0

Is there a way to obfuscate an existing .exe file?

I'm in a situation where I cannot transfer the winPEAS.exe file (for PrivEsc purposes) on a Win10 machine because of the AV blocking the executable.

Any other solution will be appreciated.

3
  • What about encrypt the file and decrypt on the destination host?
    – camp0
    Oct 28 '20 at 20:54
  • Zip or otherwise compress the file. Oct 28 '20 at 22:18
  • @camp0 Not so easy, AV detects it
    – 1afx0
    Oct 29 '20 at 21:04
1

There are readily made obfuscated winPEAS executables released by Carlos Polop.

If those are detected and blocked by AV as well, I would suggest firing up a SMB server and execute your winPEAS from there. I'm pretty sure the AV will not detect it.

Also, you can try in-memory execution of winPEAS batch via PowerShell. This way, you will not be writing winPEAS to the disk. There might be a chance AV does not detect it

If all else fails, perhaps you might want to read into what winPEAS does and perform manual enumerations yourself.

0

You can use packers (UPX) or msfvenom to encode the exe.

If it's still detected by AV you can try to create your custom encoded executable by adding a new section to the executable an writing your own encoding/decoding routine.

2
  • Does msfvenom encode an existing exe or does it compile an exe from code? I'm pretty sure it does only the latter.
    – schroeder
    Nov 4 '20 at 11:52
  • I think that it can also encode an existing exe if we consider it as a PAYLOAD (as proposed in the answer for the question: security.stackexchange.com/questions/133042/…).
    – St0rm
    Nov 4 '20 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.