+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: Firewall bypass (/showthread.php?tid=5411806)
Firewall bypass - SameFish95 - Sep 21, 2016
What common strategies are used when trying to infect a firewall protected windows system with a rat?
Is there any port with better chances than others? Some injection methods?
Thank you.
* - Slavoj Žižek - Sep 21, 2016
a common way of bypassing the firewall is injecting into something that uses loads of internet (eg. a webbrowser) or a trusted executable
* - QU⚡CKSILVER - Sep 21, 2016
Yes, injecting into an already whitelisted process is the solution, but the problem about injecting into other processes is that it could trigger the antivirus to detect because of suspicious behavior. Unfortunately, most injection techniques are already known by antiviruses.
As for the Windows Firewall, you don't need that shit. It is so easy to bypass.
* - SameFish95 - Sep 22, 2016
Thanks to both of you for the reply. I'm looking to try to bypass an eventual hardware firewall. I think I will try the injection in browser method since I don't know the target ip and so I can't do a port scan.
* - QU⚡CKSILVER - Sep 22, 2016
(Sep 22, 2016 10:17 AM)kokyx92 Wrote: Thanks to both of you for the reply. I'm looking to try to bypass an eventual hardware firewall. I think I will try the injection in browser method since I don't know the target ip and so I can't do a port scan.
If it's a physical firewall then you're going to have to investigate why the firewall is filtering specific outbound traffic.
Many modern firewalls will block connections to botnets/RATs and many other Command and Control stations, so there is a chance that firewall knows the way these sofware communicate (their traffic, their signatures and such), so that when it sees sketchy traffic going through, it will not let it establish communication or even negotiate with the server.
A way you can evade a firewall's Stateful Packet Inspection, is by encrypting the traffic (Many RATs already do this), but the Firewall will still learn from that traffic and filter it in the future.
* - SameFish95 - Sep 22, 2016
Wish I could +rep you. Thank you so much!