Is there a way to obfuscate an existing .exe file?
I'm in a situation where I cannot transfer the winPEAS.exe file (for PrivEsc purposes) on a Win10 machine because of the AV blocking the executable.
Any other solution will be appreciated.
-
What about encrypt the file and decrypt on the destination host?– camp0Oct 28, 2020 at 20:54
-
Zip or otherwise compress the file.– user10216038Oct 28, 2020 at 22:18
-
@camp0 Not so easy, AV detects it– 1afx0Oct 29, 2020 at 21:04
Add a comment
|
1 Answer
There are readily made obfuscated winPEAS executables released by Carlos Polop.
Also, you can try in-memory execution of winPEAS batch via PowerShell. This way, you will not be writing winPEAS to the disk. There might be a chance AV does not detect it
If all else fails, perhaps you might want to read into what winPEAS does and perform manual enumerations yourself.
