Veil v2.0 : Towards a True Framework

Repo Location: https://github.com/Veil-Framework/Veil-Evasion

Team Veil is proud to announce the release of Veil v2.0.  This drastically reworked version of the Veil AV-evasion framework incorporates a new structure, a slew of new features, and a variety of new payloads:

New Structure

  • Veil has moved from a single flat file towards a truly modular framework:
    • Payload modules dropped into ./modules/payloads/[language] are loaded into the framework automatically
    • Common reusable functions are stored in various files in ./modules/common/*
    • Source/compiled files are output by default to ./output/source/ and ./output/compiled/
    • ./config/update.py is executed automatically on first run, producing a common configuration file at ./config/veil.py, which can be edited manually
    • External tools used by payloads are stored in ./tools/
    • ./doc/* contains pydoc generated documentation for the framework
  • A tutorial describing how to develop payload modules is forthcoming.

New features

  • Veil’s menus and interface have been redesigned for increased usability.
  • One of the common requests for Veil was the inclusion of additional msfvenom shellcode payloads. To incorporate this, we built in automatic crawling of the metasploit /windows/* payload tree and the extraction of necessary payload parameters. The payloads should tab complete within the shellcode selection menu, in msfvenom windows/PAYLOAD format.
  • Tab completion has also been added in a variety of places around the framework, including most menus, LHOST for IP completion, and LPORT for 4444 completion. Try it out!
  • A new python ‘crypter’ named ‘pyherion’ (inspired by Null Security’s Hyperion) has been introduced, which encapsulates python payload files in an AES/base64 encoded wrapper that dynamically decodes/decrypts the python code in memory and executes it. A standalone version has also been introduced in ./tools/pyherion.py . A short post explaining its implementation details will be forthcoming.
  • Command line switches have been implemented for almost all options. Type ./Veil.py -h for details.

New payloads

  • C payloads – Using both a void pointer reference and direct injection into memory with VirrtualAlloc calls
  • Powershell – VirtualAlloc injection, MSF-psexec formatted resource file generation, and download/execution of a secondary payload.
  • C# payloads – VirtualAlloc and base64 obfuscated payloads have been introduced, along with C# .exe compilation.
  • Native payloads – hyperion and pescrambler