We're now ready for a demonstration.
We'll look at the different methods of evasion in this demo and see
how successful we are at trying to evade detection.
It's getting harder to avoid detection and evade,
but we still cover the process because the task,
especially if you're doing this as an ethical hacker,
is to see what does and does not work,
and then you provide those results to the client.
All we have to do is add the ‑e option for the encoders,
and this will allow us to apply an encoder to our payload,
and the ‑i option will allow us to specify how many iterations we
will perform as part of our attempt to obfuscate or change the
code in such a way to avoid detection.
So we're going to use Shikata Ga Nai.
This is the encoder that's a polymorphic exclusive or additive
feedback encoder within the Metasploit framework.
This encoder offers three features to provide advanced protection when combined.
It's polymorphic in that each creation of the encoded shell
code is going to be different from the next.
It accomplishes this through a variety of techniques,
dynamic construction substitution, dynamic block ordering,
and randomly interchanging the register.
So when we look at our command here, we see, as before, it's msfvenom.
We're setting up our payload as a
meterpreter/reverse_tcp LHOST ‑d x86/shikata_ga_nai.
So this is the encoder we're going to use for our purposes here,
and we see the ‑i.
Now the ‑i, in this case, 200, is for our iterations.
So we're going to do our iterations of 200 iterations and run
our actual Shikata Ga Nai encoding algorithm 200 times to try
to make it harder to detect.
And you see we're going to put it into our Downloads
folder and call it encodedtest.exe.
So we hit Enter.
It's going to run through all the iterations and print them on the screen,
and then hopefully we see Final, Saved as.
You see here the Saved as, the location is saved as.
And then one thing to note there, the final size of the executable file.
It's only 73,000 bytes.
That's pretty efficient considering it went through 200
iterations and the payload itself is 6104 bytes.
These are things to be aware of.
Now the way we test it, and this has been demonstration purposes,
don't do this if you're doing it and doing it on your own,
because as soon as we test it online, if it's not detected,
the vendors will figure out what we've done,
and they'll write a detection for it.
That's why some of the frameworks, Veil and other frameworks,
Shellter and these other ones,
they tell you do not upload your shell code and what you create
for a payload to the antivirus vendor sites.
If you do, it's going to not work anymore.
So what we do is we go to the website and we go to VirusTotal.
So we come over here to VirusTotal,
and what we're going to do is do a comparison.
So this is our file we created in our first lab, and you see it's test.exe.
We didn't do very good.
Fifty‑one out of 69 detected it.
That's not a very good percentage.
So encoding hopefully will help that.
This was a raw payload, our first payload we did in the first lab demonstration,
and we used the encoder.
Now remember,
we took Shikata Ga Nai, and we ran it through 200 iterations, but
look what happened. We're still at 51 out of 69.
So, as you clearly can see, it's a constant back and forth to
figure out what will work and what will not work.
So, because of this, Microsoft has gotten better at this.
Metasploit framework, since it's owned by Rapid7 now,
they decided, okay,
we're going to try to do something to make it a little better.
So we're going to go back into a new terminal window here,
we're going to go into Metaploit for Metasploit service postgresql
start, and then we just do msfconsole, and now it will start
Metasploit. The module we want is for Windows Defender, so we're
going to actually go in here and use
evasion/windows/windows_defender_exe. No payload configured,
so it tells us that. Let's clear to get the top of the screen.
The first thing you always want to do is info. And you
see what they're going to do here.
This is an executable evasion for Windows architecture x86, and it
tells us the file name is going to be this guy here.
So it randomly names the file.
That's how the whole process works. Description: This module
allows you to generate a Windows EXE that evades against Microsoft
Windows Defender. Shell code encryption,
source code obfuscation, Metasm, anti‑emulation are all used to achieve this.
And then they tell you one of the most important things. To make sure that
it doesn't get picked up and people start figuring out how it's done, use
a secure channel, HTTPS or some form of mechanism to avoid the network
traffic getting caught by antivirus.
And what also Windows Defender does with Microsoft
now, they have cloud‑based support.
So even if it's not detected locally, to go out to the
cloud and look for the signature as well.
So you can imagine, it's made it much more difficult.
So let's see.
We've got this file here, this wA.
Now what we have to do is just run exploit. And there it is.
Says it created it and where it stored it that.
So we want to do is we're going to copy this, so we move it
to make it a little bit easier for us.
So we're going to put it, clear our screen, here on our Downloads.
So we're going to cp, then do ls.
We see there's our file. It's located in our home directory.
Okay, so we see our file's in the home directory.
So now we go over here to VirusTotal, we go to our
Home directory, and there's our file.
Now remember, we were at 51 detections. Confirm upload. Well, we're detected.
We improved.
It's 44 out of 68.
Now if we scroll down here, see all the different ones.
So when it's undetected,
that's the ones you would start looking forward to
see if you're up against that.
So this is the process of how you would do that.
So if we go over here to our Windows 10 machine,
and we see here is the one we created already, so we're just
going to use that one for our demonstration, and we see
there's our file, so we download it.
Now remember, it's going to be detected as a Trojan
by Windows Defender if it fails.
But now we can also, so far, so good.
We don't have an alert. So we've got a few minutes
that here it has not detected it.
But as soon as, if we scan it directly and we scan this direct,
as soon as we scan it directly, it will find it.
But the good news is it did not find it in the download.
So we've got a window of opportunity, and kind of with evasion that's kind
of what you have to do is have a window of opportunity.
So we have a window of opportunity now to execute that code.
But as soon as we scan it directly, that window will go away.
Watch. Boom! So it detects it.
But because it didn't detect it on the download and Windows
Defender was back on again and stuff like that, since it
didn't detect it on the download,
we had a window of opportunity to use it, but a very short
one. And more than likely when you ran it,
it probably would actually detect it as well.
But mainly, we wanted to show you the process.
Unfortunately, there's no perfect solution with avoiding detection.
If you do some research, the process is to obfuscate and
change what the tool is finding, and that requires
disassembly and some advanced concepts,
which is beyond the scope of our demonstration. And
with that will conclude the demo here.