Metasploit Encoders
When Metasploit launched, the msfpayload and msfencode tools
could be used to encode shellcode
in a way that effectively bypassed antivirus detection.
However, AV engines have improved over the years and the encoders are generally
used solely for character substitution
to replace bad characters in exploits payloads.
Nonetheless, in this section, we’ll use msfvenom to attempt a signature bypass.
To begin, let’s list the available encoders by running msfvenom
with the list encoders option.
The x86 shikata_ga_nia encoder highlighted above
is commonly used as it is a polymorphic encoder
that produces different output each time it's run
making it effective for signature evasion.
We’ll enable this encoder with the -e option,
supplying the name of the encoder as an argument,
and we’ll supply the other typical options.
Since the assembly code has been obfuscated,
we’ll copy the generated executable to our Windows 10 victim machine,
and scan it with ClamAV.
Based on the output, ClamAV detected the encoded shellcode inside the executable.
The reason this failed is because the encoded shellcode must be decoded
to be able to run and this requires a decoding routine.
This decoding routine itself is not encoded, meaning it is static each time,
making the decoder itself a perfect target for signature detection.
Let’s try a different approach.
Since 64-bit applications have only become popular in recent years,
it stands to reason that 64-bit malware and payloads are less common.
Perhaps this relative rarity will provide us an advantage.
To test this theory, let’s generate a 64-bit Meterpreter executable
without encoding.
We’ll copy it to our Windows 10 victim machine,
and scan it with ClamAV.
Interesting. ClamAV does not flag this as malicious.
Since this is a major victory, let’s push our luck
and scan the file with Avira as well.
Since we’re only interested in signature detection at this point,
we’ll execute Avira desktop,
navigate to Antivirus
Real-Time Protection,
and verify that real-time protection is turned off.
Next, we’ll click on the configuration menu at the upper-right corner.
In the configuration window, we’ll expand the System Scanner branch,
navigate to Scan
Heuristics,
then de-select the box labelled “Enable AHeAD”.
With the heuristics detection disabled, we’ll right-click the met64.exe executable
and execute an on-demand scan with Avira.
Avira detects the 64-bit shellcode.
Next, let’s use an encoder in an attempt to evade Avira.
Since this is a 64-bit executable, we cannot use the 32-bit shikata encoder.
Instead, we’ll use the x64/zutto_dekiru encoder,
which borrows many techniques from shikata.
Now let’s scan this version.
Avira flags this as well,
again detecting the signature of the decoder or of the template
When msfvenom generates an executable,
it inserts the shellcode into a valid executable
This template executable is static
and likely has signatures attached to it as well.
We could use the -x option to specify a different template.
To do this, we’ll copy the notepad application to Kali,
and use it as a template
We’ll copy the generated executable to our Windows 10 victim machine,
and again scan it with Avira.
However, Avira flags it once again.
So far, we have used Metasploit encoders to successfully bypass ClamAV
signature detection, but we were not successful against Avira.
Clearly, Metasploit encoders are no longer widely effective for this purpose.
In the next section, we will investigate the effectiveness
of specific encryption techniques for this task.