Solved

Metasploit payload reverse_tcp

Posted on 2015-01-19
2
161 Views
Last Modified: 2015-01-22
Experts,

I am doing pentesting as a proof of concept.

In regards to a reverse_tcp payload from Metasploit, is there a way to make it not be an .exe file? I can't upload .exe at my particular website.  Is there a tool that I can run my payload through so that it can be hidden/disguised and not picked up by my antivirus?
0
Comment
Question by:trojan81
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 81

Expert Comment

by:David Johnson, CD, MVP
ID: 40559369
you could use winrar/winzip and encrypt the .exe into the zipx/rar archive
0
 
LVL 64

Accepted Solution

by:
btan earned 500 total points
ID: 40559409
password protect the exe is one mean but be wary it can be dropped by security devices as well esp such as email exchanges etc. I was thinking to remove it fingerprint such as MZ in header etc but that will not enable it to run off w/o changing back, and now AV and equivalent is capable to detect that too...

Assuming the objective is to make the exe undetectable by AV, you can check out PEScrambler is a tool to obfuscate win32 binaries automatically. The idea is to encode the file such that antivirus/anti malware cannot detect it (easily). Another in Metasploit, you can check out "shikata_ga_nai" but that is also encoding but fall in the same limitation though chances of detection are slightly lower.

...Another "common" mean is separating the exe and payload e.g. modify the signature of your intended metasploit payload or to write your own shellcode and to play with different packers and encoders until you have an executable which will be undetectable. See this blog sharing

also i see this of interest as well using the "-k" option with the "shikata_ga_nai" e.g. shikata_ga_nai -c 5 -t exe -k -x /root/Some_Dir/legitimate.exe >  /root/Desktop/legitimate-payload_2.exe . Simply, that option is to have the payload launched as a separate thread allowing the legitimate executable to launch normally in an attempt to avert user suspicion.
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
In this blog we highlight approaches to managed security as a service.  We also look into ConnectWise’s value in aiding MSPs’ security management and indicate why critical alerting is a necessary integration.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question