We discussed in previous modules that encoders and encryptors
can be used to hide our shell code on disk.
Things are not so straightforward in memory because we have to decode or
decrypt stages and payloads in memory before executing them.
We can use a different approach to get around this issue by modifying
the actual code which will be executed in memory.
Evading in‑memory signatures can be a time‑consuming process.
My suggestion would be to identify strings,
constants,
exports, and any hard‑coded shell code used inside the payload or
extensions, which are unlikely to be altered by compiler‑specific
settings, and focus your effort on those artifacts in your code
refactoring process. You will need to clone the Meterpreter payload
project from GitHub and set up a build environment.
A good way to identify signature candidates is to take a look at the
payload and extensions using tools such as PeStudio,
which will help you identify blacklisted strings and imports.
You can then go ahead and attempt to remove those artifacts using various
techniques, which we will take a look at during the demo.
Another option you might want to take is to
automate the code refactoring process.
This will be more complex and time consuming at first,
but can be interesting on the long run.
You can, of course, also make manual changes to the code,
which is how we will be doing it during the demo.
Another technique we can leverage is to identify forks of the
Meterpreter GitHub repository which have already been refactored and
obfuscated in an attempt to make it more evasive.
Finally,
we can attempt to reverse engineer the solutions we are trying to bypass,
which is definitely not the most generic approach.