Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆ Anvilpoint CyberOps - Hacker for Hire ◆ ProxiesFood: Unlimited Residential Proxy ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Remote Administration Tools › disable client AVs?

New Reply 

disable client AVs?
THC
THC Away
Tetrahydrocannabinol
****
HF Ub3r
Posts:
7,236
Threads:
274
Credibility:
000
Popularity:
570
βytes:
β 0
Game XP:
0
Nov 26, 2016 10:40 PM
I'm currently using njrat and I was wondering if there is any way to disable client AVs, especially windows defender. I can execute scripts and such.
Can you hear my weed?



cuz it's loud
yotoprules
yotoprules Offline
[closed@HF:]
Posts:
2,846
Threads:
84
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 27, 2016 06:32 AM
If you had a paid RAT you could use a UAC exploit to gain privilages to setup hidden RDP and uninstall it from the second account. A lot of work I know. Otherwise, sorry I don't think you can disable your clients AV.
Viikinki
Viikinki Offline
[n00b@HF:]
*
Registered
Posts:
60
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 27, 2016 06:34 AM
Dunno know about njrat. But for metasploit there's killav.
CichyCichoCiemny
CichyCichoCiemny Offline
[user@HF:]
*
Registered
Posts:
465
Threads:
5
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 27, 2016 01:30 PM (This post was last modified: Nov 27, 2016 01:30 PM by CichyCichoCiemny.)
Get the list of AVs from the Metasploit kill avs module list and re-write them into a batch file.
You also could just compile the ruby script.
🤝
SIM-2053312
SIM-2053312 Offline
AGC SELLER!
***
HF Ub3r
Posts:
3,778
Threads:
408
Credibility:
30311
Popularity:
372
βytes:
β 0
Game XP:
0
Nov 27, 2016 04:20 PM
If you have admin you can disable them
Armada
Armada Away
[closed@HF:]
Posts:
22,584
Threads:
642
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 27, 2016 04:23 PM
Prob want a AV nuker/filter run on Admin rights to properly circumvent the hooks, or add the filtration required.
VirtualMon3y
VirtualMon3y Away
[closed@HF:]
Posts:
1,641
Threads:
15
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 27, 2016 05:16 PM
(Nov 26, 2016 10:40 PM)THC Wrote:  I'm currently using njrat and I was wondering if there is any way to disable client AVs, especially windows defender. I can execute scripts and such.

I know you are skint bro but:

https://hackforums.net/showthread.php?tid=5398632
LanMan
LanMan Offline
[bin@HF:]
***
HF l33t
Posts:
693
Threads:
8
Credibility:
000
Popularity:
15
βytes:
β 0
Game XP:
0
Nov 28, 2016 05:10 AM
Get the product ID of the AV installed and then "msiexec /x PRODUCTID" to uninstall it silently.
You need to have Admin right and that's all.
Armada
Armada Away
[closed@HF:]
Posts:
22,584
Threads:
642
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 28, 2016 09:05 AM
(Nov 28, 2016 05:10 AM)LanMan Wrote:  Get the product ID of the AV installed and then "msiexec /x PRODUCTID" to uninstall it silently.
You need to have Admin right and that's all.

That is actually pretty tricky lol
GG
warpje
warpje Offline
Proud Dutch
**
HF Ub3r
Posts:
451
Threads:
3
Credibility:
000
Popularity:
500
βytes:
β 223.7
Game XP:
0
Nov 28, 2016 09:43 AM
(Nov 28, 2016 05:10 AM)LanMan Wrote:  Get the product ID of the AV installed and then "msiexec /x PRODUCTID" to uninstall it silently.
You need to have Admin right and that's all.

Gone test this out! Would be pretty Nice and Easy to do!
XMPP: [email protected]
LanMan
LanMan Offline
[bin@HF:]
***
HF l33t
Posts:
693
Threads:
8
Credibility:
000
Popularity:
15
βytes:
β 0
Game XP:
0
Nov 28, 2016 09:56 AM
(Nov 28, 2016 09:05 AM)Armada Wrote:  That is actually pretty tricky lol
GG
Yes it is haha, using the installation manager to "officialy" uninstall AV.


(Nov 28, 2016 09:43 AM)warpje Wrote:  Gone test this out! Would be pretty Nice and Easy to do!

If i remember correctly you can list all programs (with their product id) with "wmic.exe product list brief"
QU⚡CKSILVER
QU⚡CKSILVER Offline
[closed@HF:]
Posts:
1,688
Threads:
36
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
1
Nov 28, 2016 01:02 PM
(Nov 28, 2016 09:56 AM)LanMan Wrote:  Yes it is haha, using the installation manager to "officialy" uninstall AV.



If i remember correctly you can list all programs (with their product id) with "wmic.exe product list brief"

Hmm, you forgot a little something at the end of it 🤭

''/quiet'' for silent uninstallation 👍
LanMan
LanMan Offline
[bin@HF:]
***
HF l33t
Posts:
693
Threads:
8
Credibility:
000
Popularity:
15
βytes:
β 0
Game XP:
0
Nov 28, 2016 01:18 PM
(Nov 28, 2016 01:02 PM)QU⚡CKSILVER Wrote:  Hmm, you forgot a little something at the end of it 🤭

''/quiet'' for silent uninstallation 👍

Oops maybe, i wrote it off the top of my head
Armada
Armada Away
[closed@HF:]
Posts:
22,584
Threads:
642
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 28, 2016 02:46 PM
(Nov 28, 2016 01:02 PM)QU⚡CKSILVER Wrote:  Hmm, you forgot a little something at the end of it 🤭

''/quiet'' for silent uninstallation 👍

(Nov 28, 2016 01:18 PM)LanMan Wrote:  Oops maybe, i wrote it off the top of my head

Think he meant the /q or /s command line....

Regardless interesting and efficient approach.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by EclipseApr 7, 2022 02:24 PM 4 254 Apr 7, 2022 02:24 PM
Last Post: Goldmouth
by latiendaadssMar 23, 2020 03:02 PM 1 131 Mar 23, 2020 03:02 PM
Last Post: Arababy
by Mr 4rs4l4neDec 14, 2016 09:33 PM 6 302 Dec 14, 2016 09:33 PM
Last Post: Iraqian