Automating the Process
Now that we have learned how to manually evade an AV via PowerShell,
let’s explore how to automate AV evasion payloads.
Shellter is a dynamic shellcode injection tool
and one of the most popular free tools capable of bypassing antivirus software.
It uses a number of novel and advanced techniques to backdoor a valid
and non-malicious executable file with a malicious shellcode payload.
While the details of the techniques Shellter
uses are beyond the scope of this Topic,
it essentially performs a thorough analysis of the target PE file
and the execution paths.
It then determines where it can inject our shellcode
without relying on traditional injection techniques
that are easily caught by AV engines.
Those include changing of PE file section permissions,
creating new sections, etc.
Finally, Shellter attempts to use the existing PE Import Address Table entries
to locate functions that will be used for the memory allocation,
transfer, and execution of our payload.
With a little bit of theory behind us,
let’s attempt to bypass our current Avira antivirus software using Shellter.
Running the shellter command in the local Kali terminal
will provide us with a new console running under wine.
Shellter can run in either Auto or Manual mode.
In Manual mode, the tool will launch the PE we want to use for injection
and allow us to manipulate it on a more granular level.
For the purposes of this example however,
we will run Shellter in Auto mode by selecting A at the prompt.
Next, we must select a target PE.
Shellter will analyze and alter the execution flow
to inject and execute our payload.
For this example, we’ll use the Windows 32-bit trial executable installer
for the popular music player Spotify as our target PE.
To start, we’ll need to tell Shellter the Spotify installer location
on our local Kali machine.
Before analyzing and altering the original PE in any way,
Shellter will first create a backup of the file.
As soon as Shellter finds a suitable place to inject our payload,
it will ask us if we want to enable Stealth Mode,
which will attempt to restore the execution flow
of the PE after our payload has been executed.
Let’s enable Stealth Mode as we would like the Spotify installer
to behave normally in order to avoid any suspicion.
At this point, we are presented with the list of available payloads.
These include popular selections such as Meterpreter,
but Shellter also supports custom payloads.
At this stage, we shouldn’t worry too much about the differences
between standard and Meterpreter payloads
as we’re going to learn about those in an upcoming Topic.
In order to test Shellter’s bypass capabilities,
we’ll use the Meterpreter version of the reverse shell payload
that Avira detected at the beginning of this Topic.
After submitting L for listed payloads, we’ll select the first payload.
We are then presented with the default options from Metasploit,
such as the reverse shell host and port,
which we should fill with our local Kali’s IP and listening port.
With all of the parameters set,
Shellter will inject the payload into the Spotify installer
and attempt to reach the first instruction of the payload.
Now that the test has succeeded,
we’ll prepare for transferring the malicious PE file to our Windows client.
Next we’ll configure a listener on our Kali machine
to interact with the Meterpreter payload.
Next, we will transfer the backdoored Spotify installer
over to the target Windows 11 client
and launch an Avira Quick Scan as we did previously.
Avira’s Quick Scan performs a check inside every user’s common folder,
including the Desktop folder.
Since Shellter obfuscates both the payload
as well as the payload decoder before injecting them into the PE,
Avira’s signature-based scan runs cleanly.
It does not consider the binary malicious.
Once we execute the file,
we are presented with the default Spotify installation window,
which under normal circumstances will download
the Spotify package over the internet.
Because our VM has no internet connection,
the Spotify installer will hang indefinitely.
Reviewing our multi/handler window,
it shows that we successfully received a Meterpreter shell.
We’ve launched an interactive Windows shell session
and verified that we actually landed on the target machine as the offsec user.
Awesome!
We managed to evade antivirus detections by injecting a malicious payload
into an otherwise legitimate program.
This foundational example can be even further expanded
and tailored on a case-by-case basis
during real phishing engagements.