‫Let's see how we can create a basic malicious Windows executable using the MSF Thanom tool 64 bit Windows
‫eight is the victim's system.
‫Choose an executable to use as a template.
‫The output malware will be the same size.
‫With this template file, I'm going to use Puti dot exec file as the template.
‫Let's copy Pooty Dot exec to Calli to work on it.
‫First, look at the IP address of the target machine here Kawi.
‫You can use win SICP tool to transfer a file from a Windows system to a Linux system, SICP secure a
‫copy as a means of securely transferring computer files between a localhost and a remote host or between
‫two remote hosts.
‫It's based on the S.H. Secure Shell protocol.
‫Now, since when SICP uses SSL protocol, you'll be sure the Secret Service is running on Calli.
‫Check the status of the search service using the service SSA Status Command.
‫It's already active on Micheli, if it's not running news service, S.H. start to start the SSA service
‫in your cauli machine.
‫If you try to log in when SICP using route user, you may see the access denied message, that means
‫using S.H. service with route user is denied in your Calli machines.
‫S.H. Service configurations either change the S.H. service config to be able to connect with route user
‫or create a new user to use SSL connections.
‫I choose to create a new user you can use, add user or user, add commands on the terminal screen or
‫users interface to add a new user.
‫I've already added a user before S.H. user.
‫For this purpose, you can add a similar user to your system.
‫Connect with SICP using S.H. user credentials.
‫Find the exact file at the Windows side in this example, it's on the desktop of a current user, copy
‫it to the Kawi machine in here to the home folder of S.H. User in Calli Use is command in the terminal
‫screen to see if the file is transferred successfully.
‫Now we're ready to create a malicious executable using the Puti dot exact file as a template.
‫Prepare the appropriate MSF venom command, the first parameter is Dasch P, which specifies the payload
‫used, you have to find the correct payload according to your target.
‫Don't forget to choose a payload with the correct platform, correct architecture, correct connection,
‫method, etc..
‫You can see the available payload using NSF, Darelle Payloads Command.
‫There are a lot of payloads available, and since the target machine is 64 bit, we can filter the results
‫using grep command with pipe.
‫We use the windows for interpreter reverse, underscore TCP payload for this example.
‫Let's have a pause here and have a small introduction to the world of Métis Voit.
‫Metastable project is the most used penetration testing framework in the world.
‫It can be used to test the vulnerability of computer systems or to break into remote systems metastable.
‫It was created by HD Moore in 2003 using Perl by 2007.
‫The Métis Foyt framework had been completely rewritten in Ruby in 2009.
‫The project was acquired by Rapide seven.
‫Now they have a free and open source version, Métis flight framework and a commercial version.
‫Métis Boyd Pro.
‫It's best known sub project is the open source Métis Boite framework, a tool for developing and executing
‫exploit code against a remote target machine?
‫The mSv console is probably the most popular interface to the Métis Plate Framework MSF, it provides
‫an all in one centralized console and allows you efficient access to virtually all of the options available
‫in the MSF.
‫MSF console may seem intimidating at first, but once you learn the syntax of the commands, you will
‫learn to appreciate the power of utilizing this interface.
‫Mature too short for the matter, interpreter is an advanced payload that is included in the medicine
‫sport framework.
‫Its purpose is to provide complex and advanced features that would otherwise be tedious to implement
‫purely in assembly.
‫The way that it accomplishes this is by allowing developers to write their own extensions in the form
‫of shared object DL files that can be uploaded and injected into a running process on a target computer
‫after exploitation has occurred.
‫Masturbator and all of the extensions that it loads are executed entirely from memory and never touch
‫the disk.
‫Let's continue to create a malicious executable using the MSF venom tool.
‫Now the first parameter was the payload.
‫We can choose the platform here, Windows, but since we chose a Windows payload, the tool will already
‫understand the platform, same as the platform.
‫We can set the architecture x 64 using the dash arch parameter because we use a payload for X 64 architecture.
‫The two already understand the architecture, so we don't need to use arch and platform parameters in
‫this example.
‫The next parameter is dash F to determine the format of the output file.
‫You can use MSF venom, dash, help dash formats to see the available formats.
‫We only use the exec in this example.
‫Then specify the template file using a dashikis parameter with the template file.
‫Name the output file with the dash o parameter.
‫Now is the time to define the options of the payload, to see the options of the payload, you can use
‫the dash payload dash options parameter with the payload.
‫We have to decide the host and the airport options of the payload here.
‫Complete the command again, output file format.
‫And output file name.
‫Now, a sign will host an airport options of the payload el hostas, the IP address of the listener
‫machine.
‫In this example, our Calli machine, El Port is the port which will be open to listen to the sessions.
‫Hit enter to create the malware.
‫As you see, no arch has selected the tools selected x 64 from the payload and no platform is selected,
‫the tool automatically selected windows from the payload.
‫Again, to be sure, go to the folder and see the created malware.
‫The attackers should find a way to make the victim accept and run the malware, let's just copy the
‫malware to the victim's machine at the moment and suppose that we send it as an attachment to a phishing
‫email.
‫First, let's try to copy the files of the Windows machine while Windows Defender is running.
‫As you can see, Windows Defender recognized the malware.
‫And deleted it in seconds.
‫Can you guess why?
‫Because we use the standard medicinally payload, which is very well known, and Windows Defender recognized
‫it easily.
‫To see the payload in action, let's turn Windows Defender off and send the malware again.
‫As an attacker, we need to listen to capture the sessions of the victims who run the malware.
‫Start MSF console.
‫You'll have a media support framework show.
‫Search for the Handley's.
‫Use exploit multi handler for this example.
‫In handler, we have to use the same payload that we use in the malware.
‫List the options with Show Options command.
‫Set the listener address in port.
‫Since the default port is the same with the port we assigned in the malware, we can leave it as is.
‫And run the handler, it starts to listen at that moment.
‫Now go back to the victim machine and run the malware.
‫Voila, we got the session from the victim machine, look at the system info using this info interpreter
‫command.
‫It's a 64 bit Windows machine.
‫Look at the user ID interpreter has a lot of excellent commands to compromise the victim's machine,
‫use help command to see some of them.
‫Let's take a screenshot of the victim machine.
‫When we list the currently running processes using task list command and the victim machine, we see
‫the malware running.
‫You can kill it using the task kill command with rapid parameter.
‫Use the F parameter to force it to be killed.
‫As soon as the malware process is killed, the interpreter session dies as well.