Welcome back.
And right now, we are going to check out another tool that is used for generating payloads, and that
tool is called Wael.
Since it is not installed in clinics by default, we must install it first.
To do that, you can open up your terminal, enter the account by typing in your password after the
pseudo as you and then after it you want to type the command app, get installed.
Well.
Now, since I already have well installed, this will not do anything for me, but for you, it should
start the process of installing well, and that process might take some time.
However, running this command is only the first part.
After this installation finishes, you can clear the screen and type well inside of your terminal.
This will, for me, open up the world program, but for you it will continue the process of installation.
So Will has a bunch of dependencies and once you run the app, get installed well and after it you run
the real program for the first time.
It will ask you to install those dependencies.
You want to click there?
Yes.
And that process will also take some time.
It will also have a bunch of pop up windows right here where you want to click on next, next, next,
next on each one.
You don't want to change any of those settings.
And after all the installation has finished, you should have well up and running.
OK, great.
After get well up and running, we can see right here that we get two available tools.
The first one is vision and the second one is audit.
And what is this?
Simply a program that will allow us to generate payloads similar to the MSF one.
So let's give it a try.
If I type, use one and you will notice that the comments are similar to the MSF council.
So to use one of these options, you can just simply just use one or use two.
And since I selected use evasion, as we can see, no one is Survation.
It will tell me forty one payload loaded and these are our available comments.
So we can read information, we can list the payloads, we can use some payload.
So let us list our payload first.
And here we can see those 41 Paillot, some of them are coated in Ruby, some of them are coated in
Python.
We have partial payloads, Purlie go six C sharp C payloads and we get some auxiliary modules as well.
Now, the regular payload that we used in the Furnham would most likely be this same interpretor reverse
DCP up.
Why?
It is pretty much the same thing.
But since we already covered something similar to this inside of the NSF, let us go with a different
payload this time.
So let's go with the power shuttle payload.
Let's select payload number twenty two, which is Power Shield Interpretor Reverse DCP so we can just
use 22.
And after you select the payload, it will give you all of the available options that you can set for
that payload before you generate it and created.
Here we can see the main hostname, our host local port, browser's mean, processor's mean, ram processers
Sleepytime and these options you can use and change as you like.
Some of them might actually help you bypass some of the anti viruses, such as, for example, this
sleep option right here, sleep this amount of seconds.
So whatever we set right here, that amount of seconds, our payload will sleep after execution before
establishing the connection with our listener.
So let's set that right away.
Let's set sleep to be 20 seconds.
What does this mean once again?
Well, once the target executes, our program program will sleep for 20 seconds.
It will not do anything.
And then after 20 seconds, it will establish the connection with our listener.
Another thing that we must set is the localhost, and for that we must know our IP address and it is
not one that 12 go right here, typeset outpost 182, that 168 dot one the 12th.
And if I type generate, as we can see by the available commands right here to generate the payload,
we simply type generate press enter.
Please enter the base name for the output files and let's call it our payload.
Meaning a powerful political power click here, enter, and the payload has been created, we can see
right here language powerful payload module is the one that we selected.
Source code is written to this path right here.
And we will notice that it is written inside of the dot that file and metastable it resource file written
to this location right here.
And the two things that we are interested in are these two things, the metals resource file and the
source code.
Now, this source code, which is not bad, is something that we want to convert to now, even though
on Windows Systems that bad file is Runnable, but this will get triggered by any antivirus program
out there, since it is just a basic code that executes commands, it will get triggered by any antivirus.
We want to convert it to Yuxi.
And how are we going to do that?
Well, we can go to Firefox and there is a really good tool that is used to convert bad programs to
XY files and we're going to download it from GitHub.
So if I type right here, bet to easy or be to get here and they navigate right here to the first link.
I copied it all we can see the tool is an actual zip file, so we must unzip it as soon as we download
it.
So let's go right here, go to the second terminal.
Let's install the tool on our desktop and I'll type git clone and then paste the link to the top.
After the tool is installed, we can change the directory to the tool, and if I type out us here is
Debat to Yingzi Converter as a zip file to unzip it, we can type the command and zip and then bet to
Yuxi and it will unzip our file, clear the screen type alerts and we will get an exit file.
Hmm.
Is this a problem if we know that files can only be run inside of windows.
But remember we have a wine program installed.
Let's get a quick reminder of what wine is.
Wine is a program that allows us to execute Windows files inside of Linux.
So let's give it a try.
If I type wine and then the program name press enter, let's give it a few seconds.
And here it is.
It open the program so we must set up the program outside the language to be English.
Click on OK, I accept the agreement.
Of course we're not going to read all of this.
Then click on next click once again on next and click right here or next after it.
On The Last Step, we can click on Install.
We want to check right here, Launchpad to Yuxi Convertor and click on Finish.
And here it is.
It opened our bet to convert.
So now what we want to do is this payload that we generated, which is inside of this location as a
dot file.
We want to convert to XY using this program, so we must open it inside of this program first.
To do that, we want to go on to file and then open.
Now, we must go to this location right here.
So let's click on this arrow.
Let's go to the location, find var, then find it.
Then the next part is.
So we must go and find the foil program, here it is.
And inside of the output and source is our power payload that bet.
Let's double click it and it will open the code of our payload.
Here it is right here.
Now we have some of the options right here that we can change if we want to, you can add an icon by
checking this and then selecting the icon from your system, but we are not going to be doing that at
the moment.
Another thing that you can do, you can set the password, you can change the working directory, you
can change the format to be something out of these four and will select to be 64 bit windows invisible
because I am attacking a 64 bit Windows machine.
You can request administrator privileges at the wrong time.
So this is sometimes good if you want your target to run the payload as an administrator.
But keep in mind, once they Double-Click the program, if this was selected, then they will have to
input the administrator password.
So that is just another step before they actually execute the program.
We are not going to be checking that right now.
Another thing that you can do is this Packer.
You can enable the OpEx compression, but enabling this will just trigger more and more antivirus software
because up is a really known Packer, and it was used a lot to pack malicious programs.
So there is nothing really here that we want to change.
And once you set all of the settings to your liking, you can go right here on the convertor and then
on convert here, you want to select the name of your Paillot and we can just call it P.
S Paillot.
Standing for power shall paillard.
It is an E format so we can just save it.
And if I click on OK, it will create our file, as we can see down here.
Process finished.
Here we can see where our file has been saved.
It is in far labor, Braille output source and then Paillard got.
OK, great.
Now, the next thing that we must do to check out whether this bailout works is to run a massive council
and while it is running a massive council, what I'm going to do is I'm going to navigate to the bail
directory.
So I will open a folder, I will go to filesystem, then go right here to LA, navigate to live all
the way down.
I will go to Whale.
Then output.
Source and here is our partial payload that acce let us keep it to our target desktop.
So I will just drag it onto the desktop of my target machine.
And here is our partial payload data.
If I go right here, open the metal framework and I go back to the first copy this metal plate, resourceful,
copy its entire path.
And type resource and then paste this for this is going to do is it will set up the listener automatically
that is made for this exact payload.
As we can see right here, it started reverse DCP Handler on this IP address on this port.
And it's doing all of that in the background.
So all I'm left to do is execute this payload.
Now, in this case, we can see the control of this payload, which is something that we don't really
want.
It only showed for a brief few seconds, but that is something that you can change inside of your back
to XY converter.
So let's wait for a few seconds.
And in just a few seconds, we should receive Dimitar better session.
And remember why it is taking so long is because inside of the whale we said 20 seconds to wait before
establishing connections.
And here it is.
We got the interpreter session one opened.
Let's see whether we can execute command, so if I clear the screen type sessions, we have one session
active and I will enter it using the dash I command get user ID and we are on that target machine.
We can enter the shell as usual type.
Who am I?
We are this account and everything seems to work great.
So we managed to create another type of payload that wasn't the same as in the previous video.
And to just prove that I can go right here to the virus total and we can upload the payload to see how
many antivirus is managed to detect it with a regular massive one on payload.
We got about 53 or 54 detection rate out of 60 antivirus.
Let's see how much we get right now.
Let's go and find it the payload.
And it is once again in slash bar, slash lip.
Bail.
In the output folder and in the source folder, here it is, I will select it, confirmed the upload,
and we should have a much slower detection rate than with the regular NSF one on Paillot.
And once again, with the usage of this battery converter, you can change some of the settings and
you might even get lower detection rate, but it will never be zero.
Why?
Well, if I just go right here and I delete the entire code and type some random code which doesn't
do pretty much anything, and if I were to convert this code to XY, it will still get detected by a
lot of antivirus vendors.
You might be asking why, since this right here is not any type of malicious code?
Well, that is because we are using this tool back to converter and some antivirus vendors find files
malicious, even though they might not be just because you converted the bad file.
To see that is pretty much the only reason.
And we can see right here, we get the much slower detection rate than with the regular MSF one on Paillot.
We get twenty seven out of sixty seven.
So we managed to bypass about 20 to 30 more anti viruses just by creating a powerful payload with,
well, instead of using a regular MSF one payload.
Great.
So what did we learn in this video?
Well, we covered this tour called well, you can experiment with other options as well, and you might
get even lower detection rate.
We also covered this back to see that we can use to convert the backfills to EXI.
And we also know that no matter what type of how we convert to it will still get detected by some of
the antivirus just because we used to like this.
OK, great, now that we covered this, we can proceed with our payload in the next video.
See you there.