Solved

Metasploit payload reverse_tcp

Posted on 2015-01-19
2
149 Views
Last Modified: 2015-01-22
Experts,

I am doing pentesting as a proof of concept.

In regards to a reverse_tcp payload from Metasploit, is there a way to make it not be an .exe file? I can't upload .exe at my particular website.  Is there a tool that I can run my payload through so that it can be hidden/disguised and not picked up by my antivirus?
0
Comment
Question by:trojan81
2 Comments
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
ID: 40559369
you could use winrar/winzip and encrypt the .exe into the zipx/rar archive
0
 
LVL 62

Accepted Solution

by:
btan earned 500 total points
ID: 40559409
password protect the exe is one mean but be wary it can be dropped by security devices as well esp such as email exchanges etc. I was thinking to remove it fingerprint such as MZ in header etc but that will not enable it to run off w/o changing back, and now AV and equivalent is capable to detect that too...

Assuming the objective is to make the exe undetectable by AV, you can check out PEScrambler is a tool to obfuscate win32 binaries automatically. The idea is to encode the file such that antivirus/anti malware cannot detect it (easily). Another in Metasploit, you can check out "shikata_ga_nai" but that is also encoding but fall in the same limitation though chances of detection are slightly lower.

...Another "common" mean is separating the exe and payload e.g. modify the signature of your intended metasploit payload or to write your own shellcode and to play with different packers and encoders until you have an executable which will be undetectable. See this blog sharing

also i see this of interest as well using the "-k" option with the "shikata_ga_nai" e.g. shikata_ga_nai -c 5 -t exe -k -x /root/Some_Dir/legitimate.exe >  /root/Desktop/legitimate-payload_2.exe . Simply, that option is to have the payload launched as a separate thread allowing the legitimate executable to launch normally in an attempt to avert user suspicion.
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You may have a outside contractor who comes in once a week or seasonal to do some work in your office but you only want to give him access to the programs and files he needs and keep privet all other documents and programs, can you do this on a loca…
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now