Hello everybody
and let us continue from where we previously stopped.
So, what we did is basically we ran this command, in the previous video, and we created our Windows
payload. Or, basically, our Windows reverse shell.
So what we want to do right now is, first of all, if you just want to deliver this to someone,
there are two things you need to do.
Basically, set up a listener on the same port that you specified in the payload.
And, of course, you need to have the same IP address as well.
And what you want to do next is basically just deliver the payload.
anyway you want. Over e-mail, over USB drive, over some line, or however you want to deliver it.
But before we do that, let us see how we can actually craft a little bit better payload.
It will not be much better.
The real antivirus bypass we will do in the next section.
Basically, where we will actually code our own tools, and actually add the binary in order to prevent antiviruses
from actually detecting our program.
But since this is a well known payload that everybody uses, it will be known to the antiviruses.
So, first of all, what you want to do is go to the Firefox, and there is a site, as I said in the previous
video, which is called VirusTotal, or something like that, which basically allows you...let
me just, just type in your Google search bar VirusTotal and it should be the first thing that pops up,
I believe.
As I said, it is the website that allows us to upload our files, and it will print out a list of how
many antiviruses detect that file as the virus.
But, be careful if you're creating a serious virus, or a serious payload, or something like that,
make sure to not actually use this website. Since every time you upload something to this website it
gets sent to the antivirus databases.
So, if you, for example, upload a virus that you created or coded which gets detected by like 2 percent
or 3 percent of antivirus, which is really, really good, in a few days or weeks it actually will be
detected by a lot more, since this website actually sends that value of that virus to the databases.
And then they update it, and then every other antivirus software will actually start detecting your program
as a virus as well. In case it is a virus, of course.
So what you want to do right here...
But, first of all, since the payload that we created is just a simple reverse TCP meterpreter
shell which has already been uploaded on this website a thousand times,
we can safely upload it since it will get detected by every antivirus, anyway.
So where we want to go is navigate to our root directory where we saved the file. So here it is, reverse.exe
Size is 7.2 kilabytes.
Then we basically double click on this file, or we can click on open, and it will say confirm file upload.
You have chosen the file named reverse.exe
Do we want to continue?
We click here on yes,
and it will basically upload the file for us.
It will scan it.
And what it will do is it will print out all of the antiviruses that detect and that do not attack this
program as a virus.
So we can already see that a lot of them detected it. Basically, out of 70, 44 detected it already.
Now, all of these that actually didn't detect it, let me just reload this page so it can print it out as well.
So we can see the final result is 45/71 antiviruses detected this as a virus.
So, if you scroll down to those who didn't really detect it as a virus, you will see that these are not
some of the, basically, these are not some of the more known antiviruses.
So these, basically, I don't know if they even get updated.
Some of these I have never even heard of.
Most known antiviruses are up,
and those are the ones that actually detected it. Such as BitDefender, Avast, which, actually, you need to
know that BitDefender is probably the best antivirus that you can get for free.
It detects a lot of viruses.
And, basically, it will be really hard to bypass this antivirus, as I will show you later on.
But, for example, Avast, which is I believe one of the most used ones in the world, is actually not that
hard to bypass.
So what we want to do, so let's check out the result.
So, 45/71.
So what we want to do right now...
First of all, we want to refresh this page, and let us see if we can lower that number even a little bit.
So, even two or three antiviruses will be good.
I mean it will not be good, but better something than nothing.
Right?
So let us actually run the same command that we ran before and create a second payload.
But before we do that, let us see our available, actually let me just change my directory, our available
encoders. So not payloads,
we want to go to the encoders. And since we created a 64 bit version of the meterpreter reverse TCP, we want
to go to x64. And as I said, there are not many for this,
so we can actually use this one for, example.
So let us change to the root directory once again.
And so we do not type the command.
Let me just find it.
OK,
so here it is.
And what we want to specify is -e, and then I believe /x64/, and then the name of the encoder.
I believe it is specified with -e and then after that -i for the number of iterations it
should actually pass.
So we will do specify 5 iterations,
I believe that is by default.
Now I hope this is the syntax. If it is not we will have to run the help command in order to see what
the correct syntax for this is. But, let's see what this will do.
Now if this does work...skipping invalid encoder.
So let me just see, maybe we do not need to specify the .Ruby file...
skipping invalid encoder.
So, let us see msfvenom
--help.
Well, let's see for the encoder. The encoder to use, use --list encoders to list. So, let us see...msfvenom
-c and I believe list, or something like that. So attempting to read payload from standard input. We do not want
that.
List encoders to list,
okay.
So what we want to type is msfvenvom --list encoders so we can see our available encoder.
OK.
So let us find the one that we want to use. Now it is this one.
So I didn't need to specify these forward slash at the beginning,
so that's why it gave us an error.
So let us run the same command once again.
Now let's rename this to reverse1.exe
so it actually differentiates it from the previous one, and I believe this is the command right
now. So, it will use this encoder and it will run through 5 iterations, and you will notice that the
file will be a little bit bigger than the previous reverse.exe file.
So here we can see that it actually ran through five iterations.
Now if you specify here more it will run through more. Basically, the more the better. But the more iterations
you use, the file will be bigger.
So we can see that the payload size is not anymore
510 bytes, it is right now 768 bytes. And we can see that if
I type here ls, our reverse1.exe is there.
So, we used the encoder and now let us see if it will get the same results as this file right here.
So this first file, which is the simplest one, got 45/71.
So, let us go back.
Just click on this icon right here which will lead you to the welcome page once again.
And what we want to do right here is basically choose file as in the previous file, and we want to select
the reverse1.exe
If I click open here it will ask us once again if I want to confirm,
so click here,
OK.
And it will upload the file, and let's see how many antiviruses
catch it now.
Now it'll still be a big number but I believe it should be smaller than 45,
since this is an available encoder in metasploit and all the other people use it as well.
So it is not that new of a process in order to create an undetectable payload.
So, let us see. From now on we can see 3/3 antiviruses detected it. Not really sure why
it goes this slow, it should go a little bit faster. Maybe it takes more time for antiviruses to detect it.
Not really sure why that this is really slow for now.
So, 5/8 for now on.
We know that there is around 70, or something like that, 71 anti-viruses that are in this in
this web site that actually scan the file that we upload.
So, let's hope for a better result than in the previous scan.
So for now 18/32 detected. As we can see, it is going.
It is still going. I believe that we will not go over 45.
So this should be a better result than in the previous scan. Which means that we were able to actually
bypass some of the anti viruses in this web site, which is good.
So better something than nothing.
For now it's 32.
Let's see how much this will grow,
so we can calculate the exact number of anti viruses that we were able to bypass.
So, 35/62.
Not really sure why this scan is taking so long.
But there is one thing that you might have noticed...let me just try to find it. Never mind.
I was trying to find the Avast antivirus.
I thought we actually were able to bypass it with this simple encoder, but we were not able to since
it is still detecting it as a virus.
So that's good for Avast,
but it's still not that good of an antivirus program.
Now I have on my PC both the Avast antivirus and the bitdefender antivirus
because I wanted to test something.
Basically, bitdefender is a lot better than Avast in my opinion.
Now you can use any you want, but as an experienced hacker, you would probably not want to use any
at all, since antiviruses only slow down your PC. And if you actually know what to click and what
not to click, you really do not need it on your PC.
For example, on my laptop I do not have antivirus at all.
So let's see how long this will take.
We can actually stop it right now.
I believe there are like 4 antiviruses left which basically leaves us, if all 4 are detected,
at 41 out of 70. Which is 4 antiviruses better than the previous scan, which is something,
right?
So we were able to actually bypass some of the antiviruses. As we can see right now, only 38 detected
out of 67.
Now the last time we had 70 antiviruses, but sometimes it puts more, sometimes it puts less.
What matters is that we were able to bypass some of them.
But let's see if we can make this number even smaller.
So what we want to do, first of all, we want to use the same file that we actually created,
so the reverse1.exe, and we want to use a tool that is called hex edit. It opens it as
a hex code.
And what you can do is change the values of it. So we can just open it, let me show you, hexeditor.
So, hexeditor and then the name of the file, which in our case is reverse1.exe. And what you will
see right here is basically our program in bytes.
So, be very careful.
I mean, you do not need to be careful since it takes like two seconds to create this payload.
But if you change just one byte that you shouldn't change, your program will not work.
Now, there are a few things that we know that we can change, which is basically this right here, which is this
program cannot be run in dos mode. So we can change that value since we know it is a string, and it doesn't
actually perform anything in the code.
It is more likely a comment, or something like that.
Now, why are we changing that?
Well, as I said, how antiviruses work,
basically, they have a huge database and there they have these signature values of all the viruses.
Now if you just simply change, for example, just one byte, it will be different than the virus
that they have in the database.
So just changing and switching up simple bytes in our whole program can make you bypass some of the
antiviruses.
So what you want to do is first navigate right here. You navigate with arrows as you can see right here.
And once you reach the bytes that actually correspond to this string, you can just type anything here.
As we can see while I type here,
if we change to the 8 or the D right now
it is changing the values of this string. So if I just go AA AA AA AA, and then DD, and then some random numbers,
you will see that the values right here change.
I accidentally typed W which you cannot use in bytes. Basically, you can only use a, b, c,
d, e, f and numbers 1-9 with 0.
So let us just use some of the random ones. So
just type right here.
Make sure not to pass the last letter since if you pass it, basically, you will enter a different part
the code which can actually make a program not run.
Now, this is not the only thing that we can change in this program, but from now on it will be good.
Now once we code our own programs I will show you what else you can change in order to bypass more anti
viruses.
But for now, let's see if I save this, so file name reverse1.exe, and if I close this.
So control + O to save, enter to select file name, and control + X to exit.
And now let's see once again if I open it, you will see this string is no longer there.
Now, let's try to upload it once again and see if we get even better results than the last time.
So, where we want to go, so go right here once again, choose the file, and we go to reverse1.exe. Open
it. We will reuse reverse1.exe since that is the file that we actually changed
in the hex editor. So open it.
It will ask us these standard questions. Do we want to upload it?
We say, yes.
And right now it will analyze the virus once again.
So last time I believe we got like 40 or 38,
so let's see if we can get less than 38 right now.
Now what I did right here where I changed that string is also a well-known thing to do,
so most of the hackers actually do that as well.
So it is not that big of a thing in order to
bypass some of the antiviruses. But, it should be good enough to bypass at least some of them,
or a few of them. But looking at this, we might actually not bypass any since it is already at 36.
We actually got more that detected it than in the previous scan.
So that's a little bit weird, but it happens.
So, some antiviruses work weird,
but some antiviruses don't work weird.
Let's see just how many antiviruses it will scan. If it scans like 70 we might be able to actually bypass
like one of them, since last time it only scanned like 68, or 67, or something like that.
But right now it only scanned 69 antiviruses, 39/69 detected it. Which is still
a bad number, but we actually were able to lower it from the first scan.
So those are just some of the simple things to do in order to bypass it.
Let us just wait for the scan to finish.
So 40/70, that is not that bad.
I mean it is still bad. But if you remember the first one, it was 45/70.
So we were able to bypass 5 antiviruses, and that is good enough if the target is using one of those
five.
So that will be about it for this tutorial on bypassing antiviruses.
Now the more advanced antivirus bypass we will do in the coding section. For now on, it is good to only
know these simple things.
It will get you only so far but it is still better than nothing.
And in the next video we will actually run this on our Windows 10 machine. We will run the payload that
we created.
So that will be it for this video and I hope I see you in the next one. Bye!