Metasploit Encryptors
In 2018, Rapid7 launched updated options for encryption,
which were designed to address the growing ineffectiveness of encoders
for antivirus evasion.
Let’s investigate the effectiveness of this feature.
To begin, we’ll run msfvenom with list encrypt to list the encryption options.
Leveraging the strength of aes256 encryption,
we’ll generate an executable with aes256- encrypted shellcode,
and use a custom encryption key through the encrypt-key option.
Let’s copy the encrypted executable to our Windows 10 victim machine
and run an on-demand Avira scan.
Unfortunately, our executable is still flagged.
According to Rapid7, this feature is effective for antivirus evasion,
but the decryption routine itself can still be detected since it is static.
Our analysis so far has revealed that encryption will not be effective for
bypassing security solutions
if the decoding or decryption techniques are static,
since they will be analyzed over time and signatures will be written for them.
It’s time to change tactics once again.
The most effective solution at this point is to write our own shellcode runner
In the next section, we’ll begin this process