Hello and welcome to this lecture.
So in this lecture we'll see how do this to make that pillar drawn in the.
Computer and get complete connection to the limousine and we'll just execute some other commands.
So before doing that let me just open the Firefox and let's see how powerful our payload is to bypass
all of that antivirus viruses.
So let's open this.
Let me disclose this veil Primakov over here.
So the website that I am going to use is Virus Total.
You can also use the next Web site which is very popular Web site and not distribute.
But I personally like this virus total.
So I just choose the file.
And let's go over here and you can see we have this output and the source.
And over here instead of a source I want to go to the output and I want this compiled and the payload
name his payload.
Dot e XY file so let's open that and let's test this file.
So first of all you have to upload that file and wait for some time because it is going to scan all
of these anti viruses and you can see clearly where this is getting some of these antivirus is struggling
okay.
So many of these devices are dragging us.
So it is not good payload.
That means you can see so many of any viruses.
So this is not effective now because 36 out of 70 antivirus is like this Avast Evita.
These are the common anti viruses and they are a striking as you can see the big defender is dragging
us so many of such that rankings.
So that means this is not an effective file or the payload that we are doing for less make is something
that is more powerful than this and let's try to bypass some of these antivirus is.
So let's go beyond our payload is listening obviously and these are basically our handler is listening
on this board.
So we don't need to do anything over here.
Instead we have to this use this real framework in order to make another payload.
So let me use again that is the 15 which is going to be the smallest all of this build the 15 payload
is your reverse cell or reverse it.
Yes.
So I'll just use 15 and you can see clearly now we have these already the command that is right here.
So what I'm going to do here is let's make some changes.
So first of all I'll say this submitter may be the scope of here.
You can just give this user prompt.
It's true or something like that.
You can see and you can ascertain the slip so let's try for the slip.
If I says sleep maybe two seconds or something like this.
So as I say so ops and say one more time so it is only Dobson's and you can see now we have here too.
So let's generate and let's see if this Kansas bypass our payload.
So now I'll just name this new payload
unless it into this is going to encode everything and it will now create that payload.
And you can see it is this new payload dirty sexy.
Let's open that Firefox again.
Let me see.
I want to go to navigate this by this turtle
let's choose the file over here.
So it is new payload.
And now let me just upload this first and let's see if.
Now this.
Can this bypass surgery.
So we haven't changed anything.
We have just made it something like only things in here.
So you can see this doesn't work again.
So it is not working at all so you can see clearly we didn't get anything better than before.
So it was same as before.
It is also dragging by Avast and I think it is dragging more than before.
It is now 40 out of 67.
That must be better than before or more.
And now let's do something else try to just make some changes now.
Let's see this makes sense is by this listed said this process is the list said these processors be
to now and the less said this sleep as you said this sleep baby one less gender.
Now one more time
less heat into and allow as the same disease X indeed payload
and again we do this do some of these stocks the encoding ducks and now let's go back to our Firefox
and let's go back.
So OK.
It is already uploading has spun the virus total over here and now let me just choose the file.
It is extended payload and its upload this file and let's see if this can bypass some of the antibiotics
on.
OK it has been dragged out one more time okay.
It is the same as you for so many applications is striking our payload.
That means it is not better than before.
It is the same as before.
So we destroyed some of the ways to modify but it hasn't work yet.
So let's see what the options we can do over here.
So there is not more upset over here.
You can see we'll just say that minimum processes that they can run are the RAM take or the.
Maybe we'll just say the user name that is completely optional that doesn't do anything maybe.
So same as before you have to try everything over here in order to make that payload undetectable by
any antivirus use 15 same as before let's say.
Now let me just go maybe to the processors I don't want so much processor out of the set one analyst
say if I want to say it maybe sleep to let me see it.
Let's see if this works or not.
So this take off since one more time and it is completely fine.
I'll say I want to see and read and I'll just say Now disease payload reveals and something like this.
So let's see if this works or not.
So let's go back one more time to the Vitus turtle and I'm just going to navigate over here and let's
applaud that file.
It's useful and this time it is payload revision.
This upload this file first and maybe this is going to work it is going to upload and let's wait for
some time.
Maybe this file is bigger than before or let's see if this works or not.
So we are waiting D.
Again detectable
he is awaiting
clearly it is also quite failure because out of 20 the 14 has detected and again these make it free.
And the Kaspersky and everything has detected.
So you can clearly see this is also not the proper.
So we this man is to put it under maybe 40 or into the stars of 40.
So there has been quite improvement but we do one that is no back doors or basically no antivirus cards
our backdoor board.
In this case again was getting the result that is 39 card out of 65.
That is also the apres payload.
It is not going to work in all of these machines.
That means it is also a complete failure.
So you have to just do this couple of times in order to take or basically in order to see which so will
work for you.
So let's say sleep maybe six and let's see.
I want to generate and the payload will be final.
So I am just doing this one last time.
Final maybe reverse.
So let's shift into
now it is again that is final reverse let's go back let's take one more time.
Hope and this will work because it is just surrender my arms assuming something that is completely out
of logical we are just string random value over there.
We don't have any patterns to this.
Do you know that this rule won't be tracked by any devices because we don't have any answers to the
antivirus is a database or the signature.
So we Kansas were random value and destroy our luck.
So it is it was reverse so it was finally reverse.
So let's see if this works or less place okay
so it is uploading to see how this works.
It is also maybe not a good way because out of six are out of maybe 15 16 9 has been captured.
So it was so a failure.
So we didn't get any idea or any bad until now.
How does this get bypassed to all of these anti viruses.
So let's go back.
And now instead of going for these here with these.
Yes.
But I want to show you a way to create your payload from here.
But you can see that we have this bunch of payload.
You can now try for this python Mitra Peter reverse yesterday piece instead of go so you can just use
this and you can also try.
So let's use that now.
So I'll just say that first of all I want to list and the python reverse is true as is in 27.
So let's use that twenty seven and you can see you have to say it again the whole host and in my case
it is the IP address of Kali
let me say it.
Yell port which will be 88 DB and the noun there is so much of advanced options over here so I'll just
use these set processes maybe and I was say one and after that I had a set sleep a random value maybe
four.
After that I'll set off since again and it has said what we have this returnable here.
Let's generate this pillar now and let's say bite and rivers solicit into.
And now it is saying that what do you want to use.
So if you this heat into it is going to replace dollar or if you just price too it is going to be by
3x.
It doesn't really matter because this board is going to convert your files by then file into the EMC
file.
So I'll this stick with this by installer
and it is going to do is work.
You can see the below these billing.
Now the payload is the built below the here and you can see the executable on the same file which is
the compiled file this go over here and let's check if this works or not.
Let's try this one more time slams its thing file is useful and now it is byte in reverse so let's hope
that this war is spread so careless wait for some time it will.
This is doing stacks and python is basically what we see in the next upcoming lecture will learn about
the python how to make this complete reversal.
With the help of Python so instead of making use of this veil framework we're going to use our backdoor
from the python that we learn in the next lecture.
So will this make our own payload.
And in this case you can see so much of antivirus his has detected but our payload or our backdoor won't
be detected by any of the anti viruses.
So will this make that strong payload are the backdoor that ought to be dragged by any of the anti viruses
that will be run in any of the operating system either that can be Linux or the mac with six hour window.
Because you know the python is cross platform only the command that we run on the machine will be Python
or basically there will be a specific operating system.
So instead of using those command that is specific to any operating system we're going to use the command
that is particularly based on the python because Python works on the Linux and it also work on the windows
and the Mac OS X.
That means we'll use the command of only Python that will make our backdoor much more available or basically
to it can be used to attack all of this operating system instead of making this based on the particular
specific operating system will make a complete reversal that will be cross platform that means it will
be available.
It will be this working on any of the operating system that is available.
So this will be read for this lecture so you can clearly see even making these payload with the python
did not work for us within some of these options over here.
So it didn't work again.
So this will be read for dyslexia.
Well the straight something else in the next lecture and soon on the next one.