Let's now discuss an alternative format,
which also ships with the Metasploit framework. The exe‑only format can be
used by passing the ‑f flag and the exe‑only parameter.
Once again, if no alternative executable file is provided by using the ‑x flag,
msfvenom will use the default templates,
which should be avoided at all costs.
Instead of using a small stub of shellcode,
which allocates memory and moves the stager into the memory at runtime,
the exe‑only format simply places the shellcode at the
entry point of the executable file,
which means that no calls to VirtualAlloc are performed, and we do not
have any hardcoded shellcode in the executable file.
Currently, we actually do have hardcoded shellcode, which
could easily be detected by antivirus since we have not
encoded or encrypted our stager.
Let's now attempt to embed a stager inside the 7‑Zip executable
file as we did previously, but this time using the exe‑only
format. As you can see, this time,
only 16 scanners were able to detect our stager.
You may recall that 20 scanners had detected the same stager in the
same executable file when using the exe format.
This demonstrates how the exe‑only format is more
evasive than its exe counterpart.