[MUSIC PLAYING]
Injecting payloads into Windows portable executables.
In the previous video, we explored the process
of encoding both Windows and Linux payloads with the Shikata
Ga Nai encoder, and also took a look
at how to increase the number of encoding iterations performed
on our payloads.
In this video, we're going to take a look at how
to inject payloads into Windows portable executables,
with the objective being to, again,
evade or avoid signature-based antivirus detection.
So let's get started.
So, I'm just going to switch over to my Kali VM,
and we can actually explore how this can be done
through the use of MSF Venom.
All right, so I'm back on Kali and we
can get started by typing in the MS venom command here.
And at the bottom here, you will see
that we have the X option, which allows
us to specify a template.
So this allows us to specify a custom executable file
to use as a template that again, in this case,
we are trying to inject our payload into.
So we can utilize the X option.
You can also utilize the K option in conjunction
with the X option to essentially preserve the template behavior
and inject the payload as a new thread.
So all of this can come into play
whenever you're trying to utilize
a legitimate executable, and again
try and inject your payload into the legitimate executable.
So in order to do this, we'll first
of all require a legitimate portable executable.
You can find one know browsing online,
and of course, the option or the choice is up to you.
Some portable executables may not
allow for successful injection, so you
need to be aware of that.
In my experience, one of the best options
that you can utilize is the WinRAR executable here.
So WinRAR is essentially a file archiver for Windows,
and it's very popular.
And again, in my case and in my testing,
this has worked really, really well.
So in our particular scenario, we
are going to generate a 32-bit Meterpreter payload
and then essentially inject it into the WinRAR set up file.
So we can head over to Download, and we
can download the 32-bit setup file here,
which I'm going to do.
There we are, Save File, and that's
in my Downloads directory.
What I'm now going to do is just clear up my terminal
and we can begin the process of generating the payload
and then injecting it within one command.
All right, so in order to do this,
we again go through the process of specifying the payload as
well as the architecture, if it's not already explicitly
defined within the payload.
And in our case, because we're using a 32-bit Meterpreter
module, again, that should be no problem.
So we're to say Windows Meterpreter,
and then reverse TCP.
And we specify the LHOST option here,
which is going to be your Kali Linux IP, or the attacker's IP
address.
In my case, it's 10.10.10.5.
We then specify the port option, which in this case
is going to be 1234.
Again, feel free to change that.
We can then specify our encoder, which as we already know,
is going to be Shikata Ga Nai, so X86 shikata_ganai.
There we are.
We can then increase the encoding iterations to 10,
if we want.
And then this is where we specify the format.
So we can say the format is an executable,
and we can then specify the X flag or the X option
to essentially inject our payload
into the executable or the portable executable
that we will now specify.
So now is where you specify the actual WinRAR executable
that we downloaded.
So that is stored in my Downloads directory,
and you can see we have the WinRAR 6.02 .exe there,
so we're going to specify that as the actual portable
executable that we want to inject our payload into.
After this, we can then output our final executable
into any directory.
In our case, I'm going to specify or save it
into the Windows Payloads folder,
and I'm just going to call it WinRAR.exe, all right?
And we're just going to hit Enter and give that
a few seconds.
All right.
As you can see, you want to pay close attention to the output
generated by MS Venom.
So first and foremost, it specifies the platform
correctly as Windows, as well as the architecture,
and then it utilizes the Shikata Ga Nai encoder
and goes through 10 iterations of encoding the payload
with Shikata Ga Nai.
And at the end here, it doesn't give us
any error here or any error message
that could indicate that the injection process failed.
So if we check out the actual Windows Payloads directory,
we should be able to see that we have
the WinRAR.exe right over here, and we can now transfer this
over to the target.
So what I'll do is I will set up a web server
to host these files within this directory.
So I'm going to say sudo Python m simple HTTP server.
There we are, simple HTTP server,
and I'll host this on port 80.
We now want to set up our listener,
or multi handler if you will.
So I'm going to open up MSF console, give
that a few seconds to start up.
We are then going to specify the multi handler,
set the payload that we used to generate our executables,
so set payload to Windows, Meterpreter, reverse TCP,
and then set the LHOST options accordingly.
So LHOST is going to be equal to whatever value we specify,
which in this case is 10.10.10.5,
and then LPORT is 1234.
And we can just Run to start up the handler.
There we are.
So we can now switch over to the Windows system.
And I'm back on the Windows system, and right over
here through the web server, I can download the WinRAR.exe
that we generated.
So I'm going to hit Save and store it
within the Downloads folder.
There we are, Save, Close.
And if we open up the Downloads folder,
you can see that actually looks like the WinRAR setup file.
However, because we did not specify
the K option to maintain the functionality
of the executable, what will happen here
is when we double click on it, it
will actually not provide us with the WinRAR installer.
It'll just execute the actual payload.
However, if you take a look at the actual file description
here, you can see it still maintains the actual company
and developer that actually developed WinRAR, which again,
can help with the authenticity when you're trying to perform
a client side attack.
It also provides it with a file version.
So if we double click on it, because it's an installer,
it'll prompt me to enter a password here,
which I'm going to do.
So I am, and there we are.
There we are.
And once we execute it, it is going
to execute the payload in memory.
So we can now switch over to the Kali VM
and see whether we got a Meterpreter session.
All right, so I'm back on Kali, and as you can see,
we get a Meterpreter session.
And if I type in sysinfo, you can see we still have access
to the Windows system.
All right.
Now, once you've established access on a target system
through a client side attack, one
of the commands I would recommend that you run
is the actual post-exploitation module called migrate, right?
Now, this post-exploitation module
is a Windows post-exploitation module
that will manage the actual process that the Meterpreter
payload is currently running on to another one,
or it'll inject it into another one in the event
that process is eventually stopped by Windows.
This can be very useful in, again,
preventing that from happening.
So when I hit run post-Windows manage migrate,
it'll actually migrate the process into another one.
And in this case, it's going to call or spawn
the notepad.exe process, and it will migrate into that process
and it will then provide you with the process ID.
At this point, you really don't need
to worry about these post-exploitation modules.
We'll explore them when we actually
get into the actual post-exploitation phase
or section of this course.
So again, we have successfully been
able to migrate our process.
And again, if we type in sysinfo, we still have access.
I can list all the files here.
So we're currently within the Downloads directory
on the target system, and we can see that it actually
lists out the contents of the Downloads directory perfectly.
All right?
Now, the other option that I mentioned, you can use
is the K option.
Now, the K option will essentially
maintain the actual functionality
of the portable executable that you're
injecting your payload into.
Now, what this means is that if we again inject our Meterpreter
payload into the WinRAR setup file, what will happen
is when we transfer that executable onto the target
system and the target clicks on it,
it will actually launch up the WinRAR setup or installer,
so it's going to maintain the original functionality
of the portable executable.
And it's then going to execute the interpreter payload
and again consequently provide us with a Meterpreter session.
However, this will not work for most portable executables
out there.
And in the case of WinRAR, let's actually test
and see whether this will work.
So I'll use the previous command,
and I'll just call this WinRAR New.
We'll just call it WinRAR New, so I'm
going to output it into a new executable called WinRAR New.
And right over here, after we specify the actual X
option or before that, we can specify the K option.
That'll keep the original functionality
of the WinRAR setup file.
This is the file here.
So if we hit Enter, we should get an error
because this particular portable executable may not provide us
with the ability to actually inject the payload,
and furthermore, retain the original functionality.
There we are.
So as you can see at the end, it's still this error.
The template file doesn't have any exports to inject into.
So again, this will require a lot of testing,
and you can try it out with various portable executables
or setup files and see which ones you have luck with.
As I said, this technique is really not
used anymore, primarily because of the fact that
antivirus solutions have become much more advanced
and their signature database is quite
comprehensive in regards to the ability to detect
payloads, especially payloads generated by MSF Venom.
However, this technique will again
help you in furthermore modifying or changing
the actual signature, because you are now
injecting the actual shellcode into a legitimate executable.
So again, you can test this with other executables, if you want.
And yeah, that's pretty much going to be it
for this demonstration.
All right, so in the next video, we
will be exploring the process of automating
some of the Metasploit commands that are quite repetitive,
and we'll be able to accomplish this
through the use of a Metasploit RC script,
or a Metasploit resource script.
So I'll see you there.