Welcome back.
In this video, I want to talk about bypassing antivirus, and this video is not going to be that practical.
You might be asking why.
Well, I could show you a way to bypass antivirus right here in this video, but chances are that will
not work once you watch the video in a month or two months or in a year.
Fully undetectable payload is not something that lasts forever, especially when I show it inside of
something like a course that many people are going to watch.
So instead, I would like to tell you about a few different techniques that you can apply to generate
an undetectable payload.
So how it all goes?
Well, many people start using a payload and sooner or later antivirus start detecting it as a malicious
program that could be due to people using it a lot.
Or it could be that some of you uploaded it to the virus total and it could send to all the antivirus
vendors.
However, let me talk about the rules that you can apply to bypass antivirus.
Now, the best thing that you can do to create a fully undetectable payload is to code your own programs
or your own payloads.
For example, I call that the backdoor in C language.
And when I scanned it, it was fully undetectable.
No antivirus was able to flag it as a malicious program.
Then I created a course on creating that backdoor, and soon enough that back door was no longer fully
undetectable and was getting caught by most antivirus.
It was fired at first because it was a new payload with a new coat or a new source code.
Once you have a unique and different code and you compounded that code becomes a different binary,
which makes it undetectable until many people start using it.
So just remember, the best way to create undetectable payload is to code it yourself in a unique way.
However, this requires you to know a programming language and for many, this will present a problem.
There are other ways as well, so one of them is to update your payload tools if possible, and you
also want to keep an eye out for the tools that are new or the tools that just came out.
Why?
Well, they might have different payloads that aren't widely used yet.
So that is another way that you can do it.
You can also try creating different types of payloads, try out power, shell payloads, python payloads,
C sharp payloads.
All of them have higher chances of not getting detected.
Another cool thing you can do once you generate your payload is to change its binary a little bit.
Let me show you what they mean.
We can do this by using hex editor solitaires just real quick, generate on normal windows.
Better reverse this payload.
Let this go with our host Bellport and let's specify file to be EXI and output to be shell data.
OK, great.
This is a regular at their payload.
It gets detected by almost every antivirus in the world.
It is matter of fact the most known payload in the world for malicious activities.
But what you can do if I show you right here the M the five some hash of this payload, you will see
it is this one.
So some antivirus work by getting the hash of the executable and storing it in their database, then
once you change this hash and you change this hash by changing the binary of the program, this hash
becomes different and it is no longer inside of the databases of antivirus.
Let me show you a simpler way to change it.
So what we can do is we can type Hex editor, which is a tool that is already installed in Linux and
we can specify the payload.
This will open the payload binary and here we want to change some of the binary.
Just be careful.
Don't change something that you don't know what it is, because even changing a single byte right here
could result in a program not working if that byte was essential for the program to run.
Now, there are few things right here that we can change for sure, and that is this right here.
This is a program that cannot be run endorsement.
Now, what is this?
Well, this is a string.
It is nothing really too important for the program.
So we can go navigate with our arrows.
And we can change this strength, as you can see when I type hexadecimal right here, it changes the
output inside of this right column.
So if I just type some random hexadecimal numbers and letters
to change this
and want to change some of it, this will change colors.
And if I go all the way down, there is another thing that we can change, and that is this text right
here.
This is also something that we can change.
Just make sure you navigate to the correct line.
In my case, I believe it is this one.
The text should start with seven four and we can change it to whatever we want.
Just once again, make sure you don't go over that word because changing, for example, this bit right
here will result in a program to not work.
OK, once you finish this, you can control oh, save this now if you remember how the five has started
before we did this.
If I do it again, it is completely different.
I believe it started with something like eight, three or I don't even remember.
But right now it is completely different.
We managed to change the hash of this executable by changing its binary.
And this even though for many anti viruses, this is something that will not bypass them.
Even if you managed to bypass two or three additional anti viruses, that is good.
You did a slight change.
So this won't do much of a difference.
But everything you can change, you should, since you gain higher chances of bypassing antivirus as
well as if you have, for example, the source code of a payload, what you can do is you can try to
change it yourself a little bit, just add some random functions or make your program not do anything
for first minute or two after running.
All of these things can help you bypass antivirus.
OK, so these are just some of the ways that you can apply next time you create the payload.
Just remember one thing.
Whatever type of payload you create to be undetectable, it won't last long.
So this is something you will have to experiment with over and over again.
In the next video, we're going to see one of the ways we can mask our payload to look like a different
program.
See you there.