hi,
I have trouble with meterpreter being always detected by windows defender, tried encoding with x86_shikata_ga_nai, but that still gets detected, injecting it into another app using shellter is not reliable and sometimes still gets detected.
anyone know how to make a virus fully undetectable?
You can't use the existing tools afaik, AVs have updated to handle them. Try writing your own code to lower detection.
Hello sry i don't know where to contact u, can u check the contract i started ?
(Jun 28, 2021 08:14 AM)nitrogen_oxide Wrote: hi,
I have trouble with meterpreter being always detected by windows defender, tried encoding with x86_shikata_ga_nai, but that still gets detected, injecting it into another app using shellter is not reliable and sometimes still gets detected.
anyone know how to make a virus fully undetectable?
Hi,
Meterpreters are so common and so easy to use that Windows 10 is almost totally immune to it.
As an alternative you can try to use payload/generic/shell_reverse_tcp if it helps, as it has a much smaller footprint. Although there's no guarantee that it's undetectable.
Here's the description of the payload https://www.rapid7.com/db/modules/payloa...verse_tcp/
Cheers!
Regards,
Porky
ℒ𝒶𝓊ℊ𝒽𝒾𝓃ℊ 𝒶𝓉 𝓎ℴ𝓊𝓇 𝓈ℯ𝒸𝓊𝓇𝒾𝓉𝓎 𝓈𝒾𝓃𝒸ℯ... ℯ𝓋ℯ𝓇.
Nowadays it is difficult there will be new updates thats make hard to hack other computers
Jul 20, 2021 05:45 AM
(This post was last modified: Jul 20, 2021 05:45 AM by ĐĮΜĘ.)
(Jul 17, 2021 05:05 PM)linkinpork Wrote: Hi,
Meterpreters are so common and so easy to use that Windows 10 is almost totally immune to it.
As an alternative you can try to use payload/generic/shell_reverse_tcp if it helps, as it has a much smaller footprint. Although there's no guarantee that it's undetectable.
Here's the description of the payload https://www.rapid7.com/db/modules/payloa...verse_tcp/
Cheers!
Yeah even that one is detected at runtime as well. I would say though to the OP there are plenty of good code on GitHub to get you in the right direction. You can go search some of my posts.
The best way is only to generate your shellcode with meterpreter and run it through a custom loader with c or csharp
You can find many examples from Github that you can costomize on your own
Windows 10 is far from being immune to meterpreter. First of all, forget about normal payloads or encryption routines that are already integrated or used by common tools like donut or sgn. AV already know them very well...
Write your own packers with C # /. Net or work with process hollowing. Use files that are relevant for the operating system and are therefore not scanned so intensively by the AV (e.g. svchost). Ideally, you do not write any files to the hard drive and load the payload directly into the memory via reflective loading. For transfering the payload check out LOLBAS.
(Sep 1, 2021 04:15 PM)Cyr0x Wrote: Use files that are relevant for the operating system and are therefore not scanned so intensively by the AV (e.g. svchost). Ideally, you do not write any files to the hard drive and load the payload directly into the memory via reflective loading. For transfering the payload check out LOLBAS.
Attempting to use a system file isn't not a great idea since all of those are in fact verifiable by the OS. Windows Defender of all things will flag any process using the name of a system process if it isn't a legitimate system process.
Trying to load things directly into memory raises all kinds of red flags for AV software. If a typical user program wouldn't do that thing, your malicious code should not do such things either. Anything unusual tends to stand out.
DO NOT DEAL WITH THIS MEMBER
Its easy to do fud with meterpreter on kali, very easy
|
