1

Is anyone willing to share techniques for creating a Windows Meterpreter payload that can bypass AV? I've noticed that Defender does a very good job these days at detecting it. Some of the techniques I've used and will share here. The particular method I'm trying to use is creating an executable Meterpreter payload using msfvenom. Transferring it to Windows 10, and then on msfconsole running exploit/multi/handler with reverse shell stager. Double-click on Windows and establish meterpreter.

I've tried:

  1. Used msfvenom with Shikata Ga Nai encoder. Detected.
  2. Created a Python Meterpreter payload. Not Detected. However, doesn't have the same functionality as Windows meterpreter payload.
  3. Tried using Golang with meterpreter payload created with msfvenom, and upx. Not detected, but exe has an exception.
  • So, you want to bypass Defender specifically? And you don't want a language-based version, but a native Windows version of meterpreter? – schroeder Nov 15 '19 at 22:59
  • Hey, sorry for the delay. Appreciate the response. Yes I'm currently researching Defender specifically. I'm not sure I understand the second question of language-based versus native windows. Yes, I'm trying to create a meterpreter .exe that runs on Windows 10 x64, where you just double-click and it runs a reverse shell stager to an instance of msfconsole running /exploit/multi/handler. I've tried cross-compiling on Linux with go and using msvenom to build a windows meterpreter. But after running upx, it doesn't work. I've also tried using python meterpreter from py2exe, and this works. – Robert Nov 18 '19 at 14:57
0

One of the way that i have found working is to generate shellcode from MSF venom remove bad chars from it.Then encrypting the shellcode and put it into a own written C program and when executing the code decrypt the shellcode and execute the shellcode using WIN API create process.You will bypass all static AV analysis.But you still probably,might get caught on dynamic analysis with defender.At the end of the day i have found MSF to be very noisy when it comes to AV

  • 1
    Thanks for sharing. Yes, based on my research Defender has a sandbox that it runs dynamic analysis. I can't verify this 100% for obvious reasons. I'll keep working at this. Thanks again. – Robert Nov 18 '19 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.