[MUSIC PLAYING]
Antivirus evasion with Shellter.
So welcome to the Antivirus Evasion and Obfuscation section
of this course, where we will be introducing you
to how antivirus solutions work and how they detect malware,
as well as how they can be evaded.
So in this specific video, we're going
to be taking a look at a very simple example, whereby we'll
be injecting reverse shellcode into a legitimate Windows
executable.
And that will serve two functions.
Number one, it will make the actual final executable look
legitimate because, for example, we can actually
take a look at how to inject our reverse shell
shellcode into a program like WinRAR or Google Chrome.
And again, as I said, that serves two functions.
That'll make it look legitimate so
that the end user, or your target,
will not be able to tell outrightly
that that program is malicious.
And secondly, this is an actual antivirus evasion technique.
And this is pertinent to signature-based detection.
So we are really going to be focused
on the fundamentals within this section and within this course,
primarily because antivirus evasion or defense
evasion in general is a very complex topic that
is multi-tiered and involves multiple techniques, tools,
and, of course, you also have to take into consideration
the vast number of EDRs or antivirus solutions out there.
So you might be asking yourself, well,
why does all of this matter?
Well, if we are able to generate an executable that, when
executed, provides us with the reverse shell,
that may evade Windows Defender, but it might not evade
Malwarebytes, for example.
So again, given the fact that the actual landscape
or the digital IT industry currently
has more than 100 antivirus solutions out there,
it can be a very, very complex process.
So we're essentially going to be focused on the fundamentals
here.
And, as I said, in this example, we're
going to be taking a look at how to evade
very basic signature-based antivirus
solutions by injecting our malicious shellcode,
our malicious reverse shell shellcode
into a legitimate executable with Shellter.
So before we actually get started, let's
get an understanding of defense evasion as a topic, right?
So this definition is--
I actually pulled it from the MITRE website.
And the reason I did that is because it perfectly
encapsulates the complexity of this topic.
So defense evasion consists of techniques
that adversaries use to avoid detection
throughout their compromise.
Techniques used for defense evasion
include uninstalling or disabling
the security software or the antivirus
or obfuscating or encrypting data and scripts.
Adversaries also leverage and abuse
trusted processes to hide and masquerade their malware.
Now, the area that we're focusing on here
is obfuscation and encryption, right?
So what we are trying to do is we
are trying to change the signature
of the malicious executable that we are generating.
So for example, if I generate a Meterpreter payload
with MSFvenom, if you transfer that onto a Windows system,
a modern Windows system like Windows 10,
that will be detected immediately.
Well, why is that?
How does an antivirus solution actually
know that that is malicious?
Well, that can be explained by getting
an understanding of the various antivirus detection methods.
So antivirus software will typically
utilize signature, heuristic, and behavior-based detection.
So let's get started with signature-based detection
first.
So this is the oldest and most commonly used detection method,
and it's still used by antivirus solutions
out there, even extremely powerful antivirus
solutions, one of which is Windows Defender.
But Windows Defender and some of the really advanced
commercial antiviruses actually use
a combination of more than one of these detection methods
to ensure that they're able to uniquely or, rather, accurately
identify malware whenever it's downloaded onto your system
or whenever an attacker is able to get
that malware onto your system.
So the way signature-based detection works
is the antivirus software has a database of virus signatures
or malware signatures, right?
And so what is an antivirus or a malware or virus signature?
A virus signature is a unique sequence of bytes, or rather
a unique string of text, that uniquely identifies malware
or files or executables that are malicious.
Right, now, how is this signature generated?
Well, again, the easiest way that this is done
is to just generate a hash of that executable
or to get the hash value of that executable, right?
And I'll not dive into that right now
because that's really not within the scope
of this course itself.
But the way this works is whenever
there's a new virus that has been developed
or, for example, new ransomware, the antivirus company will
actually have one of their engineers
go ahead and download that malware sample
into a secured environment.
What they will then do is analyze it.
And part of their analysis, and that's malware analysis,
will actually consist of generating
a signature, a unique signature that uniquely identifies
that malware.
That signature is then what is included
within the antivirus solutions signature database.
So whenever you download and install an antivirus solution
that utilizes a signature-based detection,
it comes with a database of signatures.
So let's take a look at a simple example.
If I download Google Chrome, for example,
I download the Google Chrome setup.
Once that file is saved on my disk,
the antivirus solution goes to work
and actually generates a hash of that executable
and then compares that hash, or that signature if you will,
to its own signatures within the signature database.
If it matches, then that means that executable is malware.
If it doesn't find a match, then, again, it's
actually-- it's not flagged as malware or as a virus.
So in terms of evading signature-based detection,
we can do this by modifying the malicious executable
or the malwares byte sequence, therefore
changing the signature.
So whenever an exploit developer creates a new piece of malware
or ransomware and a signature is generated or made
for that particular piece of malware,
that particular executable will be detected.
So again, going back to the example
of generating a Meterpreter payload with MSFvenom, if I
generate a Meterpreter payload with MSFvenom,
transfer it over to the target, the antivirus solution
will pretty much have a signature
that matches the actual signature or hash
of the Meterpreter payload.
But if we modify the byte sequence of that Meterpreter
payload, the actual hash of that executable or Meterpreter
payload changes, consequently meaning
that if that new hash is not--
if that new hash cannot be matched to an existing
signature within the antivirus signature database,
then it's not going to be flagged as malware.
Now, as I said, antivirus companies
have an extensive database of signatures.
So you really have to be smart about what you're doing.
And the easiest way, in this particular case,
is to inject our shellcode that we will generate
with Meterpreter into a legitimate executable,
therefore masking or generating a signature that, again,
in most cases, will not be included,
or generating a new signature that
is not part of an antivirus solutions signature database.
So that's signature-based detection.
We then have heuristic-based detection.
This relies on rules or decisions
to determine whether a binary or executable is malicious.
It also looks for specific patterns within the code
or program calls that have been made
by a particular executable.
We then have behavior-based detection.
This relies on identifying malware
by monitoring its behavior.
And this is typically used or is very effective
against new strains of malware.
And, again, the way behavior-based detection works
is this particular system involves
taking a look at what a program does when it's executed.
Is it actually taking a look at the Windows Registry?
Is it doing anything that is considered suspicious?
And if so, then that's going to be flagged as malicious
or it's going to be flagged as dangerous.
So these are the antivirus detection methods.
Now, in terms of the evasion techniques, there really are--
you can really categorize these into two,
or split them up into two.
So you have on-disk evasion.
And this is your typical scenario, right?
When you generate a Meterpreter payload,
that needs to be transferred over to the target.
And if it's then executed, if it's transferred over
to the target, it's going to be stored on the target system's
disk.
So this is where on-disk evasion techniques come into play.
So whenever an executable or a malicious file
is saved onto the disk, we actually
need to utilize different evasion techniques as opposed
to in-memory evasion techniques.
So number one, in terms of on-disk evasion techniques,
we have obfuscation.
Obfuscation refers to the process
of concealing something important, valuable,
or critical.
And what obfuscation does is it reorganizes code
in order to make it harder to analyze or to reverse engineer.
You then have encoding, right?
So encoding data is a process that
involves the changing of data into a new format using
an encoding scheme.
An example of encoding is encoding a particular string
of text into Base64.
The problem with encoding is that it
is easily reversible, which means that if you know what
a particular-- if you actually identify a piece of code that's
been encoded in Base64, if you can
tell that it's been encoded in Base64,
then you can decode it very easily.
So that's encoding.
You then have packing.
So packing essentially involves the process
of generating an executable with a new binary structure,
with a smaller size and, therefore, provides the payload
with a new signature.
This is typically used by various malicious attackers
whenever they are trying to generate executables that
will consequently give them remote access to a system,
et cetera, et cetera.
You then have crypters.
Crypters essentially encrypt code or payloads
and decrypts the encrypted code in memory.
The decryption key or function is usually stored in a stub.
So this is one of the techniques that's
typically used by new strains of ransomware,
whereby the actual code is encrypted.
And encryption cannot be--
whenever you come across encrypted code,
you cannot decode that.
You actually need the key, the actual decryption key
to decode it.
And in the case of ransomware, only the ransomware developers
have that key.
And that's why whenever a system gets infected with ransomware,
they ask you--
they essentially ask you to pay a specific amount of money.
They'll then send you the decryption,
the actual decryption key to decrypt your files.
So that's how crypters work.
So those are on-desk evasion techniques.
We then have your in-memory evasion techniques.
So in the context of antivirus evasion,
in-memory evasion techniques focuses
on manipulation of memory and does not write files to disk.
It involves injecting payloads into a process
by leveraging various Windows APIs.
And again, the payload is then executed
in memory in a separate thread.
So this involves evading antivirus detection in memory.
So this is an advanced technique that we will not
be covering within this section, probably
in an advanced course or certification.
So let's actually take a look at how we can inject shellcode
into a legitimate executable and how
that can be used to evade an antivirus, a very
basic antivirus detection.
And in this case, what we'll be doing is
we'll be trying to evade Windows Defender on a Windows 7 system.
So this video does not have a lab environment attached to it.
As I said, you can follow along and take a look
at the various tools I'm using.
All of these tools can be installed on Kali Linux
without any issue.
And you can try and replicate this within your own lab
environment.
So I'll just switch over to my Kali VM,
and we can get started.
All right, so I'm back on my Kali VM,
and let's get an introduction to Shellter
because that's the actual tool we're going to be using.
Now, you can install Shellter on Kali Linux,
as the package is a part of the official Kali Linux
repositories.
But you can head over to the shellterproject.com
to learn more about Shellter and how it works.
So let's get an introduction to Shellter.
So Shellter is a dynamic shellcode injection tool
and the first truly dynamic portable executable
infector ever created.
It can be used in order to inject shellcode
into native Windows applications,
currently 32-bit applications only so keep that in mind.
The shellcode can be something yours or something
generated through a framework such as Metasploit.
Shellter takes advantage of the original structure
of the portable executable file and doesn't
apply any modification, such as changing memory access
permissions in sections, unless the user wants
to do so, adding an extra section
with read, write, and execute access,
and whatever would look dodgy under an antivirus scan.
Shellter uses a unique dynamic approach,
which is based on the execution flow of the target application.
And this is just the actual tip of the iceberg.
Shellter is not just an EPO infector
that tries to find a location to inject or insert
an instruction into, to redirect execution to the payload.
Unlike any other infector, Shellters
advanced infection engine never transfers the execution flow
to a code cave or to an added section
in the infected portable executable file.
All right, so the really cool features with Shellter
is that, again, it's compatible with Windows x86 and x64,
and it works on Windows XP Service Pack 3 and above,
or newer versions of Windows.
And again, it works with Wine and, of course, Linux.
It works with Wine.
So whenever you install the Shellter package on your Linux
system, because it's an executable,
you actually need Wine.
Wine is a compatibility layer for Linux
that allows users on Linux or Unix operating systems
to execute EXE files.
The great thing is that it's portable,
so no setup is required.
It doesn't require dependencies.
That's fantastic.
It doesn't have any static PE, or Portable Executable
templates.
It supports any 32-bit payload, and it's
compatible with all types of encoding
by Metasploit, compatible with custom encoding created
by the user, so you can specify whether you
want to go through additional encoding.
And I've already covered, within the Metasploit framework
course, how to encode a payload with MSFvenom
and how that can also be used to evade very basic antivirus
solutions that utilize signature-based detection.
All right, so in order to install Shellter,
you can simply type in sudo apt-get install shellter here,
and that should install the Shellter package for you.
However, there's a very important aspect
that you need to take into consideration here.
The Shellter package is really a Windows executable.
Now, how will you run a Windows executable on Linux?
Well, that can be facilitated through the use
of a tool called Wine.
So you may have heard of Wine before.
Wine is a compatibility layer for Linux
that allows you to execute Windows executables on a Linux
system or on a Unix system like Mac.
So after installing the actual Shellter package,
you then need to install Wine.
Now, the specific architecture or the package
that we'll be installing in regards to Wine
is the Wine 32-bit package.
And this is primarily because Shellter only supports
32-bit payloads, or rather supports
the generation of shellcode of 32-bit shellcode.
So we actually need to configure the Debian package management
utility to essentially allow for--
allow us to install 32-bit packages.
Because right now, the current Kali Linux VM
that I'm utilizing is 64-bit.
And the Debian package management utility
has, of course, been already configured to only install
64-bit packages.
So to install 32-bit packages, we
will need to run the following command.
So we can say dpkg.
So that's the Debian package management utility.
So dpkg, and we say add.
And we can say architecture.
Oh, let me just type that in correctly.
So that's architecture.
And we then specify i386.
That's for 32 bits, so i386.
And we can then hit Enter.
And in some cases, it may ask you for root permissions.
So I'll say sudo dpkg --add-architecture.
And that's done.
I can now install wine32.
So I can say sudo apt-get install wine32,
which I currently already have, as you can see.
And I'm currently using the latest version.
And that has been installed successfully.
So at this point, you can now execute the Shellter executable
with Wine, or with wine32 in this case.
So let's take a look at how we can do that.
You can head over into /usr/share/windows-resources/,
not windows-binaries, but windows-resources.
And you'll have a folder called Shellter.
So within the Shellter directory,
you can see that you'll pretty much only have the Shellter
executable.
Disregard these two folders as these folders
will be created once you actually
execute Shellter itself.
So we have shellter.exe.
So how do you execute an EXE file on Linux?
Well, we can do that with Wine.
So in order to execute, we would say, sudo wine, and then
the actual EXE, so shellter.exe.
There we are.
I'll hit Enter, and that's going to start up Shellter.
So we don't have any issues there, and we can get started.
So let's get started with the actual injection process.
However, before we do that, we need
to identify a legitimate executable that we can actually
inject our shellcode into.
So this is where the whole social engineering aspect
of things comes into play.
So you can download an executable.
I would recommend that the executable
is very small and very simplistic
in terms of its functionality.
This will probably not work if you try
and inject your shellcode into an executable like the Chrome
installer or VLC or anything like that.
So on the Kali Linux system, if I head over into the file
system here under usr and under share
we have a directory called windows-binaries
that contains a list of executables that,
again, are used during a pen test
or during a security assessment.
And one of them is VNC Viewer.
So if you're not familiar with VNC Viewer,
this is a very simple Windows program.
It's not malicious at all.
It's completely legitimate, and it's essentially
used to connect to a VNC session or to essentially
establish a VNC session.
So it's just a utility that allows
you to essentially connect to a server or to a target system
and establish a VNC session.
So we can inject our shellcode into this executable.
So I'll just make a copy, and I'll head over into my desktop,
and I'll go into a folder called AVBypass, which I created.
And I recommend that you do the same.
So this is the original executable.
Now, the great thing with Shellter
is that whenever you perform the injection, a copy of this
will be made.
So a backup of the original will be made,
and it will actually be stored under the /usr/share/windows
resources/shellter directory, within Shellter_Backups.
So you can always get the original back.
But now that we've identified the actual legitimate
executable that we would like to inject our shellcode into,
and we have saved it within a directory
that we are familiar with, we can actually
begin the injection process.
So I'll just launch Shellter again.
And it's going to ask you to choose your operation mode.
For the purpose of this demonstration,
I'm going to say auto.
We then have the PE target.
This is the Portable Executable target,
or the legitimate executable that you would like
to inject your shellcode into.
You need to specify the path to the actual executable.
In this case, mine is being stored under Home,
under the Kali directory on my desktop,
in a folder called AVBypass.
And the name of the executable is vncviewer.exe.
So I'll hit Enter.
You can see it's going to make a backup,
and it will store it under Shellter_Backupsvncviewer.exe.
It's then going to, again, take a look at whether or not
the executable has been packed.
You can see that it's not packed.
It'll then move on to PE Info Elimination.
It'll take a look at the Dll characteristics,
and it'll provide you the status here.
So all related information has been eliminated.
So that's changing the signature as much as possible.
You then have your Tracing Mode.
So again, if you take a look at the note here,
you can see that in Auto Mode, Shellter
will trace a random number of instructions
for a maximum time of approximately 30 seconds
in native Windows hosts and for 60 seconds when used in Wine.
So it's essentially tracing and identifying
instructions where the shellcode can be injected into.
So I'll give this, as it says, up to 60 seconds.
All right, so as you can see, that's done.
And it's going to tell you Instructions Traced--
18,574.
It's then going to start the first stage filtering.
So it's going to ask you whether you
want to enable Stealth Mode.
Stealth Mode-- this is a very important step
because what it's asking you is whether you want the executable
to function as intended.
So for example, in this case, we are injecting the shellcode
into vncviewer.exe.
So it's asking us whether or not we want VNC Viewer to actually
function as normal, or to actually function normally
when executed.
So if we want that to happen, which I recommend that you do,
I would enable Stealth Mode.
So what that means is that whenever the target will click
on the new VNC Viewer that we are going to be generating
or that contains the injected shellcode,
VNC viewer will function as normal,
but the shellcode will be executed in the background.
So we'll say Yes.
It's then going to ask you for the payload
that you'd like to use.
So this is where the shellcode injection
process comes into play.
So again, you can obtain a Meterpreter session
on the target.
And you can, again, identify which
of these stages or payloads you would like to use.
And based on your option, it's then
going to generate the shellcode appropriately.
So for example, if I wanted to obtain a Meterpreter session,
I could use option 1.
So it's going to ask you whether you want to use
a listed payload or custom.
Now, if you want to go ahead and encode a payload with MSFvenom
firstly, or you want to generate a Meterpreter payload
and then encode it with MSFvenom,
you can do that and then specify a custom, a [? DDC ?] option
here, and then use that actual payload itself.
However, in this case, we are not going to be doing that.
So I'll just say option 1.
Or I'll say L first to use a listed payload.
And then I'll say-- it's going to ask you
to select the payload by index.
So I'll say option 1.
It's going to ask me for my L host information.
So this is going to be the attacker's IP address.
And in my case, my Kali Linux IP is 10.10.10.10.
The port is 1234.
I'll hit Enter.
And it's now going to begin the basic obfuscation.
And we can see it right over here, PolyMorphic Junk Code.
It's going to generate some junk code there.
And the most important stage is right over here.
So Injection Stage, it's going to tell you
where the shellcode has been injected.
And you can see right over here, under PE Checksum Fix,
the valid PE checksum has been set.
And under Verification, you can see that that--
right over here, injection verified,
and we can hit Enter to continue.
So we now have VNC Viewer, but the new executable
has the injected shellcode.
So remember, when I said that Shellter actually
takes a backup, it does that for a reason.
Because the new executable is going to replace the one
that was stored within the directory,
so within this particular directory.
So remember, I copied over the legitimate vncviewer.exe
to the AVBypass folder.
And this is now the malicious executable.
So it will take a backup first.
It'll then perform the injection.
And it's going to replace the older
one with the new malicious one.
So I can now copy this over to the target system,
and you'll see that it looks exactly like VNC Viewer.
It'll function exactly like VNC Viewer.
The only difference is that when it will be executed,
it will execute the shellcode, our Meterpreter
payload shellcode, and it'll then
connect back to our reverse tcp handler
that we will set up in the Metasploit framework right now.
So the first thing I want to do is
I'm just going to set up, or launch msfconsole
to set up the handler to receive the connection
once the shellcode is executed on the target.
So I'll give this a couple of seconds.
And I'll split my terminal vertically here
because we actually need to transfer
that executable to the target.
So I'll navigate to the directory
where the malicious VNC Viewer executable is stored.
So that's under AVBypass.
And I can start a simple web server.
So I can use the Python module.
So I'll say sudo python.
I can say python3 -m.
We can say http.server.
And on port 80.
So I'll host all the files within the AVBypass directory
on the Kali Linux IP on port 80.
So there we are.
That's serving all of those files.
Now in the Metasploit window here, I'll
say, use multi/handler to set up the handler or the listener.
And then I'll specify the payload that I used when I was
essentially generating the shellcode within Shellter,
which, in this case, in the case of Windows,
if you selected the Meterpreter option,
is always going to be the actual 32-bit Meterpreter payload,
so windows/meterpreter/reverse_tcp.
All right, I then need to set up my LHOST option.
And of course, these have to match the ones
that you had set when generating the actual shellcode
within Shellter, so my Kali Linux IP.
And then LPORT, we had specified as 1234.
And I can hit run.
And we can now, again, transfer over that executable.
So I'll switch over to the Windows 7 system.
Now the Windows 7 system has Windows Defender enabled,
but it's an older version of Windows 7.
It's Windows 7 build 7600, or--
and build 7601.
And it has-- it's actually a Service Pack 1 installation.
So let's actually see if we are able to bypass basic Windows
Defender.
So let me just switch over to the Windows system.
All right, so I'm back on the Windows system.
And again, now, the method of delivering
the actual malicious executable is entirely up to you.
I'm just going to be downloading it from the web server that I
set up, so 10.10.10.
And we have VNC Viewer there.
So I'll click on that there.
Save-- I'll save it in downloads.
And it looks like we haven't had any detection yet.
So it's been saved on disk there.
If we take a look at the Downloads folder,
you can see that it looks exactly like VNC Viewer here.
So I can also move it to the desktop
just so that you can see the icon even more clearly.
I think I've zoomed in too much there so let me just zoom out.
And let me refresh that there.
And we can see the VNC Viewer icon here.
And let me just get rid of that there.
So again, if I click on it, it should work exactly the way
VNC Viewer should work.
However, in the background, what's going to happen
is it's going to execute the actual shellcode that we
injected into it.
So I'll double click on it, Run, and you can see it works.
It works as intended, and a person can actually
use this for legitimate purposes,
but it had malicious shellcode injected into it.
So this particular executable has not
been detected by Windows Defender.
So if I switch back over to Kali Linux,
you should see that I have received a Meterpreter session
on my multi/handler listener.
So I'm back on Kali Linux.
And as you can see, we made a GET request,
where we downloaded VNC Viewer on the target system.
And once it was executed, we obtained a Meterpreter session
on the target system.
So I can say sysinfo.
And you can see Windows 7 Build 7601 Service Pack 1.
And I can say get user ID, for example.
And we're currently as the Windows 7 user.
So that is how to inject shellcode
into a legitimate executable for the purpose of evading
signature-based antivirus solutions.
And that is going to conclude the practical demonstration
side of this video.
All right, so that concludes the first video
within this section.
In the next video, we're going to be taking a look at how
we can obfuscate PowerShell code in order to evade antivirus--
in order to evade detection by antivirus solutions.
So I'll be seeing you in the next video.