Hello everybody and welcome back.
And right now what I want to show you is how you can actually bypass some of the antivirus with our
river shell.
Now let's see.
Basically our backdoor that we decoded so go to your reverse virtual directory.
As you can see right here I've got my reverse shell that be why it is the same code that we used in
the backdoor coding section as we can see right here.
Everything is the same.
We got all of our available options right here.
Our shell function revile the sun and so on and so on.
What we want to do right now.
First of all let me tell you this thing.
Basically adding functions to your reverse shell that actually do nothing.
For example I mean not that they literally don't do anything.
They don't do anything useful for the universe shell functions such as adding numbers such as multiplication
division and so on and so on just basically some random functions here and there can help you actually
prevent some of the anti viruses from detecting your reverse shell.
Now might be asking how does he do that.
Well basically what antivirus is do is they simply compared the code to their database and if the code
matches two or if the hash value matches to the virus in their database they will detect it as a virus.
But if you change a code a little bit at some functions they don't do anything here and there.
Switch up the codes which up some of the bytes you have a good chance of bypassing most of the antivirus
is now the best ones.
Of course it will be really hard to bypass such as big defender But at a certain point I created basically
a backdoor that actually is detected by anti any antivirus.
Then they'd start getting used and basically now like three out of 70 antivirus is detected or something
like that.
It doesn't even matter is it is still a really small number if you create a backdoor that is actually
only detected by three out of 70 antivirus is you have a good chance at bypassing most of the target
systems.
So if you want to you can just add simple functions then don't do anything right here or basically anywhere
else and you can use them somewhere in your programs.
The good example will be dysfunction right here.
So this is a function that doesn't have anything to do with our program I just sat there.
It can be useful to bypass some of the anti viruses.
So that is one thing you can do.
Another thing you can do is first of all compile the program.
So we use wine road to not wine to drive seed python script spy installer and then you use the reverse
of the P Why no console.
And what was the other option.
I forgot.
So no console and one file you compile the program and then you open the DOT EMC version of the file
or basically your backdoor into the hex editor and you try to switch as many bytes as you can without
actually making the reverse shall not work.
So basically I will show you right now as soon as this compiles right here it is compiling currently.
Then we will open our backdoor in the hex editor and we will actually try to switch some of the values.
So right here if I go to my this directory where my reverse shell dot the axes and I simply just open
it in the hex editor.
So hex editor and then reverse shell that the AKC.
This is the command that you have to specify in order to open it in the hex edit Also click here enter
and right here.
We get our file in basically in the bytes.
So here we have the hexadecimal values of all of our instructions.
Most of these functions are basically in assembly.
So for example let me just find it right here.
This is a simple easy structure right here.
Every excel file that is running Windows will have the string right here.
This is the most common string to actually changing all the viruses in order to bypass some of the anti
viruses.
But it is so known that I don't even think it works anymore since everyone who actually watches any
videos knows that in order to actually change some values they can change this value and the and the
actual binary of the dot the XY file will be different than the one in the database.
So you can start out by actually changing this.
So make sure you're at the same line because if you actually switch are byte that you shouldn't have
switched your entire program will not work.
So make sure that you are in the same line I believe I am in the same line same one line lower so I
can go just at this byte this by 54 I believe it is 40.
So if I change it as you can see you can only use a b c d e f and numbers 139.
So you can just spam all the numbers until you actually change the entire string.
So loops I went to the on right here.
I just want to go back right here.
Let me just find out how I can exit this.
So right here.
OK.
So you just continue to change this.
So change it to anything you actually want and then make sure to change the lower part as well so
just spam random numbers and letters and then endorsement.
Make sure to stop at E and you successfully switched the.
This program cannot be on endorsement string weighted the random bytes but this is not the only thing
that you can actually change.
There are other strings here as well.
This part right here cannot be changed so don't make don't change b e d text right here.
You can't change it so you can go down here and let me just find the line.
Not really sure if it is this one five five.
It is this one so OK you just go right here make sure to skip the first bite and start from here as
we can see I changed the TS successfully just by typing here a can also change this.
This basically C 1 2 and d is the last digit or part of my last string.
You can change so we also change the text part.
Let us go down here also changed the data part so just find data right here.
Let me just find it.
This line I believe or the upper line it is this one go to the data
or it is actually this one let me just check it.
OK so here is the data again change it don't make sure to not pass the last letter.
So this is about it and you change a few string right here.
Make sure to not change this part of the code since we do not know what it is we changed a few strings
so these two strings we changed.
We also changed this part right here and we are good to go.
Right now you can actually control how to save this fundamental right legal shell and then exit.
And now let us plug in our U.S. B drive in order to see if we correctly changed the hex values of some
bytes and see if it will still be able to run.
Now if it doesn't if it can't find if it prints out some error that means we actually change the byte
in our hex editor that we shouldn't have changed.
So let's see more reversion to the media routes and then Kelly life now we can actually delete all of
this so clips.
We'll see what else do we need to delete We can delete the desktop to extend the screenshot.
And right now we can run our server.
Let us unplug the U.S. B Drive.
Now let us right now try to run our reverse shell
so go right here find your reverse shell.
Here it is and then I run it right here as we can see it did print out any error so it means that this
actually works if we get the shell back it works 100 percent since we didn't get any error and we are
able to execute commands on target b c so and with this that you actually did with the hex editor and
with adding some of the functions that make no sense.
Basically you can bypass most of the antivirus is.
So for example if you just type your code in my IP config you can see we have a working shell.
We changed bytes but make sure to only change the bytes that are actually a string.
If you change ad buys that actually run the code it will not work.
So that will be about it for the bypassing some of the antivirus is now the more you use this and the
more people actually use these backdoor it will get uploaded on the virus total and once you get up
so uploaded on the virus total basically this show will also be flagged as virus by a..
By any antivirus company so make sure to always switch it up.
Change some functions change.
Different code basically.
That will get you the best results you can.
Now also one thing the pie installer library in Python is also flank flagged by most of the anti viruses
but not my mouse.
But like big defender flags pine star as an ant as a virus.
Basically if you were to for example create a simple program.
So let me show you.
If I just open my big defender it put my big defender to be to run as we can see right now it is your
device is not the base fed to activate protection please retry.
OK so your device is now protected.
Not really sure about that.
There was no let me show you if I nano if we nano actually test that by users should be in Python and
we just print less print Hello World we just print this which obviously this isn't a virus.
But the big defender antivirus will actually flag it is a virus just because it used by installing the
PI installer in order to compile.
Now it is only I believe big defender and F secure all the other anti viruses will not flag this program
as a virus so you will be good to go.
In any case that target has anything except B defender and I believe AV secure or something like that.
So let us see if this will actually get flagged as an antivirus as a virus.
Pardon me.
So we find the command for the compilation.
We just find it right here and we compile it does not be like so let's let this compile shouldn't take
too long.
Basically our program is a single line that will print how a world
and right now if we plug in our use be try once again.
Copy the file to their
now we go to the test mode test not to exceed to media.
Ruth and Kelly live unplug this.
We don't have to run anything right here.
We only need to print the products of our.
Let me just find it where it is not.
This
our main defender or its right here is running.
So let us run.
Right now that's not the AKC windows cannot access the specified device path or file.
You may not have the appropriate permission to access the item.
Which basically means it already deleted the item because it's likely that the app is a virus as you
will see soon enough I believe right here it'll pop up threat blocked or something like that.
So let us see how long that will take.
It should basically show us any second that it actually deleted that file as we can see if we tried
to run this.
We cannot run it
just close this close this as well
and here it is on access item was deleted thread name tags dot the exit so by installer basically gets
flagged as an app as a virus by basically anything you called will be flagged as a virus if compiled
with by installer.
If he was a defender or secure so that would be about it for this video.
I hope you enjoyed it and I will see you in the next one.
Bye.