As you probably already know by now, msfvenom is a tool shipped with the
Metasploit framework which can be used to generate stages.
When using msfvenom,
you can pass in various parameters, such as the format, using the dash ‑f flag.
This will let you specify which format you want to use,
such as the exe format. By default, when using the exe format,
msfvenom will use a default executable file which is shipped with
Metasploit. As we will discover later on, using this default template
is a bad idea, because the vast majority of antivirus solutions will
detect it with ease since it is available on the internet and can be
analyzed to develop signatures.
We can, however, pass in a ‑x flag and specify a custom executable file,
which will avoid getting flagged by antivirus. Mileage may vary, however,
because the exe format is noisy and makes use of hard‑coded shellcode
stubs which allocate read/write/execute memory sections at runtime and
copies the stager into it before executing it.
As we have previously discussed when covering API monitoring,
making use of these frequently abused APIs is a bad idea. To
generate a stager using the exe format, we can use the following
command. When we run this command,
the default executable template will be used, and the
stager will be embedded into it.
Let's generate a stager using this format and upload it to VirusTotal.
As you can see, this sample was detected by 43 antivirus scanners, nearly
twice as many detections as our custom shellcode runner,
which only had 24,
even though the same stager shellcode was embedded inside the file.
This is quite interesting, since the stager which we embedded inside
our shellcode runner is the same as the one which is embedded inside
the default executable template by msfvenom.
This can be explained by uploading the executable template to
VirusTotal without embedding a stager into it.
As you can see, this file was flagged by 40 antivirus
scanners, which proves that some scanners have signatures
for the file, but not the actual.
stager.
This default executable template can be avoided using the ‑x
parameter when generating a stager with msfvenom.
I chose to use the 7‑Zip executable file as a template.
One of the reasons I chose this file is because it is not digitally signed.
If you specify a template which has a digital signature,
msfvenom will break the signature when embedding the stager into it,
and may be flagged by some antivirus scanners.
If we upload this file to VirusTotal,
we can see that we now only have 20 out of 69 antivirus scanners
which are flagging the file. You may recall that our custom
shellcode runner was flagged by 24 scanners.
This difference is interesting, since the stager shellcode
embedded inside both file is identical.
The only difference is the executable file in which the stage was embedded.
If you look at this from the point of view of a malware analyst,
if you were to analyze the shellcode runner and the back
door to the 7‑Zip executable files,
you would notice that one file imports very little
functionality from the operating system.
This is a characteristic which is regularly observed in
malware which resolves its APIs at runtime.
As we will discuss later on in the course,
some antivirus solutions make use of artificial intelligence in an
attempt to automate a malware analyst's job by attempting to
classify files based on their characteristics.