Hiding a meterpreter in a MSN installer using Iexpress.

[sickness]

This is a quick tutorial about how to create an encoded meterpreter and then hide it into an installer using a Microsoft utility called "iexpress".

Blip.tv: Sickness - Hiding meterpreter in MSN installer
Blog: Hiding meterpreter using Iexpress. « ihasomgsecurityskills

Hope you like it

[espreto]

Good tutorial! The introduction is great!

Regards,

[mandrakesecurity]

Nice great Tutorial....

Regards

[Bobba Fett]

Very cool tutorial, Thanks for sahring Sickness!

[sickness]

Well glad you like it guys

[RexBudman]

In regards to the LHOST, if I need to use the installer on various machines it would require me to not only find out the IP of the target again but also remake a new payload+installer?

Or is there a method on using a generic LHOST so as to have a universal installer.

I am still in the process of learning Metasploid and the Unleashed module is quite good but long, so I am not quite there yet.

[purehate]

No, In this situation the LHOST is the attackers IP. The MSN installer could be executed on any machine because all it does is connect back to the attackers machine with a reverse shell.

[Zoro2010]

Thank You my friend

[jackdanielz]

Thank you!!! A killing good tut!

[sickness]

I'm glad you guys like the tutorial