Hack Like a Pro: How Antivirus Software Works & How to Evade It, Pt. 2 (Dissecting ClamAV) « Null Byte :: WonderHowTo

Welcome back, my novice hackers!One of the most common questions that Null Byte readers ask is: "How can I evade detection by antivirus software on the target?" I have already talked abouthow AV software works, but to obtain a deeper understanding, what better way is there than opening up and dissecting some AV software?For the remainder ofthis series, we will be dissecting the most widely used, open-source, multi-platform AV software in the world,ClamAV.Just a quick side note before we begin: when I use the term antivirus, you can substitute anti-malware. I prefer the term anti-malware as viruses are a subset of malware, but the industry and the public still use the term antivirus, so I will use them synonymously. Please don't be confused.About ClamAVClamAV is an open-source (GNU public license) project that was purchased by Sourcefire in 2007, the same company that purchasedSnort. When Sourcefire was purchased by Cisco in 2013, both Snort and ClamAV became a part of Cisco, the networking giant.As detailedon their blog:"The ClamAV detection engine is multifaceted—heuristics, support for numerous archivers (ZIP, RAR, OLE, etc.), tons of unpacking support (UPX,PEtite,NSPack, etc.), and several different content inspection engines."MRG did a third-party evaluation of Immunet Protect (uses ClamAV as one of its engines) where it outscored 15 other leading AV vendors and was the ONLY product that had a 100% detection rate."ClamAV is just as effective as commercial antivirus software, and is widely utilized to protect email gateway systems, though, generally not consumer level systems. ClamAV did recently develop a Windows version, so its acceptance at the consumer level is likely to improve.The beauty of working with ClamAV is that it is open source, so we can open it up and look inside to see and understand how it works. By doing this, we will have a better understanding of how all AV software works, and therefore can better devise strategies to evade it. This is not to say thatallAV software works the same, but they do work similarly.Inthis series, we will be examining the structure and operation of ClamAV. We will also look at its malware signatures, as well as develop our own malware signatures based upon some of the malware we use here on Null Byte to learn about hacking.Step 1: Fire Up KaliThe first step, as usual, is to fire upKaliand open a terminal.Step 2: Download ClamAVNext we have to download and install ClamAV on our Kali Linux system. There are multiple ways you can download ClamAV. The first, and probably the simplest, is to use the APTITUDE package manager:kali > apt-get install clamav clamav-freshclamOr, you can browse tothe ClamAV websiteand download it. Just make certain you download the Debian Linux version as Kali is built on Debian.Finally, you can clone it directly from the Git repository at:kali > git clonehttp://git.clamav.net/clamav.devel.gitThis is the method that I would advise you to use here for our purposes, as it installs the developer version of ClamAV.Once ClamAV is downloaded, navigate to it's directory by typing:kali > cd clam-develThen, let's look inside the directory to see what files and directories ClamAV installed.kali > ls -lStep 3: Configure & Make ClamAVIf you cloned the developer version of ClamAV, you will need to configure and make it. To configure ClamAV, use:kali > ./configureTomakeClamAV, use these two commands:kali > makekali > make installBe patient, these steps can take awhile. I also recommend that you runldconfigbefore proceeding any further:kali > ldconfigStep 4: Download the Virus/Malware SignaturesNow that we have ClamAV installed and configured, let's get the virus signatures. ClamAV stores these signatures in compressed files namedmain.cvdanddaily.cvd. The main.cvd is a database of known virus signatures, while the daily.cvd is the "daily" updates to the virus signatures (actually, ClamAV updates signatures 4x per day).You download the main.cvd usingwgetby typing:kali > wgethttp://database.clamav.net/main.cvdAnd then the daily updates of malware signatures at:kali > wgethttp://database.clamav.net/daily.cvdDetection Databases in ClamAVClamAV maintains a number of databases of malware that it uses to compare the files it is examining. These include:MD5 hashes of known malicious binaries (.hdb)MD5 hashes of PE sections (.mdb)Hexadecimal signatures (.ndb)Archive metadata signatures (.zmd or .rmd)Whitelist of known good files (.fp)Step 5: Examine ClamAV SignaturesThe signatures in ClamAV are compressed binary files. If you want to view a virus signature, you must first uncompress the file. To do this, ClamAV comes with a special tool to view its signature files, namedsigtool, which stands for "signature tool," presumably.Navigate to the sigtool directory within ClamAV and type:kali > ./sigtoolThis displays the help file for sigtool. It is this tool that we will be using throughout this exploration of ClamAV. You can see some of the switches for this tool in the screenshot above.Step 6: Unpack the SignaturesThere are two signature files,main.cvdanddaily.cvd. The first being the primary database of signatures, the latter being the daily updates of signatures. Let's unpack them now with sigtool and take a look. We will use the-uswitch forunpack.kali > sigtool -u main.cvdkali > sigtool -u daily.cvdAfter unpacking these signatures, we can see many more files in the ClamAV database directory. These are the uncompressed signatures.Step 7: View the Signature FilesNext, let's take a look at some of the signature files. We can use the Linux commandmoreto display the contents of thedaily.ndbfile. The daily.ndb file is the hexadecimal representation of the signatures. This means that the signature name will be in ASCII, but the signature itself will be in hex.As you can see in the screenshot above, the name of the signature (circled in red) is in ASCII (WIN.Trojan.LoluandWin.Trojan.Vobfus), but the rest of the signature is in hex. In the next tutorial, we will convert that signature to ASCII, then look at the signature language of ClamAV and decipher what the signature is looking for.A Final NoteI do not recommend that you activate or run ClamAV on your Kali system, since nearly everything we use is known malware. ClamAV will identify your tools as malware and try to quarantine them, hence making your Kali a mess. If you have followed my instructions here, ClamAV is not activated and the daemon is not running—it should not interfere with your hacking platform.Keep coming back, my novice hackers, as we explore the inner workings of AV software!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 3 (Creating a Malware Signature in ClamAV)Hacking macOS:How to Create an Undetectable PayloadHack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHow To:Use MSFconsole's Generate Command to Obfuscate Payloads & Evade Antivirus DetectionBest Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 1Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:Remove the Palladium Pro rogue malware from your computerHow To:Anti-Virus in Kali LinuxHack Like a Pro:How to Evade AV Software with ShellterHow To:Remove Antivirus Pro from your computer with SpyhunterHow To:Remove AntiVirus Pro from your computerHow To:Watch This Sunday's 2013 Pro Bowl Football Game OnlineHack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)News:Samsung Preinstalls McAfee Bloatware on Your S8 & It's Neither Great nor FreeHacking Windows 10:How to Break into Somebody's Computer Without a Password (Exploiting the System)Advice from a Real Hacker:How to Know if You've Been HackedHow To:The Definitive Guide to Android MalwareHack Like a Pro:How to Use PowerSploit, Part 1 (Evading Antivirus Software)News:What to Expect from Null Byte in 2015Hack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHow To:Android's Built-In Scanner Only Catches 15% of Malicious Apps—Protect Yourself with One of These Better AlternativesHack Like a Pro:How to Read & Write Snort Rules to Evade an NIDS (Network Intrusion Detection System)News:What does Pro Tools HD Native mean for you?How To:Scan for Viruses in Windows Using a Linux Live CD/USBLockdown:The InfoSecurity Guide to Securing Your Computer, Part INews:2,000 FREE Scrabble Apps (iOS) from EA on Facebook & Twitter — ENDS TODAY!WTI:The Hangover Pt. 2How To:Keep Stroke Patients Active at Home w/ Wii FitLevitation Challenge:Evading ArrestNews:Oscar Week '11 Predictions with Mike 'The Greek' - Pt. 03The Film Lab:Interview - Jacob Medjuck Pt. 02News:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateWindows Security:Software LevelNews:Oscar Week '11 Predictions with Mike 'The Greek' - Pt. 04News:Oscar Week '11 Predictions with Mike 'The Greek' - Pt. 04News:Oscar Week '11 Predictions with Mike 'The Greek' - Pt. 01News:Oscar Week '11 Predictions with Mike 'The Greek' - Pt. 02News:Oscar Week '11 Predictions with Mike 'The Greek' - Pt. 01