If we choose to use the reverse_https stages and payloads,
a default certificate will be used by the Metasploit handler.
This certificate is sent over the network during the SSL handshake,
similar to how using the default executable template was being flagged
by antivirus when uploaded to VirusTotal.
Using this default certificate is likely to get flagged on
the network or even on the endpoint.
You may recall that antivirus and EDR solutions sometimes make use of network
drivers to inspect network packets. To get around this issue,
we can choose to use a reverse_http stager instead of HTTPS,
which will avoid the SSL handshake altogether.
This is not a big deal, because communication between the
Meterpreter payload and the Metasploit handler is already
encrypted at the application level.
The reason for encrypting the data at the application
level is because SSL interception can be performed by
security solutions to inspect data.
If on the other hand we do want to use HTTPS stages and payloads,
you can of course request a valid certificate from a trusted
public certificate authority for a domain which you own and bind
it to your Metasploit handler.
Ja3 and Ja3s fingerprints can theoretically be used to detect stages
and payloads which make use of the HTTPS protocol.
Ja3 hashes can be calculated by capturing the SSL handshake
and extracting various artifacts such as the TLS version and
supported ciphers, to name a few.
All these artifacts are concatenated and hashed using the MD5 hashing algorithm.
These hashes are commonly referred to as fingerprints, which
can be linked to a specific client or server, which in our case
relate to the Meterpreter stager, payload, and Metasploit handler.
Once again, this can be avoided by using the HTTP stages and payloads instead.
The more you are able to blend in with existing network traffic,
the less likely you are to get caught by security
solutions and perimeter defenses.
There are many techniques which you can leverage to do this.
One effective way to blend in is to use a technique
commonly referred to as domain fronting.
This technique is possible because of how content delivery networks
route HTTP traffic and perform SSL encryption.
This technique lets us establish an SSL tunnel with one domain, and
piggyback the SSL tunnel to access a different domain.
This can be very useful to trick perimeter defenses into thinking you're
connecting to a trusted domain classified accordingly,
even though you're actually leveraging the SSL tunnel to connect to a
different domain which may not be as trustworthy.
Another technique which can help blend in with surrounding
network traffic is to configure realistic user‑agent and
header information into your stages, payloads, and handlers.
Some security solutions might alert on traffic which makes
use of abnormal or rare user agents,
for example. Stages can be configured to authenticate over the network.
This might also be required in some cases by certain proxy servers.
Finally, Metasploit provides stageless payloads.
The advantage of using these stageless payloads is that you no
longer need to send over the payload and extension,
which will improve stealth over the network.
This is, however,
a double‑edged sword, because although you will increase stealth on the network,
it will be harder to conceal on disk and will result in a much larger file,
which can be an issue in some circumstances.
Many things can go wrong on the network.
It's always a good idea to have a plan B.
When we write our own custom stages,
we can add a fallback to a different communication protocol,
such as DNS tunneling, for example.
Fallback communication channels may be routed differently and might
evade detection even though the former did not.