Antiscan.me
The AntiScan.me website is a good option to check multiple AV scanners
at the same time.
We can use this service to check our C shell wrapper binary
and determine if it’s detected by any other product.
Let's run a simple test using a know malicious file.
A good choice would be the simple Meterpreter ELF files
that we generated earlier.
Antiscan will only accept files with an extension of .exe so we will rename
the files in our Kali VM and then upload them to Antiscan’s website.
This may not be a completely valid test as we don’t know how Antiscan handles
files on the backend, and the requirement to have files with an extension of .exe
indicates they’re likely expecting Windows malware samples.
Still, this test will allow us to at least get an idea of whether basic
Linux Meterpreter payloads are caught.
First, we’ll scan the 32-bit Linux Meterpreter ELF file
that we generated previously.
The file is detected by 8 of 26 products.
At least some of the scanners recognize the file specifically as an ELF file
with a malicious payload or as Linux-based.
This tells us that Anitscan.Me is at least partially Linus aware.
If we try to scan our 64-bit Linux Meterpreter ELF file,
it is detected by seven of the scanners.
This isn't a reassuring result,
but at least some of the products dedected our file.
Note that the scanners identify the file as an ELF file and the payload
as Linux-based, similar to our 32-bit example.
Also note that Kaspersky detected the binary in the same manner
as it did on our system, which indicates that the signatures are the same
and we’re doing at least a reasonably fair comparison.
Now that we know the scanners work, we’ll try our simple C shellcode wrapper binary.
After renaming wih an .exe extension,
we can upload it to the website.
Surprisingly, it is only detected by 2 of 26 possible products.
Avast and AVG both detected our sample as malicious and, as expected,
Kaspersky did not.
Although this is a satisfactory result let’s Try Harder.
In order to avoid detection by the last two scanners, we’ll obfuscate
our original shellcode string.
We can do this by creating an encoder program to perform an XOR operation
on our payload string to produce the new obfuscated version.
We’ll then take the output of our encoder and replace our original C wrapper’s
payload with the obfuscated version we produced.
We’ll also add an XOR decoder to our original C program to deobfuscate
the payload in memory before executing it.
The code for our encoding program is very similar to our original C program.
The key difference lies in the main loop.
Instead of running the payload, we’re converting each character using XOR
and printing it to the console.
The code includes our original msfvenom-generated shellcode buffer
as a character array.
It defines an XOR key value (in this case, “J”),
and calculates the length of the buffer string and stores that value
as an integer in the payload_length variable..
The program then iterates through the characters,
performing a bitwise-XOR operation on them with the XOR key we chose.
Next, it prints the newly encoded hex value to the screen
so that we can copy it later.
We can use gcc to compile our encoder.
Once we’ve done that, we can run it to get the encoded version of our shellcode
as printed output in the command line.
We can copy the output string from our encoder and replace the payload string
in our original C wrapper.
In addition, we need to modify our original C wrapper’s main function
to decode the shellcode before we try to run it.
Our newly modified C wrapper program behaves as a combination of our
original C wrapper and our encoder program.
We define our payload buffer, which is now obfuscated,
as the result of our encoder program’s output.
We define our XOR key and get the size of the payload,
stored in the arraysize variable.
We then iterate through the payload string as we did in the encoder,
performing an XOR operation on each character as we did before.
Since our payload is already obfuscated and XOR is a symmetric cipher,
performing XOR on it with the same key will deobfuscate each character,
resulting in our original payload string.
We then run our shell as we did in our original C wrapper.
If we compile and run the program.
we notice that we get a shell in our Metasploit listener.
Now that we know that the shell works properly,
let’s try scanning it with Antiscan.me.
We’ll repeat the process of renaming the file to an .exe,
and upload it to Antiscan.Me.
The results show that our changes were sufficient to bypass all 26 scanners.
The fact that our XOR-based shellcode wrapper program bypassed all of the
scanners shows the minimal effort required
to evade at least some Linux antivirus programs.
In the next section, we’ll discuss shared libraries in Linux
and how we can abuse them during a security assessment.