+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: disable client AVs? (/showthread.php?tid=5476572)
disable client AVs? - THC - Nov 26, 2016
I'm currently using njrat and I was wondering if there is any way to disable client AVs, especially windows defender. I can execute scripts and such.
* - yotoprules - Nov 27, 2016
If you had a paid RAT you could use a UAC exploit to gain privilages to setup hidden RDP and uninstall it from the second account. A lot of work I know. Otherwise, sorry I don't think you can disable your clients AV.
* - Viikinki - Nov 27, 2016
Dunno know about njrat. But for metasploit there's killav.
* - CichyCichoCiemny - Nov 27, 2016
Get the list of AVs from the Metasploit kill avs module list and re-write them into a batch file.
You also could just compile the ruby script.
🤝
* - SIM-2053312 - Nov 27, 2016
If you have admin you can disable them
* - Armada - Nov 27, 2016
Prob want a AV nuker/filter run on Admin rights to properly circumvent the hooks, or add the filtration required.
* - VirtualMon3y - Nov 27, 2016
(Nov 26, 2016 10:40 PM)M.D. Wrote: I'm currently using njrat and I was wondering if there is any way to disable client AVs, especially windows defender. I can execute scripts and such.
I know you are skint bro but:
https://hackforums.net/showthread.php?tid=5398632
* - LanMan - Nov 28, 2016
Get the product ID of the AV installed and then "msiexec /x PRODUCTID" to uninstall it silently.
You need to have Admin right and that's all.
* - Armada - Nov 28, 2016
(Nov 28, 2016 05:10 AM)LanMan Wrote: Get the product ID of the AV installed and then "msiexec /x PRODUCTID" to uninstall it silently.
You need to have Admin right and that's all.
That is actually pretty tricky lol
GG
* - warpje - Nov 28, 2016
(Nov 28, 2016 05:10 AM)LanMan Wrote: Get the product ID of the AV installed and then "msiexec /x PRODUCTID" to uninstall it silently.
You need to have Admin right and that's all.
Gone test this out! Would be pretty Nice and Easy to do!
* - LanMan - Nov 28, 2016
(Nov 28, 2016 09:05 AM)Armada Wrote: That is actually pretty tricky lolYes it is haha, using the installation manager to "officialy" uninstall AV.
GG
(Nov 28, 2016 09:43 AM)warpje Wrote: Gone test this out! Would be pretty Nice and Easy to do!
If i remember correctly you can list all programs (with their product id) with "wmic.exe product list brief"
* - QU⚡CKSILVER - Nov 28, 2016
(Nov 28, 2016 09:56 AM)LanMan Wrote: Yes it is haha, using the installation manager to "officialy" uninstall AV.
If i remember correctly you can list all programs (with their product id) with "wmic.exe product list brief"
Hmm, you forgot a little something at the end of it 🤭
''/quiet'' for silent uninstallation 👍
* - LanMan - Nov 28, 2016
(Nov 28, 2016 01:02 PM)QU⚡CKSILVER Wrote: Hmm, you forgot a little something at the end of it 🤭
''/quiet'' for silent uninstallation 👍
Oops maybe, i wrote it off the top of my head
* - Armada - Nov 28, 2016
(Nov 28, 2016 01:02 PM)QU⚡CKSILVER Wrote: Hmm, you forgot a little something at the end of it 🤭
''/quiet'' for silent uninstallation 👍
(Nov 28, 2016 01:18 PM)LanMan Wrote: Oops maybe, i wrote it off the top of my head
Think he meant the /q or /s command line....
Regardless interesting and efficient approach.