Creating a (Almost) Fully Undetectable EXE Using Kali & GCC « Null Byte :: WonderHowTo

First, I want to give credit to the author where I first found how to do this:Astr0baby's Blog. This article was dated, so I took the script on his page and reworked it to make it work today. (I also included the way to make it hide the cmd line popup.)RequirementsKali (or another Linux distro)Metasploit (Framework, Express, or Pro)GCC (I use the Windows version on MinGW on Wine)A basic understanding of how to set up Metasploit's multi/handlerNote: If you do not have the Windows version of MinGW installed,this Postcan show you how I do it.OverviewIt's no secret that AV sandboxes our executables, verifies their signatures, and uses other methods to determine whether our "legit" file is malicious or not. (Norton goes a step further and makes sure it doesn't connect to an unknown source without permission.) So how do we get around this?In this how-to, I'm going to show you my method for AV evasion that uses the msfpayload and msfencode commands to create an executable file. Then we will run the code through some custom commands and "filler" variables to make it less detectable to AV.Be aware: Metasploit is doing away with msfpayload and msfencode in the coming months, somsfvenomis going to be used instead. If you can modify this process to incorporate msfvenom, please get with me about it. I would love to keep this updated.PreparationThere are three things you need to do before you run the commands following.Update Kali:sudo apt-get updateCreate a "ShellCode" folder in the metasploit root folder:mkdir /usr/share/metasploit-framework/ShellCodeCreate an "out" folder in the root folder:mkdir /root/outI made the executable in the/root/outfolder to keep things neat when creating multiple files. This is optional, but will require some editing of the commands if you choose not to place the finished .exe files there.The CommandsBelow is the code for creating the executable. This was originally just something for me to play with, so it may look a bit messy. Change the IP, port, enumber (encoder iterations), and seed variables as much or as little as you need to fit your scenario.Download on GitHubBe sure that the ShellCode folder is empty prior to running this.Starting the ListenerJust in case you're reading this and have never started a Metasploit multi/handler module, here's how you do it:msfconsoleuse exploit/multi/handlerset LHOST xx.xxx.xxx.xxset LPORT 4444#OPTIONALset ExitOnSession falseexploit -jBe sure your LHOST is the local IP address, even if you are making the executable connect to an external IP.Final ThoughtsAs stated before, this is a rework of an external article. I have made it into something more usable to me and also added the hidden command window strings that Astr0baby left out on his blog.I have found this to be effective on multiple Windows OS's using most antivirus softwares and it bypasses it 9/10 times. Be aware that Norton Antivirus will recognize the file ONLY after it's executed and block a "meterpreter/reverse_tcp" attack. One way I've (kind of) gotten around this is to usemeterpreter/reverse_httpsin the executable and listener. It still asks the user if they want to allow the connection, but doesn't call it malicious.So, give it a shot. If you like it, I'm glad I could help. If you have ways to improve it, PM me. I would love to improve on this!UPDATE: Now in Proper BASH Format.Ok. so with some of you having problems getting this to work, I decided to make this a script rather Copy/Paste.The new repo is here:Download on GitHubI hope this helps!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Bypass Antivirus Using Powershell and Metasploit (Kali Tutorial)How To:Create an Undetectable Trojan Using a Domain NameHow To:Hide a Virus Inside of a Fake PictureHack Like a Pro:How to Evade AV Software with ShellterHow To:Hack Any Windows 7/8/10 User Password Without Logging InHack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hacking Windows 10:How to Create an Undetectable Payload, Part 2 (Concealing the Payload)Hack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHow To:Run an VNC Server on Win7How To:Hack Windows Administrator Password with Out SAMHow To:Use MinGW to Compile Windows Exploits on Kali LinuxHow To:Build and Install Kali Nethunter (The New Version) On a Supported Android Device Running Android 6.0.1News:A WORD TO THE WISE ABOUT REMOVING INTERNET EXPLORERHow To:Use Cygwin to Run Linux Apps on WindowsDrive-By Hacking:How to Root a Windows Box by Walking Past It