Lecturer: Okay, now that we have Veil loaded, 2 2
you can see it show us the main commands 3 3
that you can use with Veil. 4 4
So, the first command is, you can do exit to exit, 5 5
you can do info to get information about a specific tool, 6 6
you can do list, to list the available tools. 7 7
You can do update, to update Veil, 8 8
and this is very, very important 9 9
because you always wanna be up to date 10 10
when it comes to bypassing anti-virus programs, 11 11
and then you can do use to use a tool. 12 12
Now, let's start using Veil Evasion, 13 13
and as we do it, it's gonna become so easy 14 14
and you'll be able to understand it more. 15 15
Now, Veil has two main tools and if we do list, 16 16
you'll be able to see them. 17 17
So, we have the first one which is 18 18
the one that we're interested in, which is called evasion. 19 19
And that's the one that generates 20 20
undetectable backdoors for us. 21 21
And then there's the second one, which is called ordnance, 22 22
and this tool generates the payloads that's used by evasion, 23 23
so you can look at this as a helper or a secondary tool. 24 24
Now, what I mean by a payload is, 25 25
a payload is the part of the code of the backdoor, 26 26
that does the stuff that we want, 27 27
that does the evil stuff if you wanna say. 28 28
So, it's the part of the code 29 29
that give us a reverse connection, 30 30
it's the part of the code 31 31
that download and execute something on the target computer, 32 32
it's the part of the code that allow us 33 33
to achieve what we want by executing that file. 34 34
And this is gonna become more clear as we start using Veil. 35 35
Now, for now we're interested into using evasion, 36 36
so we're gonna do use 1, because that's the first tool, 37 37
that's number one. 38 38
And as you can see we have Veil Evasion loaded now, 39 39
and as I said before, this used to be a standalone tool 40 40
that you just downloaded on it's own. 41 41
But now they have it all combined together. 42 42
Now, as you can see, the first thing that we get 43 43
when we load Veil Evasion is the commands 44 44
that you can run on this tool. 45 45
So, the first thing that we wanna do is 46 46
we want to list to see all the available payloads. 47 47
And as you can see, we have 41 different payloads 48 48
and all of this payloads follow a certain naming pattern. 49 49
And you can see for example, 50 50
let's take this example right here 51 51
because that's the payload that I'm gonna be using. 52 52
You can see the payload is divided into three parts. 53 53
The first part right here refers to the programmer language 54 54
that's the payload is gonna be wrapped in. 55 55
So, we have the evil code, and then the evil code 56 56
is gonna be wrapped into a certain programming language 57 57
that the target computer understands. 58 58
And right here you can see that this payload uses 59 59
go programmer language, we can see this one uses c, 60 60
we can see these ones use cs, 61 61
we have python, we have powershell, 62 62
and we have ruby if we scroll down. 63 63
The second part of the payload is really important. 64 64
This is the type of the payload, the type of the code 65 65
that's going to be executed on the target computer. 66 66
In this example, we're using Meterpreter 67 67
which is a payload designed by Metasploit. 68 68
Metasploit is a huge framework for hacking 69 69
and it allows you to do a lot of things. 70 70
But in this lecture we're focusing 71 71
on creating a payload called Meterpreter, 72 72
and what's really cool about Meterpreter is 73 73
it runs in the memory and it allow us 74 74
to migrate between system processes, 75 75
so we can have the payload or the backdoor 76 76
running from a normal process like Explorer for example, 77 77
and this payload will allow us to gain full control 78 78
over the target computer, 79 79
so we'll be able to navigate through the file system, 80 80
download, upload files, turn on the mike, 81 81
turn on the webcam, even use that computer 82 82
to hack other computers, install a key logger, 83 83
you can literally do anything you can think of. 84 84
And all of this will be running from the memory 85 85
from a normal process on the system. 86 86
So, it's very hard to detect 87 87
and it doesn't leave a lot of footprints. 88 88
That's why it's a really, really cool payload 89 89
and we'll be using it a lot. 90 90
The third part of the name is the method 91 91
that's gonna be used to establish the connection. 92 92
So, and here we can see that this is called rev https. 93 93
So, rev stands for reverse, and https is the protocol 94 94
that's gonna be used to establish the connection. 95 95
So we can see that this payload will create 96 96
a reverse https connection. 97 97
You can see this one right here for example, 98 98
it creates a reverse http connection. 99 99
And we have this one in here 100 100
that creates a reverse tcp connection. 101 101
Now, what I mean by reverse is the connection is gonna come 102 102
from the target computer to my own computer. 103 103
So, I won't be connecting to the computer 104 104
that I want to hack, what's gonna happen is 105 105
once the person double clicks the backdoor, 106 106
the backdoor will connect back to me 107 107
from the target computer. 108 108
What's cool about this is, 109 109
I'll be able to bypass anti-virus programs 110 110
because the connection is not going to the target computer, 111 111
it's coming back to my computer, 112 112
so it's literally as if the target person 113 113
is just connecting to a normal website. 114 114
I'm gonna use a port that websites use which is 80 or 8080, 115 115
so again, if the person analyzes the connection, 116 116
it will look as if they're literally 117 117
just connecting to a normal website. 118 118
Also, if the target computer is hidden behind a router, 119 119
or behind a network, again this is gonna work, 120 120
because the connection is coming 121 121
from the target computer to me, 122 122
instead of me connecting to the target computer. 123 123
So, using a reverse connection is really, 124 124
really handy and I think this is really 125 125
the only practical way of gaining access to a computer 126 126
because there is a lot of things that can stop you 127 127
from connecting to a certain computer. 128 128
Now, this is the general naming pattern. 129 129
You'll see some payloads like this one right here 130 130
which doesn't follow that general naming pattern. 131 131
And basically, what these payloads do for example 132 132
you can see this one is called shellcode inject, 133 133
so what it's going to do is, it's going to create a payload 134 134
that injects your other payload. 135 135
So, it's gonna create a normal payload, 136 136
and that normal payload injects 137 137
a Meterpreter payload for example. 138 138
Now, it does this to try to bypass more security 139 139
but usually they won't bypass more things 140 140
than the normals payloads would bypass, 141 141
so that's why I usually just use 142 142
one of the normal payloads in here. 143 143
So, this is it, this is all about the payloads, 144 144
sorry I took a bit of time, but I wanted to make sure 145 145
that you guys understand the naming pattern, 146 146
I wanted you to understand what a payload is, 147 147
and the difference between a reverse 148 148
and a bind, and a tcp payload, 149 149
this way the rest of the course 150 150
will become more clear to you 151 151
and I can just use the payload that I want 152 152
without explaining what it is. 153 153
Now, in the next lecture we're gonna be 154 154
generating a payload, and we'll be testing it 155 155
against anti-virus programs.