[Autogenerated] Hey, there were better.
Colin.
It's virtual machine.
So let's say you want to execute a malicious code in
the machine that hasn't a virus.
For example,
let's say you want to execute a reverse shell script that he will
allow you to remotely control the computer,
their tones of partial screws.
For that, I personally like the use screws from this get home page in year,
we can go to the reverse show cheat sheet a year if I
tones or reverse shell quotes and pretty much any
scripting language you can think off.
So let's check the power share ones.
The year there are three different poor show river shows for this demo.
I use this middle one,
and these line contains the whole power show Common to
launch a power shell and executed code.
But what I'm interested in here is the actual power
show called Between the coats.
So L carpet and paste this into a file in my desktop.
Then in here,
I'll just say this I p address that the show we connect to in my case,
I put in my I P address here.
Also, I could change the poor that is reverse show use,
but in my case, I will leave.
That is, it is which is the port 40 to 42.
Perfect.
Now I can saving close this file Now.
When someone runs is on a machine,
the computer connected therapy and gives us a show.
So we needed a listener for the show.
For that, I'll use the Net cat.
So let me quickly migrate to root and then type and sea and then dash N
v L P and then the poor that I want to listen on.
Remember, in our keys it'll be deported 40 to 42.
Alison, As you can see, that cat is no listening.
Import 42 42 for connections.
Perfect.
So we are set.
Let's start by doing a simple test without using an obfuscation.
So I'll try to run this reverse show cold as it is.
So first, how copy this code and didn't go to a Windows machine.
And again, remember, this machine has the Windows Defender enabled,
as was decent of IRS enabled.
So I open the command prompt and then run power show in here.
I would just pass the quoted a cop before.
Now let's run it awesome.
Take a look.
The enter virus detected.
This is a malicious cold and prevented it from running.
So let's go back to Colonel Lennox and try to Oprah skate this cold.
First, let's start the invoke obfuscation.
For that, I would start power show,
then loading vocal replication module and then it started.
Invoke obfuscation, Too awesome.
Let's start by setting the path for my reverse show script.
For that, a type set is create a path and then the path for my script.
Awesome.
Now let's unlike the obfuscation technique in Year of Select Encoding.
And then I was like the option five, which includes the script.
Perfect.
Take a look.
Now we have a huge obfuscation string.
So then let's cop it and then pasted on power show.
Now I would have to do is cross your fingers and presenter.
Oh, take a look.
This didn't work the inter virus to detecting our script,
and that's why it's really important to always test the commanding
your lab before executing the target machine.
If this machine was a production server,
the anti virus would generate in alerts to the soccer team,
and you would get caught for this reason a do recommend you
creating a virtual machine with the same Windows version and
the same improvise version there.
Your target machine.
In this way,
you confess your risk Asian techniques before sending to the real target.
Okay, so let's go back to colonise and try some different obfuscation techniques.
First, let me closing, invoke AFIS cation and reopen it again.
And these were set out of variables in the too, so we can start fresh.
Perfect.
Let me quickly said this creep path again.
No, we need to experiment with different obfuscation techniques,
and this process is kind of try on our which means you should explore each
obfuscation technique and testing your testing server.
But save us some time.
I tested the script against few of the presentation techniques and for my tests,
the ASD technique was successful, and actually from appears experience.
The ASD technique is really the one that ours works.
So let's say like the CST option year.
You see, that are several A S D techniques.
In my case, I would type or because I want our debt,
it needs to be applied and to confirm that I want to use all the
techniques of select Option one and then press enter.
Awesome.
As you can see, we have no Oprah skater commander.
That's saving to a file to make things easier for that.
I used to coming out and then but the path for the output file.
Perfect.
Now let me open new terminal window so we can compare
the original script and the new one.
Cool.
Take a look.
As you can see, the ASD technique changed the way the power show.
No, they revoked, and these will help to obfuscate our actions.
So let me copy this code and quickly confirmed that my next
cats to running perfect it issue here.
So now let's go to our Windows machine here,
let me pay the full scale it cold into power show.
And then let's cross our fingers and press enter and we got nothing.
But that's a good sign.
It means that it was not blocked.
So let's go to college annex and see if you got something amazing.
Take a look.
We got a shelter or Ringo's box.
If we do it, I p conflict.
We can see that I have control to the Windows box and if a runner Who am I?
Comment?
I can see that I'm logged as a Adami.
That's really cool rate were able to bypass both
anti virus and Windows defender, and you've got a show as an ad mean,
and that's amazing.