[SameFish95]

What common strategies are used when trying to infect a firewall protected windows system with a rat?
Is there any port with better chances than others? Some injection methods?
Thank you.

[Slavoj Žižek]

a common way of bypassing the firewall is injecting into something that uses loads of internet (eg. a webbrowser) or a trusted executable

[QU⚡CKSILVER]

Yes, injecting into an already whitelisted process is the solution, but the problem about injecting into other processes is that it could trigger the antivirus to detect because of suspicious behavior. Unfortunately, most injection techniques are already known by antiviruses.

As for the Windows Firewall, you don't need that shit. It is so easy to bypass.

[SameFish95]

Thanks to both of you for the reply. I'm looking to try to bypass an eventual hardware firewall. I think I will try the injection in browser method since I don't know the target ip and so I can't do a port scan.

[QU⚡CKSILVER]

Thanks to both of you for the reply. I'm looking to try to bypass an eventual hardware firewall. I think I will try the injection in browser method since I don't know the target ip and so I can't do a port scan.

If it's a physical firewall then you're going to have to investigate why the firewall is filtering specific outbound traffic.

Many modern firewalls will block connections to botnets/RATs and many other Command and Control stations, so there is a chance that firewall knows the way these sofware communicate (their traffic, their signatures and such), so that when it sees sketchy traffic going through, it will not let it establish communication or even negotiate with the server.

A way you can evade a firewall's Stateful Packet Inspection, is by encrypting the traffic (Many RATs already do this), but the Firewall will still learn from that traffic and filter it in the future.

[SameFish95]

Wish I could +rep you. Thank you so much!