OK, now that we have loaded, you can see it, show us the main commands that you can use with Vele.
So the first command is you can do exit to exit, you can do info to get information about a specific
tool.
You can do list to list the available tools.
You can do updates to update.
Well, and this is very, very important because you always want to be up to date when it comes to bypassing
antivirus programs.
And then you can do use to use a tool.
Now, let's start using television, and as we do it, it's going to become so easy and you'll be able
to understand it more.
Now, Will has two main tools, and if we do list, you'll be able to see them.
So we have the first one, which is the one that we're interested in, which is called evasion, and
that's the one that generates undetectable back doors for us.
And then there's the second one, which is called ordnance.
And this tool generates the payloads that's used by evasion.
So you can look at this as a helper or a secondary tool.
Now, what I mean by a payload is a payload is the part of the code of the back door that does the stuff
that we want, that does the evil stuff, if you want to say so.
It's the part of the code that give us a reverse connection.
It's the part of the code that download and executes something on the target computer.
It's the part of the code that allow us to achieve what we want by executing that file.
And this is going to become more clear as we start using Bill now.
For now, we're interested into using evasion.
So we're going to do use.
One, because that's the first rule, that's number one.
And as you can see, we have a vision loaded now, and as I said before, this used to be a standalone
tool that you just downloaded on its own, but now they have it all combined together.
Now, as you can see, the first thing that we get when we load will evasion is the commands that you
can run on this tool.
So the first thing that we want to do is we want to list to see all the available payloads.
And as you can see, we have 41 different payloads and all of these payloads follow a certain Namik
pattern.
And you can see, for example, let's take this example right here, because that's the payload that
I'm going to be using.
You can see the payload is divided into three parts.
The first part right here refers to the programming language, that's the payload is going to be wrapped
in.
So we have the evil code and then the evil code is going to be wrapped into a certain programming language
that the target computer understands.
And right here you can see that this payload users go programming language.
We can see this one uses see we can see these ones.
You see as we have python, we have power shell and we have Ruby if we scroll down.
The second part of the payload is really important.
This is the type of the payload, the type of the code that's going to be executed on the target computer.
In this example, we're using my interpreter, which is a payload designed by me test flight test flight
is a huge framework for hacking and it allows you to do a lot of things.
But in this lecture, we're focusing on creating a payload called an interpreter.
And what's really cool about Mr. Peter is it runs into memory and it allow us to migrate between system
processes so we can have the payload or the back door running from a normal process like Explorer,
for example.
And this payload will allow us to gain full control over the target computer.
So we'll be able to navigate through the file system, download upload files, turn on the mike, turn
on the webcam, even use that computer to hack other computers, install a key logger.
You can literally do anything you can think of.
And all of this will be running from the memory, from a normal process on the system.
So it's very hard to detect and it doesn't leave a lot of footprints.
That's why it's a really, really cool payload and we'll be using it a lot.
The third part of the name is the method that's going to be used to establish the connection.
So in here you can see that this is called Ribe https.
So register stands for reverse and https is the protocol that's going to be used to establish the connection.
So we can see that this payload will create a reverse https connection.
You can see this one right here, for example, it creates a reverse HTP connection and we have this
one in here that creates a reverse TCP connection.
Now, what I mean by reverse is the connection is going to come from the target computer to my own computer.
So I want to be connecting to the computer that I want to hug.
What's going to happen is once the person double clicks the back door, the back door will connect back
to me from the target computer.
What's cool about this is I'll be able to bypass antivirus programs because the connection is not going
to the target computer is coming back to my computer.
So it's literally as if the target person is just connecting to a normal website.
I'm going to use a port that websites use, which is 80 or 88.
So, again, if the person analyzes the connection, it'll look as if they're literally just connecting
to a normal website.
Also of the target's computer is hidden behind a router or behind a network.
Again, this is going to work because the connection is coming from the target computer to me instead
of me connecting to the target computer.
So using a reverse connection is really, really hard.
And I think this is really the only practical way of gaining access to your computer, because there
is a lot of things that can stop you from connecting to a certain computer.
Now, this is the general naming pattern, you'll see some payloads like this one right here, which
doesn't follow that general naming pattern.
And basically what these payloads do, for example, you can see this one is called Shell Code Inject.
So what it's going to do is it's going to create a payload that injects your other payload.
So it's going to create a normal payload.
And that normal payload injects interpretor payload, for example.
Now, it does this to try to bypass more security, but usually they want bypass more things than the
normal payloads would bypass.
So that's why I usually just use one of the normal payloads in here.
So this is it, this is all about the payloads sorry, I took a bit of time, but I wanted to make sure
that you guys understand the naming pattern.
I wanted you to understand what a payload is and the difference between a reverse and a bind and a TCP
payload.
This way, the rest of the course will become more clear to you.
And I can just use the payload that I want without explaining what it is now.
In the next lecture, we're going to be generating a payload and will be testing it against antivirus
programs.