Let us talk about detection and the process of avoiding it.
The reality is it has become more and more difficult to avoid detection,
at least 100% of avoidance.
So they set out on a mission to stop it, and they did, for the most part.
But like any defense,
there's going to be flaws, and that's what we try to focus on.
We know there's going to be challenges in front of us, but
we also know there are going to be flaws.
So what we do is we try to discover those flaws. So, evasion.
We have to modify our code that makes up the payload in such
a way that it's not detected.
One of these is accomplished by encoding. We encode the
payload. When we encode our payload,
we actually scramble or obfuscate it in such a way to try to avoid a
detection by a signature‑based detection type of tool, for example.
The problem is, even though we have lots of different encoders within
Metasploit, lots of different methods of encoders, the problem is
those encoders are known.
So for the most part, anytime you use an encoder,
it can obfuscate it and make it a little bit more
difficult, but it's not a perfect solution.
So what we normally do is we blend multiple different
things and try to use that as our solution.
Why?
Because there's a big limitation of encoding. All we need is a
decoder, and once we've got the decoder, then we can decode it,
which is why Base64 encoding, even though it's very popular, is
very easy to decode.
So because of that limitation, a better way is to use encryption.
And now when we encrypt our payloads,
it makes it much more difficult for the defenses to detect them.
It also raises the level complexity for us as well.
It's not that we do this and it's easier for us as the attacker.
There's always going to be more complexity when you add an
encryption. Because in this case, we have an algorithm like we did
with encoding, but we also have an encryption key.
So from our standpoint, if they can decrypt it, they can read it.
So that's a good thing because they have to have the key,
not just the algorithm; they've got to have the key. But
the complexity is we have to have the key to decrypt it and
use it when we need to use it.
That can add challenges as well.
So it's just another way to try and avoid the detection.
And as we said, it's not 100%, but it's better than nothing.
We are now ready for a demonstration.
We'll look at the different methods of evasion in this demo and see
how successful we are at trying to evade detection.
Since most of the templates within Metasploit have been used for some time,
it's getting harder to avoid detection and evade.
But we'll still cover the process because the task,
especially if you're doing this as an ethical attacker,
is to see what does and does not work and to
provide those results to the client.
And that's one of the most important things you can do as you learn about the
different methods and processes of professional testing.
And with that, we'll start the demo here. Enjoy the demo.