Original subtitles

where we will be introducing you to how

antivirus solutions work and how they

detect malware as well as how they can

be evaded. All right. So, in this

specific video, we're going to be taking

a look at a very simple example uh where

whereby we'll be injecting reverse shell

shell code into a legitimate Windows

executable. And that will serve two

functions. is number one, it'll make the

the actual final executable uh look

legitimate because uh for example, we

can we can actually take a look at how

to inject uh you know our reverse shell

shell code into a program like WinRAR or

Google Chrome and uh again as I said

that serves two functions that will make

it look legitimate so that the end user

or your target will not be able to tell

outrightly that that program is

malicious and secondly this is an actual

antivirus evasion technique and this is

pertinent to signaturebased detection.

So, we're really going to be focused on

the fundamentals within this section and

within this course primarily because

antivirus evasion or defense evasion in

general is a very complex topic that is

multi-tered and involves multiple

techniques, tools uh and of course you

also have to take into consideration the

vast number of EDRs or antiv antivirus

solutions out there. So, you might be

asking yourself, well, why does all of

this matter? Well, you know, if we are

able to generate a an executable that

when executed provides us with a reverse

shell, uh that may evade Windows

Defender, but it might not evade uh

malware bites, for example. So again,

given the fact that uh you know the

actual landscape or the uh you know the

digital IT industry currently has more

than 100 antivirus solutions out there,

it can be a very very complex process.

So, we're essentially going to be

focused on, you know, the fundamentals

here. And as I said in this example,

we're going to be taking a look at how

to evade very basic uh signature based

antivirus solutions by injecting our

malicious shell code uh our malicious

reverse shell shell code into a

legitimate executable with shelter. So,

before we actually get started, let's

get an understanding of defense evasion

as a topic. Right. So this definition is

uh I actually pulled it from the MITER

website and the reason I did that is

because it uh perfectly encapsulates the

complexity uh of this topic. So defense

evasion consists of techniques that

adversaries use to avoid detection

throughout their compromise. Techniques

used for defense evasion include

uninstalling or disabling the security

software or the antivirus or obfuscating

or encrypting data and scripts.

Adversaries also leverage and abuse

trusted processes to hide and masquerade

their malware now. The area that we're

focusing on here is obfuscation and

encryption. Right? So what we're trying

to do is we're trying to change the

signature of the malicious executable

that we're generating. So for example,

if I generate a interpreter payload with

MSF Venom, if you transfer that onto a

Windows system, a modern Windows system

like Windows 10, that will be detected

immediately. Well, why is that? Why how

does an antivirus solution actually know

that that is malicious? Well, that can

be explained by getting an understanding

of the various antivirus detection

methods. So, antivirus software will

typically utilize signature huristic and

behavior-based detection. So, let's get

started with signaturebased detection

first. So this is the oldest and most

commonly used detection method and it's

still used by antivirus solutions out

there even extremely powerful uh

antivirus solutions one of which is

Windows Defender but Windows Defender

and uh you know some of the uh really

advanced commercial

antiviruses actually use a combination

of more than one of these detection

methods to ensure that they're able to

uniquely or rather accurately identify

malware whenever it's downloaded onto

your system or whenever an attacker uh

you know is able to get that malware

onto your system. So the way signature

based detection works is the antivirus

software has a database of virus

signatures or malware signatures right

and uh so what is an antivirus or a

malware or virus signature? A virus

signature is a unique sequence of bytes

or rather a unique string of text that

uniquely identifies malware or files or

executables that are malicious. Right

now, how is this signature generated?

Well, uh again, the easiest way that

this is done is to just generate a hash

of that executable or to get the hash

value of that executable, right? And

I'll not I'll not dive into that right

now because that's really not within the

scope of this course itself. Uh but the

way this works is whenever there's a new

virus that has been developed or you

know for example new ransomware the

antivirus company uh will actually have

one of their engineers uh go ahead and

download that malware sample into a

secured environment. What then what they

will then do is analyze it and part of

their analysis and that's malware

analysis will actually consist of

generating a signature a unique

signature that uniquely identifies that

malware. That signature is then what is

included within the antivirus solutions

uh signature database. So whenever you

download and install an antivirus

solution that utilizes a signature based

detection, it comes with a database of

signatures. So let's take a look at a

simple example. If I download uh Google

Chrome for example, right? I download

the Google Chrome setup. Once that file

is saved on my disk, the antivirus

solution goes to work and actually

generates a hash of that executable and

then compares that hash or that

signature if you will uh to its own

signatures within the signature

database. If it matches, then that means

that that executable is malware. If it

doesn't find a match then again it's uh

it's actually it's not flagged as

malware or as a virus. So in terms of

evading uh signature based detection we

can do this by modifying the malicious

executable or the malware's bite

sequence therefore changing the

signature. So uh whenever an exploit

developer creates a new piece of malware

or ransomware and a signature is

generated or made for that particular

piece of malware that that particular

executable will be detected. So again

going back to the example of generating

a interpreter payload with MSF venom. If

I generate a interpreter payload with MS

of Venom, transfer it over to the

target, the antivirus solution, uh we'll

pretty much have a signature that

matches that uh the the actual signature

or hash of the interpreter payload. But

if we modify the bite sequence of that

interpreter payload, the actual hash of

that executable or interpreter payload

changes. Consequently meaning that if

that new hash is not uh if that new hash

cannot be matched to an existing

signature within the antivirus signature

database then it's not going to be

flagged as malware. Now as I said

antivirus companies have an extensive

database of signatures. So you really

have to uh you know you really have to

be smart uh about you know what you're

doing and the easiest way in this

particular case is to inject our shell

code that we will generate with

interpreter into a legitimate

executable. Therefore, masking or you

know generating a signature that is uh

that again in most cases will not be

included or uh you know generating a new

signature that is not part of uh you

know an antivirus uh solutions signature

database. So that's signature based

detection. We then have heristic based

detection. This relies on rules or

decisions to determine whether a binary

or executable is malicious. uh it also

looks for specific patterns within the

code or program calls that have been

made by uh you know a particular

executable. We then have behavior based

detection. This relies on identifying

malware by monitoring its behavior. And

this is typically used uh or is very

effective against new strains of

malware. And again the way behavior

based detection works is uh this

particular system involves taking a look

at what a program does when it's

executed. Is it uh is it actually taking

a look at the Windows registry? Is it

doing anything that is considered

suspicious? And if so, then that's going

to be flagged as malicious or a it's

going to be flagged as dangerous. Right?

So these are the antivirus detection

methods. Now in terms of the evasion

techniques, uh they really are you can

really categorize these into two or

split them up into two, right? So you

have on disk evasion and this is your

typical scenario, right? uh when you

generate a interpreter payload that

needs to be transferred over to the

target and uh if it's then executed uh

you know if it's if it's transferred

over to the target it's going to be

stored on the target systems disk. So

this is where on disk evasion techniques

come into play. So whenever a an

executable or uh you know a malicious

file is saved onto the disk uh we

actually need to utilize different

evasion techniques as opposed to

in-memory evasion techniques.

So uh number one in terms of on disk

evasion techniques we have obfuscation.

Obfuscation refers to the process of

concealing something important, valuable

or critical. And what obusiscation does

is it reorganizes code in order to make

it harder to analyze or to reverse

engineer. You then have encoding, right?

So encoding data is a process of uh that

involves the changing of data into a new

format using a an encoding scheme. An

example of encoding is encoding a

particular string of text into base 64.

The problem with encoding is that it is

easily reversible, right? Uh which means

that if you know what a partic if you if

you actually identify a piece of code

that's been encoded in B 64, if you can

tell that it's been encoded in B 64,

then you can decode it very easily.

Right? So that's encoding. You then have

packing. So packing essentially in

involves the process of generating an

executable with a new binary structure

with a smaller size and therefore

provides the payload with a new

signature. This is typically used by uh

by various uh you know malicious

attackers uh whenever they're trying to

generate uh you know executables uh that

you know will consequently give them

remote access to a system uh etc etc.

You then have cryptors. Cryptors

essentially encrypt code or payload uh

or payloads and decrypts the encrypted

code in memory. The the decryption key

or function is usually stored in a stub.

So uh this is one of the techniques that

typically used by new strains of

ransomware whereby the actual um the

actual code is encrypted right and uh

encryption cannot be uh cannot you when

whenever you come across encrypted code

you cannot uh decode that you actually

need the key uh the actual decryption

key to decode it and uh in the case of

ransomware uh only the ransomware

developers have that key and that's why

whenever you a system gets infected with

ransomware, they ask you uh you know

they essentially ask you to pay a

specific amount of money. They'll then

send you the decryption the actual

decryption key to decrypt your files,

right? So that's how cryptos

work. So those are on disk evasion

techniques. We then have uh you know

your in-memory evasion techniques. So

uh in the context of antivirus evasion

uh inmemory evasion techniques focuses

on manipulation of memory and does not

write files to disk. Uh it involves

injecting payloads into a process by

leveraging various Windows APIs and

payload uh again the payload is then

executed in me uh in memory in a

separate thread. So uh this involves

evading antivirus antivirus detection uh

in memory right. So this is an advanced

technique that will we will not be

covering within this section probably in

an advanced course or

certification. All right. So let's

actually take a look at how we can

inject uh you know shell code into a

legitimate executable and uh you know

how that can be used to evade uh an

antivirus uh you know a very basic um

antivirus detection. And in this case um

what we'll be doing is we'll be trying

to evade uh Windows Defender on a

Windows 7 system. So this uh video does

not have a lab environment attached to

it. As I said you can uh you can follow

along and take a look at the various

tools I'm using. Uh all of these tools

can be installed on Kali Linux without

any issue and you can try and replicate

this within your own lab environment. So

I'll just switch over to my Kali VM and

we can get started.

All right. So, I'm back on my Kali VM

and uh let's get an introduction to

Shelter because that's the the the

actual tool we're going to be using.

Now, you can install Shelter on Kali

Linux as uh the package is a part of the

official Kali Linux repositories, but

you can head over to the shelter

project.com uh to learn more about

Shelter and how it works. So, let's get

an introduction to Shelter. All right.

So, Shelter is a dynamic shell code

injection tool and the first truly

dynamic portable portable executable uh

infectctor ever created. It can be used

in order to inject shell code into

native Windows applications currently

32-bit applications only. So, keep that

in mind. The shell code can be something

yours or something generated through a a

framework such as Metas-ploit. Um,

shelter takes advantage of the original

structure of the portable executable

file and doesn't apply any modification

such as changing memory access

permissions in sections unless the user

wants to do so. Adding an extra section

with readr uh and execute access and

whatever would look dodgy under an

antivirus scan. Shelter uses a unique

dynamic approach which is based on the

execution flow of the target

application. And this is just the tip

the the actual tip of the iceberg.

Shelter is not just an EPO infectctor

that tries to find a location to inject

an in uh to inject or insert an

instruction into to redirect execution

to the payload. Unlike any other

infectctor, Shelter's advanced infection

engine never transfers the execution

flow to a code cave or to an added

section in the infected portable

executable file. All right. So, the

really cool features with Shelter is

that again it's compatible uh with

Windows x86 and x 64 and it works on

Windows XP Service Pack 3 and above or

newer versions of Windows. And again, it

works uh with Wine uh and of course

Linux. Uh it works with Wine. Um so

whenever you install the shelter package

uh on your Linux system because it's an

executable, you actually need Wine. Wine

is a compatibility layer for Linux that

allows uh users on Linux or Unix

operating systems to execute .exe files.

Uh the great thing is that it's

portable, so no setup is required. It

doesn't require dependencies. That's

fantastic. It doesn't have any static PE

or portable executable templates. Uh it

supports any 32-bit payload and it's

compatible with all types of encoding by

Metas-ploit. Uh compatible with custom

encoding created by the user. So you can

specify whether you want to go through

additional encoding and I've already

covered within the metas-ploit framework

course how to encode a payload uh with

MSF venom and uh you know how that can

also be used to uh to evade very basic

uh antivirus solutions that utilize

signaturebased detection. All right so

uh in order to install shelter you can

simply type in pseudoapp get install uh

shelter here and that should install the

shelter package for you. However,

there's a very important uh aspect uh

that you need to take into consideration

here. The shelter package is really a

Windows executable. Now, how will you

run a Windows executable on Linux? Well,

that can be facilitated through the use

of a tool called Wine. All right, so you

may have heard of Wine before. Wine is a

compatibility layer for Linux that

allows you to execute Windows

executables uh on a Linux system or on a

Unix system like Mac. So after

installing the pack the the actual

shelter package, you then need to

install wine. Now the specific uh

architecture or the package that we'll

be installing in in regards to wine is

the wine 32bit package and uh this is

primarily because shelter only supports

32-bit payloads or rather supports the

generation of shell code of 32-bit shell

code, right? So uh we actually need to

configure the Debian package management

utility to uh essentially allow for uh

you know allow us to install 32-bit

packages because uh right now the the

current Kali Linux VM that I'm utilizing

is 64-bit and the Debian package

management utility uh has of course been

already configured to only install

64-bit packages. So to install 32-bit

packages we'll need to run the following

command. So we can say DPKG. All right.

So that that's the Debian package

management utility. So DPKG and we say

add and we can say

architecture. Uh let me just type that

in correctly. So that's

architecture. And we then specify I386.

That's for 32bit. So

i386. And we can then hit

enter. And uh in some cases it may ask

you for root permissions. So I'll say

sudo dpkg add architecture and that's

done. I can now install uh you know wine

32. So I can say sudo apt get

install wine 32 which I currently

already have as you can see and I'm

currently using the latest version and

that has been installed successfully. So

at this point you can now execute the

shelter executable with wine uh or with

wine 32 in this case. So let's take a

look at how we can do that.

uh you can head over into user share

Windows resources not Windows binaries

but Windows resources and you'll have a

folder called shelter. So within the

shelter directory you can see that uh

you'll pretty much only have the shelter

executable. Disregard these two folders

as these folders will be created uh once

you actually execute shelter itself.

Right? So we have shelter.exe. So, how

do you execute an exe file on Linux?

Well, we can do that with wine. So, in

order to um in order to execute it, it

will say sudo wine and then the the

actual exe. So, shelter uh

shelter.exe. There we are. I'll hit

enter and that's going to start up

shelter. So, we don't have any issues

there and we can get started. So, uh

let's get started with um with the

actual injection process. However,

before we do that, we need to identify a

legitimate executable uh that we can

actually inject our shell code into. So,

this is where the whole social

engineering um you know aspect of things

comes uh into play. So, you can download

an executable. Uh I would recommend that

the executable is uh very small and very

uh very simplistic in terms of its

functionality. uh this will probably not

work if you try and inject you know your

shell code into an an executable like

the Chrome installer or VLC or anything

like that. So uh on the Kali Linux

system um if I head over into the file

system here under

user and under

share we have a directory called Windows

binaries that contains a list of

executables uh that uh again I used

during a pentest or uh during a security

assessment and one of them is VNC

viewer. So if you're not familiar with

VNC viewer this is a very simple Windows

program. It's not malicious at all. it's

completely legitimate. Uh, and it's

essentially used to connect to a VNC uh,

session or to essentially establish a

VNC session, right? So, it's just a

utility that allows you to uh, to

essentially connect to a server or to a

target system and establish a VNC

session. So, we can inject our shell

code into this executable. So, I'll just

make a copy and I'll head over into my

desktop and I'll go into the folder

called AV bypass which I created and I

recommend that you do the same. So this

is the original executable. Now the

great thing with shelter is that

whenever you perform the injection, a

copy of this will be made. Uh so a

backup of the original will be made and

it will actually be stored under the

user share Windows resources shel uh

shelter directory uh within shelter

backups. So you can always get the

original back. Uh but now that we've

identified the the actual legitimate

executable that we would like to inject

our shell code into and we've saved it

within a directory that we are familiar

with, we can actually begin the

injection process. So I'll just launch

shelter

again and it's going to ask you to

choose your operation mode. For the

purpose of this demonstration, I'm going

to say auto. We then have the PE target.

This is the portable executable target

or the legitimate executable that you'd

like to inject your shell code into. You

need to specify the path to the actual

executable. In this case, mine is being

stored under home under the Cali

directory on my

desktop in a folder called AV

bypass. And the name of the executable

is VNC

viewer.exe. So I'll hit enter. You can

see it's going to make a backup and it

will store it under shelter backups VNC

viewer.exe. It's then going to again

take a look at whether or not the

executable has been packed. You can see

that it's not packed. Uh it'll then move

on to PE info elimination. It'll take a

look at the DLL characteristics and

it'll uh it'll provide you the status

here. So all related information has

been eliminated. So that's changing the

signature as much as possible. You then

have your tracing mode. So again uh if

you take a look at the note here you can

see that in auto mode shelter will trace

a random number of instructions for a

maximum time of approximately 30 seconds

in native Windows hosts and uh for 60

seconds when used in wine. So it's

essentially tracing and identifying uh

instructions where the shell code can be

injected into. So I'll give this as it

says up to 60

seconds. All right. So, as you can see,

that's done. And it's going to tell you

instructions, instructions traced, uh,

18,574. Uh, it's then going to start the

first stage filtering. So, it's going to

ask you whether you want to enable

stealth mode. Uh, stealth mode where

this is a very important step because

what it's asking you is whether you want

the executable to function as intended.

So, for example, in this case, we are

injecting the shell code into VNC

viewer.exe. So it's asking us whether or

not we want VNC viewer to to actually

function as normal or to to actually

function normally when executed. So if

we want that to happen, which I

recommend that you do, I would uh I

would enable stealth mode. So what what

that means is that whenever the target

will click on the new VNC viewer that we

have uh that we're going to be

generating or that contains the injected

shell code, uh VNC viewer will function

as normal, but the shell code will be

executed in the background. Right? So

we'll say yes. It's then going to ask

you for the payload that you'd like to

uh that you'd like to use. So this is

where the shell code injection process

comes into play. So uh again you can you

can obtain a interpreter session on the

target and you can again identify which

of these stages or payloads you'd like

to use and based on your option it's

then going to gen it's then going to

generate the shell code appropriately.

So for example if I wanted to obtain an

interpreter session I could use uh

option one. So it's going to ask you

whether you want to use a listed payload

or custom. Now uh if you want to go

ahead and encode a payload with MSF

Venom uh firstly or you want to generate

an interpreter payload and then encode

it with MSF Venom, you can do that and

then specify a custom the DC option here

and then use that that actual payload

itself. However, in this case, we're not

going to be doing that. So I'll just say

option one or I'll say L first to use a

listed payload and then I'll say it it's

going to ask you to select the payload

by index. So I'll say option one. It's

going to ask me for my L-host

information. So this is going to be the

attacker's IP address and in my case my

Kali Linux IP is 10 10 10. Uh the port

is 1 2 3 4. I'll hit

enter and it's now going to begin the

obus uh basic

obuscation and uh we can see it right

over here polymorphic junk code. It's

going to generate some junk code

there and uh the most important stage is

right over here. So injection stage it's

going to tell you where the shell code

has been injected and you can see right

over here

um under P checksum fix uh the valid P

checksum has been set and uh under

verification you can see that that uh

right over here injection verified and

we can hit enter to continue. So the uh

we now have uh VNC viewer but the new

executable has the injected shell code.

So remember when I said that shelter

actually takes a backup, it does that

for a reason because uh the new

executable is going to replace the one

that was stored uh within the directory,

right? Um so we're within this

particular directory. So remember I

copied over the legitimate VNC viewer

exe to the AV bypass folder and this is

now the malicious executable. So it will

take a backup first. It'll then perform

the injection and uh it's going to

replace the older one with the new

malicious one. So I can now copy this

over to the target system and you'll see

that it looks exactly like VNC viewer.

It will function exactly like VNC

viewer. The only difference is that when

it will be executed, it'll execute the

shell code uh our interpreter payload

shell code and it'll then connect back

to our reverse TCP handler that we will

set up in the metas-ploit framework

right now. So the first thing I want to

do is I'm just going to set up uh or

launch MSF console to set up the handler

to receive the connection once the shell

code is executed on the target. So I'll

give this a couple of seconds and I'll

split my terminal vertically here

because we actually need to transfer

that executable to the target. So I'll

navigate to the directory where the

malicious VNC viewer executable is

stored. So that's under AV bypass and I

can start a simple web server. So I can

use uh the Python module uh so I'll say

sudo

python I can say python 3 uh m we can

say https server and on port 80. So I'll

host the uh I'll host all the files

within the av bypass directory on the

kali linux IP on port

80. So there we are that's serving all

of those files. Uh now in the

metas-ploit window here I'll say use

multi- handler to set up the handler or

the listener and then I'll specify the

payload that I used when I was when I

was essentially generating the shell

code within shelter which in this case

uh in the case of Windows if you

selected the interpret option is always

going to be the 30 the actual 32-bit

interpreter payload. So Windows

interpreter reverse

TCP. All right. Right. I then need to

set up my Lost option and of course

these have to match the ones that you

had set when generating uh the actual

shell code within shelter. So my Kali

Linux IP and then Lport we had specified

as uh 1 2 3 4 and I can hit

run and uh we can now again transfer

over that executable. So I'll switch

over to the Windows 7 system. Now the

Windows 7 system has Windows Defender

enabled but it's an older version of

Windows 7. It's Windows 7 uh build 76 uh

7600 or and uh build 7601 and uh it has

um it's it's actually a service pack one

installation. So let's actually see if

we are able to bypass uh you know basic

Windows Defender. So let me just switch

over to the Windows

system. All right. So, I'm back on the

Windows system and uh again, now the

method of delivering the the actual

malicious executable is entirely up to

you. I'm just going to be downloading it

from the web server that I set up. So,

10

10. And we have VNC viewer there. So,

I'll click on that there. Save. I'll

save it in downloads. And it looks like

we haven't had any um detection yet. So,

it's been saved on disk there. If we

take a look at the downloads folder, you

can see that it looks exactly like VNC

viewer here. So, I can also move it to

the desktop just so that you can see the

icon even more clearly. Uh, I think I've

zoomed in too much there. So, let me

just zoom

out and let me refresh that there. And

we can see the VNC viewer icon here. And

let me just get rid of that there. So,

again, if I click on it, it should work

exactly the way VNC viewer should work.

However, in the background, what's going

to happen is it's going to execute the

uh the actual shell code that we

injected into it. So, I'll double click

on it. Run. And you can see it works u

you know it works as intended. And a

person can actually use this for

legitimate purposes. Uh but it had um

you know it had malicious shell code

injected into it. So we this particular

executable has not been detected by

Windows Defender. So if I switch back

over to Kali Linux, uh you should see

that I have received a interpreter

session on my uh on on my multi-Handler

listener. All right. So I'm back on Kali

Linux and as you can see we made a get

request or we downloaded VNC viewer on

the target system and uh once it was

executed we obtained a interpreter

session on the target system. So I can

say sis info and you can see windows 7

build 7601 service pack 1 and I can say

get use ID for example and we're

currently as the Windows 7 user. So that

is how to inject SH code into a

legitimate executable for the purpose of

evading uh signature based antivirus

solutions. And uh that is going to

conclude the practical demonstration

side of this video.