Although we have already bypassed Windows Defender with our
PowerShell‑based stager, let's now go through a demo in which I will
apply some anti‑emulation techniques to our custom stager,
which we wrote in C++ previously in an attempt to
bypass Windows Defender's emulator.
As you can see,
I have already added the code designed to exhaust the
emulator at the start of our main function.
This will ensure that before the emulator is able to
check what our stager is doing,
it will have to emulate millions of CPU instructions.
I chose to write the function in assembly.
We can take a look at the code in the exhaustion.asm file.
As you can see, I move a random high value into the rcx
register, which will serve as a loop counter.
I then enter the loop, which will execute four bogus instructions,
decrement the RCX register and check if the RCX register is null.
If it isn't null, the jump is taken back up to the start of our loop.
This will keep occurring until the RCX counter is equal to
null, at which point the function will return.
The function is ran 10 times, followed by the actual stager code.
We can go ahead and set up a Metasploit handler and compile and run this code.
After a few seconds, you will notice that we get an
antivirus alert. Interestingly, however,
the process is not terminated. And if we go back to our Metasploit handler,
we will find that we do indeed have a fully‑functional Meterpreter session
despite the antivirus alert. The reason we did get an antivirus alert will
be explained in later modules where we further discuss obfuscating the
payload when it gets sent over the network.