Evading AntiVirus using Veil

This is a tutorial on how to evade AV using a new tool called Veil. It is not just a tool, It is a framework like metasploit dedicated to AV evasion.

Here is the website of Veil Framework - https://www.veil-framework.com/

Installation

The best way to get Veil is by getting a copy of Kali linux. But this tool was added to kali recently, so if your copy of kali linux dont have veil installed, then you can use the following commands to install it in Kali:

apt-get update && apt-get install veil

OR 

You can gitclone it on to your PC, for this type:

git clone https://github.com/Veil-Framework/Veil-Evasion.git

ok now we can have fun with the tool


Using Veil


Type ¨veil¨ into the terminal.



You can use the ¨list¨ command to see the available payloads. The payloads are listed according to its success rate.



Here we are going to use the “powershell/VirtualAlloc”. To use this type ¨use 9¨. 



Here we will just use the default values, so simple type ¨generate" and press enter.

Then you can choose to use Metasploit’s standard msvenom shellcode or choose your own. We will just choose the default, msfvenom.

type 1 and enter



next we have to choose the type of shell. just press enter



next enter the ip address of the host machine (the one you are using)



then you have to enter the local port that you will be using, enter 4000 here



You will then be asked to enter any MSVenom options that you want to use, we won’t be using any, so just press enter to bypass them.

And that is it! Veil will then generate our shellcode with the options that we chose.
Then we need to give our created file a name. here, some social engineering is required. Your file name should attract the victim.



Our file will be stored in the “/usr/share/veil/output/source/” directory.
Just take the created .bat file and send it to our target. When it is run, it will try to connect out to our machine.
We will now need to start a handler listener to accept the connection.

Getting a Remote Shell

To create the remote handler, we will be using Metasploit.

Start the Metasploit Framework from the menu or terminal (mfsconsole).
Now set up the multi/handler using the following screen:



Be sure to put in the IP address for your machine and the port that you entered into Veil. They must match exactly.

Metasploit will then start the handler and wait for a connection:



Now we just need the victim to run the file that we sent them.



On the Windows 7 machine, if the file is executed, we will see this on our Kali system:




A reverse shell session!

Then if we type “shell”, we see that we do in fact have a complete remote shell:

~Phr3ak