2

Is anyone willing to share techniques for creating a Windows Meterpreter payload that can bypass AV? I've noticed that Defender does a very good job these days at detecting it. Some of the techniques I've used and will share here. The particular method I'm trying to use is creating an executable Meterpreter payload using msfvenom. Transferring it to Windows 10, and then on msfconsole running exploit/multi/handler with reverse shell stager. Double-click on Windows and establish meterpreter.

I've tried:

  1. Used msfvenom with Shikata Ga Nai encoder. Detected.
  2. Created a Python Meterpreter payload. Not Detected. However, doesn't have the same functionality as Windows meterpreter payload.
  3. Tried using Golang with meterpreter payload created with msfvenom, and upx. Not detected, but exe has an exception.
2
  • So, you want to bypass Defender specifically? And you don't want a language-based version, but a native Windows version of meterpreter?
    – schroeder
    Nov 15, 2019 at 22:59
  • 1
    Hey, sorry for the delay. Appreciate the response. Yes I'm currently researching Defender specifically. I'm not sure I understand the second question of language-based versus native windows. Yes, I'm trying to create a meterpreter .exe that runs on Windows 10 x64, where you just double-click and it runs a reverse shell stager to an instance of msfconsole running /exploit/multi/handler. I've tried cross-compiling on Linux with go and using msvenom to build a windows meterpreter. But after running upx, it doesn't work. I've also tried using python meterpreter from py2exe, and this works.
    – Robert
    Nov 18, 2019 at 14:57

1 Answer 1

1

One way I found that works, is to:

  • generate shellcode from msfvenom,
  • then remove bad chars from it i.e. -b '\x00',
  • then encrypt the shellcode,
  • and put it into a self-written C program, which will decrypt and execute the shellcode, via CreateProcess

You will bypass all static AV analysis. But you still probably might get caught on dynamic analysis with Windows Defender.

1
  • 1
    Thanks for sharing. Yes, based on my research Defender has a sandbox that it runs dynamic analysis. I can't verify this 100% for obvious reasons. I'll keep working at this. Thanks again.
    – Robert
    Nov 18, 2019 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .