Let's now go through a demo where we will be evading Windows Defender
on the endpoint, as well as ClamAV on the network.
We will be using the custom stager, which we have
been working with during the course.
If you have been following along in the course, at this point,
you should be quite familiar with the custom stager, which we wrote in C++
throughout the various modules, which we covered previously.
You may recall that despite the fact that we were able to partially
bypass Windows Defender in a previous module,
it did still cause an alert when the payload was sent back to the stager.
Let's see if encoding the payload will make our tradecraft more evasive.
I have already configured the proxy server on our victim system, which will
ensure that all HTTP traffic will get sent to our Squid proxy,
which in turn will make use of the ICAP protocol and the open source CanAV
antivirus to scan HTTP traffic for malicious content.
I have also enabled Windows Defender on the endpoint.
If we now switch to our Kali machine,
you will notice that I have already started the Metasploit handler.
I have set the enablestagingcoding option to true to ensure our payloads and
extensions are not sent over the network and obfuscated.
I have once again chosen the zutto_dekiru encoder.
You may notice that I also set the autoloadstdapi option to false. This will
change the Meterpreter initialization process slightly.
I have found that it can help evade heuristic detections in some
cases. We can now go back to our stager and compile it.
Once compiled,
we can go ahead and execute it and hope for the best or the
worst, depending on the point of view.
As you can see,
Windows Defender did not appear to detect our stager and did
not trigger an alert as it did previously.
Our stager did not crash either,
which would've been the case if the payload had been blocked by the Squid proxy
and ClanAV. If we go ahead and go to our Metasploit handler,
you will notice that we did indeed receive a connection from the
stager and that the payload was sent back encoded.
We can now manually complete the initialization by loading the stdapi extension.
At this point, we can start interacting with our
Meterpreter session. As you can see,
it appears to be fully functional, and we have successfully evaded
the antivirus, as well as the perimeter defenses.