I thought this would be an interesting experiment.So to start with the venerable Netbus 1.6 a mighty contender from 2000. Tracking it down was more of a chore than anything else, but finally found it. I decided on going with an old RAT that no longer is in use in the wild, and should really have 100% detection although I discovered a very different real world when testing.
Tools:
msfvenom
sigthief
hyperion
So here I will be trying to use Netbus 1.6 as the base, and seeing how much can be quickly done to make it more passable. I also added a message box, to keep it as original as possible.
So this is the original PATCH.EXE
https://www.virustotal.com/#/file/bf7aa8.../detection
SHA-256 bf7aa8fafd5b719841211eaea5e8a2d44f4b24482a9c0ed093098a302fa151fd
File name 1002-1031fc4869c5c1397f9ddf1773e46c030dc845e5
File size 461.5 KB
Last analysis 2016-02-15 17:06:41 UTC
57/67
How it isn't 67/67 I have no idea.
The idea here is using the "PATCH.exe" as the template in msfvenom, we will output to a "exe-only". Also using x86/shikata_ga_nai 2 interations. I create a new file
sha256sum patch.exe
bf612b1aa77c8f2e4510565aabdb0e705d3f0b904cf66ed168590b4255a3c42f patch.exe
patch.exe : (37/67) https://www.virustotal.com/#/file/bf612b.../detection
ls -al patch.exe
-rw-r--r-- 1 root root 472576 Dec 13 01:48 patch.exe
So now we are bypassing 20 more AV's including some like BitDefender/Comodo
Now I go ahead and scramble the PE a bit to make it appear as though it is still unencrypted and save as "patch1.exe"
sha256sum patch1.exe
58bf61b8934929e52da34db05da050fc3716e29280fb6118f14137daee2ee4af patch1.exe
patch1.exe : (41/67) https://www.virustotal.com/#/file/58bf61.../detection
As to why the detections went up here I can only guess that is due to using Hyperion a runtime crypter. Roo much encryption can also raise flags with AVs.
Now I grabbed procmon from microsoft. Why? Well I need it's signature
sha256sum Procmon.exe
978f95fc63699f1e769663e32bae596148742b3038f743a51af346ca4d2f56d0
Now onto ripping the signature of the file using sigtheif.
Ripping signature to file!
Output file: /root/Downloads/procmon/Procmon.exe_sig
Signature ripped.
FIN.
And we place the signature that we ripped on over to our netbus file.
Output file: /root/patch1.exe_signed
Signature appended.
FIN.
After placing the signature ripped from Procmon into our "patch1.exe" file
patch1.exe_signed: (37/67) https://www.virustotal.com/#/file/558fe4.../detection
So in conclusion, could more have been done? Could we get around every AV? Maybe but this does show that modern AV's still struggle with catching even 17 year old remote administration tools. Now could more have been done? Yes, certainly, but the point was to test if we can bypass more AV's than just the default. Funny thing is that more encryption didn't help too much. So looking at newer solutions for compromising currently at hand it is very feasible that one can bypass AV solutions, perhaps not all solutions, but to an initial compromise, it is possible.
Tools:
msfvenom
sigthief
hyperion
So here I will be trying to use Netbus 1.6 as the base, and seeing how much can be quickly done to make it more passable. I also added a message box, to keep it as original as possible.
So this is the original PATCH.EXE
https://www.virustotal.com/#/file/bf7aa8.../detection
SHA-256 bf7aa8fafd5b719841211eaea5e8a2d44f4b24482a9c0ed093098a302fa151fd
File name 1002-1031fc4869c5c1397f9ddf1773e46c030dc845e5
File size 461.5 KB
Last analysis 2016-02-15 17:06:41 UTC
57/67
How it isn't 67/67 I have no idea.
The idea here is using the "PATCH.exe" as the template in msfvenom, we will output to a "exe-only". Also using x86/shikata_ga_nai 2 interations. I create a new file
sha256sum patch.exe
bf612b1aa77c8f2e4510565aabdb0e705d3f0b904cf66ed168590b4255a3c42f patch.exe
patch.exe : (37/67) https://www.virustotal.com/#/file/bf612b.../detection
ls -al patch.exe
-rw-r--r-- 1 root root 472576 Dec 13 01:48 patch.exe
So now we are bypassing 20 more AV's including some like BitDefender/Comodo
Now I go ahead and scramble the PE a bit to make it appear as though it is still unencrypted and save as "patch1.exe"
sha256sum patch1.exe
58bf61b8934929e52da34db05da050fc3716e29280fb6118f14137daee2ee4af patch1.exe
patch1.exe : (41/67) https://www.virustotal.com/#/file/58bf61.../detection
As to why the detections went up here I can only guess that is due to using Hyperion a runtime crypter. Roo much encryption can also raise flags with AVs.
Now I grabbed procmon from microsoft. Why? Well I need it's signature
sha256sum Procmon.exe
978f95fc63699f1e769663e32bae596148742b3038f743a51af346ca4d2f56d0
Now onto ripping the signature of the file using sigtheif.
Ripping signature to file!
Output file: /root/Downloads/procmon/Procmon.exe_sig
Signature ripped.
FIN.
And we place the signature that we ripped on over to our netbus file.
Output file: /root/patch1.exe_signed
Signature appended.
FIN.
After placing the signature ripped from Procmon into our "patch1.exe" file
patch1.exe_signed: (37/67) https://www.virustotal.com/#/file/558fe4.../detection
So in conclusion, could more have been done? Could we get around every AV? Maybe but this does show that modern AV's still struggle with catching even 17 year old remote administration tools. Now could more have been done? Yes, certainly, but the point was to test if we can bypass more AV's than just the default. Funny thing is that more encryption didn't help too much. So looking at newer solutions for compromising currently at hand it is very feasible that one can bypass AV solutions, perhaps not all solutions, but to an initial compromise, it is possible.
