MSM venom is a really good tool when you're trying to generate payloads.
It has a whole lot of features that allow you to play with many things in payloads.
However, antivirus software companies constantly update their databases and detection mechanisms.
As I said before, they can use artificial intelligence and machine learning, cloud computing and many
other technologies to improve their products because they're trying to sell them and make a profit.
So that means M7 and payloads are pretty much always detected.
I'd say, you know, 85 percent of the time mostly will say they're detected by these improved technologies.
But I want to show you something.
So open Windows 10.
And go to HTP tend tend to dot one one 8000.
To view our malware folder from a browser now the three files that we created in the previous videos
are here, so let's download them in order to click on normal that you sexy and say, well, Windows
defender to Texas as a virus.
It detects it even when I downloaded, but not when I launch.
See, that's a big improvement.
So the next file download encoded Donnie XY and say so.
As you can see, while downloading Defendor scans a file case that's detected as well as have a look
at the third file, click it to download and say that defenders also scanning the file.
OK, unfortunately it's also detected as a virus.
So then let's go back to Colin.
What do you think we should do at the moment?
So the point I'm trying to make here is that antivirus software and payload generators are in competition.
So today your payload can successfully execute on your targets and you can evade the antivirus software.
But a few days go by and the same payload may be prevented to be executed and detected as malware.
So then you need to find a new custom payload generator.
So at the time I record this cause I'm looking for a custom payload generator and I found one on GitHub
and you can use this one or find another one for yourself.
All righty, then.
Let me show you first how to install this custom generator.
So I'm going to use another COLLY instance for a fresh install.
So open up your browser and go to this GitHub address.
Fantham Evasion is the name of this PAVOL Generator.
So I'll download it as a zip file.
Then open file explorer and.
Go to the download directory.
And it.
And you can cut her copy the extracted folder to the Iranian folder on the desktop.
So here are the files in the phantom folder.
Close it up and open your terminal.
So change the directory to fantham folder like this.
Then type S.H. Mod plus X Phantom evasion that he wanted to make the file run by the current user and
then type Python Phantom Evasion Dot PWI to start the installation.
So the insulation will take a really long time, but be patient and as always, I'm not going to record
the whole insulation.
You just wait for it.
And we're back after the insulation, you will have this green, which means you installed it perfectly.
Now I'm going to go back to my colleague.
And go to Fantham folder.
Then run.
Python, fantham, evasion, dopy, why?
Now you can explore all the modules, there are many, many very useful, but what I'm looking for is
a stealthy Windows payload, so type one and it will be stagers.
So type to.
Windows 10 boxes, 64 bit, so type to.
And then these are the payloads that phantom evasion provides for it, so I'm going to choose the fourth
one.
It's 64 interpretor reverse TCP.
So this has a short but informative warning.
And it also shows the required payload for the handler, so I'll press enter to continue.
Provide host, which is then 10 to 11.
Allport is four for three.
Then file name Fantham, I think is a good name.
Now it's good to add multiple processes, behaviors, so type Y.
Insert two decoy processes.
And striping the executable will also help, so type why?
It will sign the executable if you want.
So, yeah, I do.
So type Y.
So it'll spoof Microsoft CERT and fill with no pat information.
And then finally, the payload is generated, so.
The file is in the phantom invasion directory and open up a new tab at least.
And as you're looking at what I'm looking at, you will see the phantom that actually is right here.
All right, move Phantom Daddy exi to route desktop malware.
So I moved here because I already have run the Python server from this folder, so now I'll go to the
MSF council, said payload to Windows XP 64 interpretor reverse TCP.
Said host to ten point ten to one one.
And said airport to 443.
So options to check, make sure everything's OK.
And if there's no problem, then exploit Jay.
OK, so now open Windows 10 and open the download page for our executables, refresh the page.
Now download The Phantom that sexy and save it.
Windows Defender is scanning the file.
And just like that, it does not detect anything.
So now open the download folder.
And double click the final to launch it.
Now, you might think you are detected, but no.
Click more info and you'll see why, because Microsoft doesn't know the publisher of this executable.
So it just warns us, which nobody really cares about, that, you know, it warns even for very well
known applications, so you can run it anyway.
Most people do.
Then go to Cali and open MSF console tab.
So here's a tip, because you use the decoy processes and some other techniques apply to the payload
as well, it's going to connect back, but it's going to take a bit to just wait for it.
Believe me, the session will open.
OK, it didn't prove me wrong.
There it is, the session has opened.
Hit enter and type section.
So now you can interact with Section eight.
Type get Eweida.
Cesan fo.
And congratulations, you have now evaded the Windows defender on Windows 10 and got an interpreter
session.
Well done.