Hack Like a Pro: How to Evade AV Software with Shellter « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!One key area on the minds of all hackers is how to evade security devices such as an intrusion detection system (IDS) or antivirus (AV) software. This is not an issue if you create your own zero-day exploit, orcapture someone else's zero-day. However, if you are using someone else's exploit or payload, such as one fromMetasploitorExploit-DB, the security devices are likely to detect it and spoil all your fun.Security software largely works by recognizing asignature of malicious software. If you can change the signature of your malware, payload, or shellcode, it will likely get past the AV software and other security devices.Don't Miss:Null Byte's Guides to Evading AV SoftwareI have written tutorials on usingVeil-EvasionandMetasploit's msfvenomto re-encode payloads to get past these devices, but no method is foolproof. The more options you have to re-encode your malware, the better chance you have of re-encoding malware to get past these devices.In this tutorial, we will be usingShellter. From my experience, it has proven more effective in re-encoding payloads to get past AV software than the other options.How Shellter WorksShellter is capable of re-encoding any native 32-bit standalone Windows application. Since we are trying to avoid AV detection, we need avoid anything that might look suspicious to AV software such as packed applications or applications that have more than one section containing executable code.Shellter is capable of taking any of these 32-bit Windows applications and embedding shellcode, either your custom payload or one available from such applications as Metasploit, in a way that is very often undetectable by AV software. Since you can use any 32-bit application, you can create almost an infinite number of signatures making it nearly impossible for AV software to detect.Step 1: Download & Install ShellterThe first step, of course, is to download and install Shellter. I will be running it on a Windows system, but Shellter can be run onKaliusingWine. I find that it is faster and easier to run Shellter in its native Windows environment. You can download Shellterhere.Step 2: Start ShellterNow that you have downloaded and installed Shellter, click on the executable in the Shellter directory. This should start the Shellter application like below.Step 3: Move a Windows Binary to the Shellter DirectoryTo test the effectiveness of Shellter at obfuscating the nature of a file, we will be using a well-known malicious file to AV software. And that would besbd.exe, aNetcatclone that has all the capabilities of Netcat, but also has the ability to encrypt the connection with AES.We will be embedding it with a Meterpreter payload from Metasploit. In essence, we will be taking a known 32-bit .exe file, embedding it with a known Meterpreter payload, and seeing whether AV software will detect either. I think that this is an excellent test of Shellter's capabilities as detection of either will trigger the AV software. Both will need to be obfuscated to bypass the AV scan.You can getsbd.exein the Windows binaries directory in Kali at:kali > cd /usr/share/windows-binarieskali > ls -lCopysdb.exeto the same directory as Shellter on the Windows system for simplicity.Step 4: Run ShellterNow let's go back to our Shellter application. EnterA(Auto) for the operation mode andN(no) for a version update. Since we just downloaded the current version, we don't need to update Shellter.Shellter will prompt you to enter the file that it is to re-encode. In our case, it issbd.exe. Remember, it only accepts 32-bit standalone applications.PE Target: sbd.exeIf your PE (portable executable) file is some place other than the Shellter directory, you will need to provide the absolute path here. Then just hit enter and Shellter begins its work.It eventually stops and, once again, prompts you for the type of payload you want to embed in the file. ChooseLfor "listed". Then, select1for the "meterpreter_reverse_tcp" payload.You will next be prompted for the LHOST (local) IP and the LPORT. Enter the IP of the local machine and any port you want. Then hit enter.Step 5: Embedding & Re-EncodingAfter a few minutes, Shellter completes the PE checksum and verification.When the verification is complete, your file is ready!Step 6: Test for DetectionNow that we have created the obfuscated shellcode, this is the moment of truth. We need to test to see whether AV software can detect it.On this system, I am usingthe Vipre AV software. I placed the re-encoded .exe file in a folder named "Exe folder" on my desktop, so let's scan just that folder with Vipre and see how well Shellter hid the malicious intent of that file.This scan only took a few seconds and Vipre does not detect any malicious files in the folder withsbd.exe. Success! Our malicious software is undetected by THIS AV software!This, of course, does not mean that all AV software will be unable to detect the malicious nature of our file. AV software from different publishers use different signatures and methods for detection. Some may be be able to detect the true nature of this file, but the key is to find an obfuscation technique that gets past the AV on the system you are targeting. This might require multiple attempts with different files, different encoding, and different payloads. Eventually, you are likely to find at least one combination that works.True hackers are nothing if not persistent.Step 7: Create Listener on KaliNow that we know the malicious shellcode is undetectable by at least Vipre, we can send the file to the target system. Before it is executed, we need to open a listener on our Kali system to connect.We can use Metasploit's multi-handler for this purpose. Start by opening the msfconsole by typing:kali > msfconsoleThen, use the multi-handler exploit and set the payload (windows/meterpreter/reverse_tcp), then set the local host (LHOST) and local port (LPORT) to the same as that embedded in your application above.Finally, typeexploitand the multi-handler will "catch" the connection from the payload when it is executed on the target, opening a Meterpreter shell unbeknownst to the AV software and the targeted user!Now with a Meterpreter prompt on the target system, we can use any of the Meterpretercommandsorscriptson that system to gain complete control.Shellter is just one more tool to evade AV software, but it may be the best. No one method works against all intrusion detection systems and antivirus software, but this one should be in your toolbox. We will continue to explore the capabilities of Shellter and other AV evasion software, so keep coming back, my tenderfoot hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 1Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureHow To:Make a Fully Undetected Backdoored ProgramHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 2 (Dissecting ClamAV)Best Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeNews:What to Expect from Null Byte in 2015Hack Like a Pro:How to Evade AV Detection with Veil-EvasionHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:Create an Undetectable Trojan Using a Domain NameHack Like a Pro:How to Use PowerSploit, Part 1 (Evading Antivirus Software)Advice from a Real Hacker:How to Know if You've Been HackedHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 3 (Creating a Malware Signature in ClamAV)How To:Record a playing stream in AV Voice Changer SoftwareHacking macOS:How to Create an Undetectable PayloadHack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:The Basics of XORingAdvice from a Real Hacker:How to Protect Yourself from Being HackedNews:Hackers Have 92% Success Rate Hacking Gmail on AndroidHow To:Add a radio station to Replay AVTypoGuy Explaining Anonymity:A Hackers MindsetHack Like a Pro:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterHow To:The Essential Skills to Becoming a Master HackerNews:Some Great Articles on Evading AV SoftwareLevitation Challenge:Evading ArrestNews:What does Pro Tools HD Native mean for you?