Hi folks, Today’s post we going to see yet another framework developed Veil team. Veil-Pillage is a modular post-exploitation framework and a part of the Veil framework released last month. It’s made the life of penetration tester so easy and it subsumes Veil-Catapult and implements a ton more features.
First things first, installation. The best way to pull down the latest version of the Veil-Framework is to first clone down the Veil master project from github:
#git clone https://github.com/Veil-Framework/Veil.git
Those whose new to Veil Framework, follow by previous posts about Veil-Framework to get more information.
Then change into the Veil directory and run the update.sh script which will pull down all the project submodules and run all appropriate setups:
#cd Veil
#./update.sh
If you’re running this on Kali linux, its only officially supported platform at this point, everything should pull down and install correctly. Change into the Veil-Pillage directory and launch ./Veil-Pillage.py. You’ll then be presented with the main menu:
#./Veil-Pillage.py
Here you can see the number of modules currently loaded, as well as the common commands available. Now for some basic usage. The first thing you’ll want to do is to give Pillage a set of targets and a set of credentials. This can be done in several ways. You can set targets with a space or comma separated list, an existing target text file, or just with “set targets” for an interactive menu.
>set targets 192.168.31.2
>set creds sathish:sam
You may use metasploit to smb bruteforce the target to get the username and password.
Credentials work similarly, with set creds [domain]/user:password or set creds [domain]/user:LM:NTLM. Specifying a creddump file with set creds file.txt works as well.
After you have your target and credential sets worked out, you need to choose a module to execute. List will list all of the modules available. You can select a module with “use #” where # is the number from the list command, or use action/module/… which allows you to tab-complete the loaded module path:
> use <Tab Key>
For this Tutorial I going to use Management/enable_rdp module to Enable remote desktop connection on the target machine.
This will drop you into the module menu, where you will see a description of the module, required options, and module commands.
The most common option you’ll see across most modules is “trigger_method”, which controls how the specified action is executed on the target machine. “wmis” will utilize pth-wmis from the passing-the-hash toolkit which doesn’t create a service and is preferable in most situations, “winexe” will utilize pth-winexe and creates a service as well as dropping a binary to disk, and Impacket’s “smbexec” which creates a service but doesn’t drop a binary. What action you choose will depend on the specific situation you’re encountering, but wmis is usually set as the default.
If you want to set a module specific option across ALL modules, setg will set a specific option globally. This command can also be used from the main menu.
Once you have everything set to your liking, the run command will start execution. You’ll be prompted to make sure you want to execute the module, and then everything will kick off. After execution is completed, you’ll get the standard output menu. Status files are output to /root/veil-output/pillage/MODULE/<timestamp>.out. Typing yes will display the output file for the module:
The output file will tell you exactly what action was performed on what host with what credentials. Every module that has any kind of reciprocal cleanup action will automatically produce a cleanup file that’s output to /root/veil-output/pillage/MODULE/<timestamp>.pc . You can run this file with “cleanup <file>.pc” from the main menu:
There’s also a global cleanup file that keeps track of all cleanup actions for all modules. If you type cleanup on the main menu, it will prompt you to use this global file, which will then cleanup all affected hosts and then reset the cleanup file itself.
Whenever you exit Veil-Pillage, through exit, ctrl+c, or if there is some error in execution, the program state is automatically saved to pillage.state. When you start Pillage back up, it will ask you if you want to restore this state file. If you do, your credential and target sets are restored, module options set to their modified values, and you’re thrown right back into the module menu you were operating in.
Below image is the Remote Desktop of the target machine, likewise you can use different modules available in Veil-Pillage.
LINUX DIGEST 