Welcome back.
In this video, I want to show you a cool way that you can make your executable seam and look like another
file.
So what I'm going to do right now is I'm going to mask our shell data that we created from the previous
video to look like a car image.
And what you will need for this is you're going to need a car image or basically it doesn't even have
to be an image or a car.
It can be any file type that you want.
If you want to create it to be a PDF file, you can if you want to create it to be a JPEG file, you
can just follow along.
And the process of doing that is the same for every file type.
So two things.
You're going to need a file that you want your executable to look like and the executable itself.
So this is the same payload from the previous video, which is the regular Windows interpretor Shell.
And what I'm going to do is I'm going to copy it to the desktop real quick.
And once you got these two files on your desktop, you are ready to go now, the first thing that we
must do is we must make an icon file from this file.
And how can we do that?
Well, we can just open the Google Chrome or any search engine and type Yanji to Icko.
You can never get to the first link in case you chose Portugal and Italy due to this convertor dot com,
for it allows us to simply just upload our image and it'll create an icon file with that image.
So I'm going to lower the screen.
Then, as it says right here, drop your files, I will drop it right here.
It will take a few seconds.
And right here, our files should appear once it's done.
Here it is, we can download it by pressing this arrow.
And it will download the car that I filed for us, so I'm going to show it in folder based it on my
desktop and now we are good to go.
We got the car, that PMG, which is the image.
We got this car that Icko, which we are going to use to make our executable, have this icon right
here and we're going to merge it with this image in order for once the target executes our program.
It also opens this image.
Let me show you how it would look like.
So all you want to do, you want to select these two files.
Right.
Click on them and click.
Add to archive.
Click on this right here.
There are a few settings that we must set.
First or high format should be zip.
Right here, you want to check, create SFX, our hype, and here you can name your file, whatever
you want.
The only bad thing about this is that it will have an extension, but most of the people don't have
extensions enabled on their Windows system, so this will not present that big of a problem.
OK, so let's go right here and call it car seat.
Then I want to go to the advanced tab and click right here on SFX Options, this will open this small
window and we want to go through each step and set the settings accordingly.
In the update tab, you want quick extract and update files and in the overwrite mode, you want to
overwrite all files.
Then if I go to text and I can type here who want to click on this load?
SFX icon from the file, click on Browse, find the icon file that you just created.
In my case, it is on my desktop, so I'm going to select it.
Once you do that, you can move on to the next step.
So in the lysis tab, there is nothing that we want to set here.
Also, there is nothing that we want to set.
If I go to the advanced nothing in modes, we want to click on hide all and unpack the temporary folder
after it.
In the setup, we want to write both of our file names.
So the run after extraction, we want to type right here shell data.
Just make sure you type the files name right here correctly.
So Doxy is our executable end card dot.
PMG is our image.
OK, good.
Under the general, nothing here to do so once you set all of those options, you can click on OK,
and you can click right here on OK as well.
And here it is.
We got Kadota acce on our desktop.
It has the icon of this image and once we go and executed, it should also open this image.
But in the background it should also run our shelter.
Let's test it out.
But first we must set up our listener.
So open terminal.
Run MSF massive.
Let's set up our listener, so multi handler said payload to be regular Windows interpreter reverse
the host will be the IP address.
My calendars, machine and outport, if I remember correctly, was five five five five.
Now I can run this.
This will start the listener and if I go to my desktop and execute this fall.
Well, for some reason, it seems to have only opened this matter, but there Shell and it didn't open
the image and this is something that happens sometimes so we can try to change some of the settings
in order to make this work.
But in this case, it was just a late opening.
So here is the image.
It opened right now for some reason that took a few seconds to just run it once again just to see whether
it will open faster right now.
So I will run the listener once again and open car that it still seems to take some time, even though
our interpretor shell is open.
So what we can do instead of this is we can, first of all, exit this shell, close this image that
opened 10 seconds after we executed, and we can start the massive console again, delete this file
and we are going to change one setting, which will hopefully make our file execute faster.
So let's go once again, zip here.
We want to name the file to be harder to see under the advance SFX options.
And here under the setup is something that we want to change.
The last time we specified the shell, the first right now we're going to specify that PMG first and
under it I'm going to specify Shell that the ACCE then I'm going to click right here, hide all.
In the general, nothing in the update, extract and update files, overwrite all files, text an icon,
let's select our file in the license and module.
There is nothing.
So I just click on OK, it will create our file once again.
Not sure why I closed the console.
One Right now we are going to set up our listener again and multi handler.
Interpretor.
Said the host and the airport, we want to run it.
Run the file and now it opens the image straight away.
OK, so just make sure that you specify the image name first and then after it you can specify the shell
name.
And here we also got the interpreter session opened.
We can execute commands as usual.
So our program works good.
It has an icon of an image.
It also opens an image.
The only problem is this extension.
And there are some of the ways that you can fix this and make it seem like it doesn't have any extension,
but most of those ways automatically get detected by any antivirus out there.
OK, great.
Now that we cover this, we are ready to finally get into the post exploitation section.
And here we're going to go into details with the interpreter shell, what options it has and what post
exploitation modules we can run after hacking the target.
See you in the next video.