Let's now recap what you've learned so far.
We started off taking a look at how Metasploit's
Meterpreter stages and payloads work.
I walked you through the techniques used by the stager to
resolve APIs and communicate with the handler.
We also covered how the handler patches the payload's DOS header before sending
it back to the stager so that it can be reflectively loaded.
We also covered reflective DLL injection,
a technique used by the payload during its initialization.
Next, we covered antivirus and endpoint security solutions.
I demonstrated how many of these solutions work by breaking them
up into various components and explaining how they can be
leveraged to detect malicious activity.
Finally,
we went through several modules focused on evading endpoint security
solutions using Metasploit's Meterpreter stages and payloads.
I demonstrated how detection can be evaded on disk through the use of
encoders and custom templates, as well as custom stagers.
We also covered how machine learning can be tricked by making slight
changes to the files' appearance by loading modules and resolving their
imports at runtime. We then covered defense evasion at runtime using
various anti‑emulation and anti‑sandboxing techniques, as well as
unhooking APIs. I also showed you how you can bypass AMSI using a variety
of different techniques.
I then demonstrated how to evade detection in memory, and showed you how
the Meterpreter codebase can be customized to hide various artifacts,
which may be leveraged by antivirus and EDR solutions to detect
Meterpreter payloads and extensions in memory.
Finally, we covered defense evasion over the network.
I demonstrated how perimeter defenses can be defeated
by encoding payloads and extensions.
I also gave you some insight into how you can ensure you
keep a low profile on the network.