1

Since January I observed that meterpreter_reverse_https was detected by AV even with the enablestageencoding set to true. I tried to change the signature of the meterpreter and set the handlersslcert to true, without success. After this, I set the SSL option of web_delivery to true but still have the same problem. So, I switched to reverse_tcp_rc4 which worked perfectly until this weekend. Now it is also detected by Symantec.

One point which is important, when I take the source code of the meterpreter in PSH and execute directly in the powershell console, it works! I think that ips detects the signature of the communication between the victim and the web delivery server.

Can some one please explain to me how to resolve the problem? I really need it because I have a meterpreter session which launches periodically with this method.

9
  • AVs are evolutioning too. You must look for other kind of enconding. Did you tried msfvenom using different encodings? You can use multi-encode, like they do here. Maybe if the AV is too sensitive can't be done with msfvenom. The msfvenom is a "n00b" method in the end. Feb 20, 2017 at 17:37
  • Thanks for replying. I am not speaking about evad av. This can be done by using poweshell. I am speaking about how to evad ips... Feb 20, 2017 at 17:46
  • It's a little unclear to me whether you are getting caught because of the Metasploit traffic over the wire or because of some AV or HIDS-like detection of meterpreter on the test host. But if it is because of the traffic, best I think I could suggest would be to look up the wiki documentation on using Metasploit with "paranoid mode" settings, which covers things like doing reverse https with a pinned certificate (preferably a not-self-signed one) to thwart intercepting proxies. But, well, fundamentally at this point Metasploit's basic C2 habits are very well known and sometimes easy to spot. Feb 20, 2017 at 18:58
  • Official documentation on Metasploit/meterpreter "Paranoid Mode" settings: github.com/rapid7/metasploit-framework/wiki/… Feb 20, 2017 at 19:00
  • 1
    sorry for the whole rotomonde, i was a bit tired. If you want extra stealth, use Veil-Evasion, that works wonders against detection veil-framework.com/framework/veil-evasion In my experience, just injecting the meterpreter with powershell with unicorn will also work github.com/trustedsec/unicorn.
    – J.A.K.
    Feb 26, 2017 at 23:26

2 Answers 2

1

I find where is the problem, it's the web delivery module of metasploit. I think that IPS are triggering some HTTP headers of this module. I bypassed the problem by using multi handler module combine whith a usal apache2 server and it's work! ( you don't need to follow paranoid steps)

If some one know what IPS is exactly triggering and how we can bypass it using web delivery module. Please inform me.

Thanks to all

1
  • Could be a lot of things. Start by having a valid SSL certificate from LetsEncrypt or another trusted CA. A lot of IPSes flag the self signed certificates. Further, use the stageless meterpreter.
    – void_in
    Mar 1, 2017 at 10:11
0

Mohammad,

Most AV's are not checking powershell processes for meterpreter sessions at the moment.

I would encourage you to try generating meterpreter droppers from veil-framework as their source code .py, editing the variables, generating an exe with pyinstaller, then trying that.

Happy Hunting.

1
  • Hello, i am not speaking about the dynamic detection but about IPS... Feb 27, 2017 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .