect
to get much better results once applying some additional options or something like that.
As I already mentioned, the MSF is a really known tool and everyone use these options to generate payloads.
So they are very well known to all the antivirus vendors.
Here we can see our second shell is scanning and let's see whether we get a lower number than forty
three.