Jun 14, 2019 07:59 AM
(This post was last modified: Jun 14, 2019 09:11 AM by BrunoB.)
Hi,
I'm trying to get a meterpreter exe through windows 10 AV.
I tried using shellter witch unfortunately doesn't work. The windows AV gets It.
Any suggestions on how I could get this through?
P.S. I'm new to this so I don't have much experience...
(Jun 14, 2019 07:59 AM)BrunoB Wrote: Hi,
I'm trying to get a meterpreter exe through windows 10 AV.
I tried using shellter witch unfortunately doesn't work. The windows AV gets It.
Any suggestions on how I could get this through?
P.S. I'm new to this so I don't have much experience...
The best way to get your payload to the machine is to use a downloader. The downloader would interact/use the builtin cmdlets for defender to tell defender what to do instead of it default settings. Once you have executed the correct cmdlets your file would be downloaded and executed which would bypass defender if done correctly.
(Jun 14, 2019 10:52 AM)__Digital__ Wrote: The best way to get your payload to the machine is to use a downloader. The downloader would interact/use the builtin cmdlets for defender to tell defender what to do instead of it default settings. Once you have executed the correct cmdlets your file would be downloaded and executed which would bypass defender if done correctly. what downloader would you recommend?
(Jun 14, 2019 11:21 AM)BrunoB Wrote: what downloader would you recommend?
the one you write yourself
come on, its literally a single line of powershell code
humble rubyist in a world of pythonistas
You can use some of the evasion techniques like Veil Evasion or use any other EXE cryptots like Themida, Enigma, and others.
(Jun 14, 2019 11:21 AM)BrunoB Wrote: what downloader would you recommend?
As Faith told you before i could the one you make yourself then you know its clean and not dirty.
DO NOT DEAL WITH THIS MEMBER
(Jun 14, 2019 11:25 AM)Faith Connors Wrote: the one you write yourself
come on, its literally a single line of powershell code
Yeah, any skid can do that ;)
(Jun 15, 2019 07:31 AM)W32.DisTrack Wrote: Yeah, any skid can do that ;)
i mean im a skid and i can do it :P
humble rubyist in a world of pythonistas
DO NOT DEAL WITH THIS MEMBER
(Jun 15, 2019 10:58 AM)Faith Connors Wrote: i mean im a skid and i can do it :P
Exactly my point lol. I'm not sure why the skids haven't hopped on the powershell train.
|
