Now let's start all from the beginning.
So what are we gonna do in this lecture is will this make a.
And will this listen on the board on this server or on the little Linux and on the client side you can
see we have this immense edge which is the virtual box of Windows stand ready and all this insect that
payload from the web server and will just run this backdoor and see if it can be detected by these antivirus
or not.
So first of all as always let's go to the Linux.
And this is the machine where do you have these surveilled frame up.
So it is installed in this folder.
If you remember from the previous lecture if I list there is Vale.
So if I just go to the veil at least one more time in order to run this framework will this do something
like this veiled or be way less it into then you'll have this veil free mock up and running.
So next thing what you need to do over here is to make a payload.
You have to first use that is one because we wanted this evasion.
So let's use one.
Now let me list all the payload that is available.
You could see the 4 2 on Billboard.
We want to maybe this payload which is reverse its GDP yes.
So I have told you before that this is the naming convention where the payload starts with the programming
language that it is made of.
And this is a meteor Peter for the reversal or basically for the connection between the client and the
server.
And here is the name.
So it is basically a reverse.
Yes TTP is that means our client will try to connect to the server or not that the college Linux is
going to connect.
So basically what happens is if any server are basically in my case it is a calorie nut.
So if Collin Linux tried to connect directly to the client then it is not possible because there is
a firewall that is not going to give us any connection.
So if there is any malicious content you want to transfer directly it is not possible.
So if client connects to the server that is possible because in that case firewall does not care about
basically it cost each and every connection that is done by the client.
So that is one of the main disadvantages are basically we can use this bill or on any type of machine.
So in that case the firewall trust is in every connection that is done by the client.
So in our case the client is window.
So enough of that let's make our payload.
So I'll just say I want to use the 15 number.
Let's see you can really see over here some of the options and we're familiar with this all of the substance.
So the many over here is whole host and the airport.
So let's set this yellows to the IP address of this limousine.
So I'll just say host these I have to confirm first with this I have config.
So let's go over here and others say I have config and this will give us the IP address Let's type here
1 9 2 1 6 8.
So I have lost or basically have said the will host.
Now let's give the port.
So I want these 80 80 which is used by the web server.
So less into here.
And if you want to see the options or simply type options and you will see that now we have this yellow
list in the airport right here.
So next thing what I want to do is set some processes for it.
So the same processors.
And I'll just set one.
And now if you see the options and this is our last option so we have been doing this from the beginning
of this surveilled framework.
So this should not be any confusing for you.
So next thing what you need to do is will simply said Zenith red which is going to give us the payload.
So we do see what is the name so I'll just give men reversal or main reverse.
So this will be our name or I can also add this is yesterday.
Yes.
So I say this is the main reverse TTP as payload and we are going to inject this to the client.
So let's hit into now.
It will this do all of these encoding technique and it will this give us.
Now that is the executable is right over here in this var library will output compile in the name of
the reversal.
So let's go to that place.
So this navigate from here.
And in this case we have to go to the VAR library and veil and it is an output and it is on the comp..
So here there are so many payloads that we have been doing in the previous lectures.
But now in this case it is meant reverse.
Yes.
So it is right here.
So let me copy this first.
Was this main reverse is.
Yes.
Now let's put this into our website.
So let's go back to the VAR and our web server is inside this w w w as dismal.
And I want to just include into this file.
So list pasted down here.
And this is our payload in the web server.
So next thing what you need to do is run your party server.
So I have a lady running a party server if you want to run here then.
Did you see the terminal.
And basically if you want to run you have to first type service a party to start.
So this is the way to start the Europe party server and after you see it into a budget server is going
to run if you want to stop the server.
You can also do that is restart the server with these restart command.
So in my guess I'll just restart.
So a party server is restarted and we have this framework.
Basically this payload inside our web server.
So let's go now.
So before going over there and just downloading that pillar Let's listen.
That are basically let's listen to the port in here.
So let's open the new window a new terminal and let me just make this real big and we are going to use
the MSF console which will this have this handler and this handler is responsible for communicating
between these college Linux and the machine which in this case is a window so ready to give a time to
load.
And it is doing that.
It is the MIT exploit framework.
So first of all you have to use that exploit multi handler which is the module over here and let me
hit into the now we're inside this Mulder handler.
So if you want to see the substance you can see directly with these so absence and you can see here
that we don't have any payload options.
We don't have a local host and local board.
So what you need to do first is we have to set the payload.
So in our case the payload is going to be executed in the windows.
And it is based on this Scimitar operator free mode.
And after that you have to pass the name here.
So in our case it is reverse yesterday.
P.S. If we have use reverse to DP this voices reverses to be if we made the payload which is based on
reports DCP this type reports disappear over here.
But in our case it is reversed yesterday.
P.S. let me hit into.
So before that I want to show you something.
What if we just remove this and this a window and hit into then it is going to source zero.
That this payload is not valid.
So you have to this give you the proper name.
And after that are the seat into.
Now if you see absence again then this is going to give us the payload of some now and you can see the
payload right here.
We have this will host and yell port now.
So we have to now ascend here.
So this is set in the El host which is the limousine IP address.
And this type it over here.
And the next thing is your port.
And in this case it will be a TNT.
Let's make sure that everything is perfect and they could see.
Now we have this payload of Sun yellows which is this IP address of Caylee missing and you will see
that here is 80 80.
This is the port that Caylee went missing.
We'll listen to for all the incoming connection so incoming connection can be multiple client and multiple
Klein can communicate to this column was in.
So now what you need to do is this type exploit in order to get are basically in order to execute the
handler which will this listen to the incoming connection.
So let me just press exploit.
Now you could see we have started this reverse handler on this IP address which is this must entirely
address and it details the port that this machine is listening to.
So now let's go to our window machine here.
Endless open that is this web is of our Caylee missing.
So in this case it is 1 9 2 1 6 8 1 dot 2.
So this is the Caylee IP address.
So let me hit into and wait for a moment.
So this our is and we have to navigate inside the file because the file is inside this directory.
So I'll just hit enter now.
Then you could see that all the file over here.
So we want this man reverse.
Yes.
Piers let me download it and make sure it is the same.
And I'll just say it on now.
So now it will just give the information it is nothing that is it is also saying that this is not the
virus because if it was the virus then it has been already deleted.
But this is a simple masses and this message is given every time you install anything on the windows.
So we'll go to the more info.
We'll see it on anyway now I think we have run this.
Let's go back to the limousine.
You'll see we are now inside this meter decision.
That means we can now execute the command of these symmetric beta modules so if I hit enter you'll see.
Now we are inside these messages window 10.
You could see that is Windows 10.
And it is six to four gigabyte or basically 64 bit not a gigabyte.
So it is saying that it is a 64 bit muslin and you can see the Metro version over here.
And we have a now complete connection between these two machines.
So we have got those reverse cell and now lined machine is communicating with the column missing.
And it is done through this machine.
So there is no firewall inside here acting to just block the communication because because the firewall
is just asserting that communication or there is just trusting the communication because that is the
loophole over there and we just made use of that in order to get the reversal in line to communicate
to the server or in this case in the limousine.
And we get whole access to this computer now.
So you can now put any command like Ellis command or you can also see that these multiple command will
see in the next upcoming lecture.
So soon the next one.