Hack Like a Pro: How to Kill and Disable Antivirus Software on a Remote PC « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!In some of my past articles, I've shown numerous ways of embedding a listener/rootkit on a remote system, includingbuffer overflowsof the operating system, getting the victim to click on a link to ourmalicious website, and sending a maliciousMicrosoft OfficeandAdobe Acrobatfile.In each case, we've embedded a listener/rootkit that gives us control over the system. Metasploit has a powerful listener called Meterpreter that enables us to control the system, send more commands, pivot from the victim to other systems, elevate our privileges, and many other things, as we will see.My next few posts will focus on how to use the Meterpreter in various powerful ways. Today, we will focus on how to use the Meterpreter to disable the antivirus protection on our victim system, which is more advanced than simplybypassing the antivirus program, as I wrote about last time.Disabling is necessary because the next time the system is scanned by the victim's antivirus software, it's likely to detect our listener and disable it, so we need to take preemptive action to disable it before it can disable us.So...fire upMetasploitand let's get hacking!Step 1: Getting StartedI'm assuming you have already embedded your Meterpreter listener by one of the many methods I've outlined in my earlier posts, and that you have a Meterpreter prompt as it appears in the screenshot below.Before we can begin to kill the AV software, we need to escalate our privileges.Usually, when we embed a listener on the victim's system, the listener will only have the privileges of the user who provided us with a gateway to their system by clicking on themalicious website,Office doc,Abobe PDF, etc.That user most often has limited rights or privileges to the system. Unlimited rights to do anything on the system is held by the administrator or system administrator (or sysadmin for short).We need to escalate our privileges from the user to sysadmin to have our way with this computer.Step 2: Checking the UserBefore we start the process of escalation, let's check what user we are logged in as. Type:meterpreter > getuidThis will return the ID of the user we are logged in as. If we are anything but the sysadmin, we'll need to escalate to kill the antivirus software.Step 3: Escalate PrivilegesMetasploit and its Meterpreter make it simple to escalate privileges to the sysadmin. Simply typegetsystemat the Meterpreter prompt.meterpreter > getsystemNotice that Metasploit responds with "...got system (with technique 1)". Metasploit has multiple methods to escalate privileges and it tries each of them out until one works.In our case, it was successful with technique 1.Step 4: Check That We Are SysadminNow that Metasploit has told us that it has escalated our privileges to sysadmin, let's make sure. Type:meterpreter > getuidAs you can see in my screenshot above, the victim responds withNT AUTHORITY\SYSTEM, the syadmin user!Congratulations! You can now have your way this victim.Step 5: Kill the AntiVirus SoftwareNow that we have unlimited rights to this system, let's kill the antivirus software. Metasploit has a Ruby script calledkillav.rb. We simply run that script from the Meterpreter prompt and it will kill the system's antivirus software.Make certain to start the script with the keywordrun. Type:meterpreter > run killav.rbNotice from the screenshot above that the killav.rb script not only killed the antivirus process, but also the open command prompt.Now that we have killed the antivirus process, we can remain hidden within their system and do as we please with little or no chance of being detected.In upcoming blogs, we will explore more adventures with the power of our embedded listener/rootkit with sysadmin privileges. There is no limit what we can do now!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Disable Anti Virus Services After Got Meterpreter Session on Remote PC.Best Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHow To:Remove the Palladium Pro rogue malware from your computerHacking macOS:How to Create an Undetectable PayloadHack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureHow To:Remove Personal Antivirus from your Windows PCHow To:Android's Built-In Scanner Only Catches 15% of Malicious Apps—Protect Yourself with One of These Better AlternativesHow To:Remove AntiVirus LiveHow To:Protect your PC by disabling Remote DesktopHow To:Remove Advanced Virus Remover spyware from your computerNews:Apple Releases iOS 13.3.1 for iPhone, Fixes Security Bug in Mail AppHow To:Use the USB Rubber Ducky to Disable Antivirus Software & Install RansomwareHow To:Remove Antivirus Pro from your computer with SpyhunterHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Remove AntiVirus Pro from your computerHow To:3 Reasons You Still Need a Good Antivirus App on AndroidHack Like a Pro:How to Remotely Record & Listen to the Microphone on Anyone's ComputerNews:Epson to Launch Moverio Assist as Easier to Deploy Smartglasses Remote Assistance ToolHow To:Remove the MS Removal Tool malware from your PCHow To:The Safest Way to Disable ALL Bloatware on Your Galaxy S10How To:Turn Your Android Phone into a Universal Remote Control with These Cool AppsHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHacking Windows 10:How to Break into Somebody's Computer Without a Password (Exploiting the System)Hack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHow To:Simulate a RAT on Your Network with ShinoBOTLockdown:The InfoSecurity Guide to Securing Your Computer, Part INews:VARIOUS WINDOWS ISSUES RESOLVED BELOW...News:WINDOWS 7 (FIX TWEAK, REPAIR, CONJOIN SHELLS ETC...)News:Jailbreak your PS3!News:... A Few Cool FreewarezZz ...News:In Just a Clik, Turn Your Smartphone into a YouTube Remote for Any Web DisplayHow To:Remove System Tool Malware (System Tool Antivirus) On Windows PCsLockdown:The InfoSecurity Guide to Securing Your Computer, Part IIDrive-By Hacking:How to Root a Windows Box by Walking Past ItHow To:Get the "Kill Box" Achievement in Call of Duty: Modern Warfare 3How To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop It