Instructor: Welcome back.
In this video, I want to talk about bypassing antivirus,
and this video is not going to be that practical.
You might be asking why?
Well, I could show you a way to bypass antivirus right here
in this video, but chances are that will not work
once you watch the video
in a month or two months or in a year.
A fully undetectable payload is not something
that lasts forever,
especially when I show it inside of something
like a course that many people are going to watch.
So instead, I would like to tell you
about few different techniques that you can apply
to generate an undetectable payload.
So how it all goes.
Well, many people start using a payload
and sooner or later antiviruses start detecting it
as a malicious program.
That could be due to people using it a lot,
or it could be that some of you uploaded it
to the virus total and it got sent
to all the antivirus vendors.
However, let me talk about the rules
that you can apply to bypass antivirus.
Now, the best thing that you can do to create a fully
undetectable payload is to code your own programs
or your own payloads.
For example, I coded the back door in C language
and when I scanned it, it was fully undetectable
no antivirus was able to flag it as a malicious program.
Then I created a course on creating that backdoor
and soon enough that backdoor was no longer fully
undetectable and was getting caught by most antiviruses.
it was FUD at first because it was a new payload
with a new code or a new source code.
Once you have a unique and different code
and you compile it, that code becomes a different binary
which makes it undetectable
until many people start using it.
So just remember
best way to create undetectable payload is to
code it yourself in a unique way.
However, this requires you to know a programming language
and for many, this will present a problem.
There are other ways as well.
So one of them is to update your pay tools if possible
and you also want to keep an eye for the tools that are new
or the tools that just came out.
Why? Well, they might have different payloads that aren't
widely used yet, so that is another way that you can do it.
You can also try creating different types of payloads.
Try out PowerShell payloads, python payloads
C sharp payloads.
All of them have higher chances of of not getting detected.
Another cool thing you can do once you generate your payload
is to change its binary a little bit.
Let me show you what they mean.
We can do this by using hacks editor.
So let us just real quick
generate a normal Windows Meter, reverse DCP payload.
Let us go with L host
L port, and let's specify file to be EXC
and output to be Shell.dxc.
Okay, great.
This is a regular Meter payload.
It gets detected by almost every antivirus in the world.
It is matter of fact, the most known payload
in the world for malicious activities.
But what you can do, if I show you right here
the MD5sum hash of this payload
you will see it is this one.
So some antiviruses work by getting the hash
of the executable and storing it in their database.
Then once you change this hash and you change this hash
by changing the binary of the program
this hash becomes different
and it is no longer inside of the databases of antiviruses.
Let me show you a simple way to change it.
So what we can do is we can type hexeditor
which is a tool that is already installed in Cal Linux
and we can specify the payload name.
This will open the payload's binary
and here we want to change some of the binary.
Just be careful.
Don't change something that you don't know what it is
because even changing a single bite right here could result
in a program not working
if that bite was essential for the program to run.
Now, there are few things right here
that we can change for sure, and that is this right here.
This is a program that cannot be run in dos mode.
Now what is this?
Well, this is a string.
It is nothing really too important for the program
so we can go navigate with our arrows
and we can change this string.
As you can see, when I type hex decimal right here
it changes the output inside of this right column.
So if I just type some random hex decimal numbers
and letters to change this.
And once you change some of it, this will change colors
and if I go all the way down
there is another thing that we can change
and that is this text right here.
This is also something that we can change.
Just make sure you navigate to the correct line.
In my case, I believe it is this one.
The text should start with seven four
and we can change it to whatever we want.
Just once again, make sure you don't go
over that word because changing, for example
this bite right here will result in a program to not work.
Okay, once you finish this, you can control, oh, save this.
Now, if you remember how the MD5 hash started
before we did this.
If I do it again
It is completely different.
I believe it started
with something like eight three or I don't even remember
but right now it is completely different.
We manage to change the hash
of this executable by changing its binary, and this
even though for many antiviruses
this is something that will not bypass them.
Even if you managed to bypass two
or three additional antiviruses, that is good.
You did a slight change.
So this won't do much of a difference.
But everything you can change, you should
since you gain higher chances of bypassing antivirus
as well as if you have, for example, the source code
of a payload, what you can do is you can try to
change it yourself a little bit.
Just add some random functions
or make your program not do anything
for first minute or two after running.
All of these things can help you bypass antivirus.
Okay, So these are just some of the ways that you can apply.
Next time you create a payload.
Just remember one thing, whatever type
of payload you create to be undetectable
it won't last long.
So this is something you will have to experiment
with over and over again.
In the next video, we're going to see one
of the ways we can mask our payload to look
like a different program.
See you there.