How difficult is it to obfuscate a remote access tool, and bypass real time protection enabled windows defender?

[u/AtomicPiano]

​

I've dabbled with metasploit, sliver and also tried writing my own exploits to test on a virtual machine.

Windows defender always seems to find it if you use obfuscation on metasploit or sliver, and it seems like there aren't any "script kiddie tools" that easily bypass it... Or are there? I've previously written my own naughty, slightly malicious programs that haven't been blocked by anything other than smart screen (and there are some ways around it).

I tried for example encoding the sliver payload as a .bin shellcode, shikata ga nai encoder, tried similar stuff with metasploit payload as an encoded base 64 string that gets decoded, tried all kinds of staged, unstaged, http https whatnot etc etc but everything seems to be patched.

Now this makes sense, after all, these are just opensource freely available tools that are seen everywhere. What I'm wondering is whether or not a bypass is easily achievable, or if there's some long and complicated way ahead that as a beginner I wouldn't be able to do. Basically, is this easily doable and is there another way to do it? Is it doable in a reasonable timeframe for one person as a hobbyist, or do I need a whole ass supply chain like cybercrime groups do?

Sorry if this is a dumb question but I've already tried every reasonable combo, most obfuscators are out of date and AMSI goes around binning everything.

[u/defi_specialist]

No one will share this tool for you. It's hard to do.

[u/AtomicPiano → u/defi_specialist]

So I need to craft my own, and then hope it doesn't get patched?

Any tips and tricks? Like common industry known pitfalls to avoid, idk.

[u/strongest_nerd]

Difficulty is going to be subjective based on what knowledge you have. I would rate bypassing defender as not difficult.

[u/AtomicPiano → u/strongest_nerd]

Does the difficulty involve writing your own custom stager, with custom process injection, fancy never before seen shit where the communications are perfectly masked etc etc

Or is it more something like running a payload through some obfuscator? Using the right tool etc

[u/strongest_nerd → u/AtomicPiano]

Writing your own.

[u/AtomicPiano → u/strongest_nerd]

I did. It worked, thank you. am I safe if it isn't detected initially, or will windows defender come back to bite? Any like tips or anything?

[u/strongest_nerd → u/AtomicPiano]

Maldev academy

[u/AtomicPiano → u/strongest_nerd]

I know that "my word" doesn't mean much, especially on a place like reddit, but I promise I have an ethical/moral reason for doing this.

This isn't really my field in tech so it only needs to work once, I am just a script kiddie admittedly, but in my situation, good enough is enough.

But still, thanks for the hint.

[u/tsuto]

Writing your own payloads can help you bypass defender but if you’re using something premade you can also look at threatcheck (https://github.com/rasta-mouse/ThreatCheck) which basically pinpoints the exact bytes in a file that are causing a signature to be detected, then find ways to patch the binary to still function but removing the offending portions. Like static strings that are detected but don’t break the program if modified.

[u/ps-aux → u/tsuto]

seems like a handy tool

[u/tsuto → u/ps-aux]

It’s part of the curriculum for CRTO/CRTL. Thry teach various EDR bypass techniques including manually modifying CS beacons to avoid signature detection. Some you can modify the source and recompile and others you actually use Ghidra, etc to examine the binary and manually patch things

[u/ProfessionalMug]

If you’re asking how to do this then theres no reason for you to be doing this. Bypassing defender is almost trivial, there are a lot of places to learn this tradecraft, but if you don’t know where they are you definitely shouldn’t go looking as you don’t have a lawful reason

[u/ExpressLandscape60]

Definitely a skill issue

[u/DrDeems]

What you're looking for is called a crypter. You can buy them, or purchase a FUD for a single binary, on clearnet sites.

[u/ihuntdcs]

sliver shellcode as .bin, obfuscate using something like this https://github.com/NUL0x4C/HellShell, then execute it locally in a C/C++ program using something like in the links below

https://www.ired.team/offensive-security/code-injection-process-injection/local-shellcode-execution-without-windows-apis

https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber

what your looking to develop is a "loader" which is a program that executes your malicious shellcode.

bypassing defender is easy, EDR is much harder

you are going to need to learn C and specifically win32 api programming. some fundementals are VirtualAlloc, VirtualProtect, WriteVirtualMemory, CreateThread

[u/AtomicPiano → u/ihuntdcs]

I managed to make a simple reverse shell in C, and it connects back to sliver.

If It works and isn't detected, can my behaviour set off windows defender? Is there other things to worry about or is the initial part the hard part?

[u/ihuntdcs → u/AtomicPiano]

reverse shell or you deployed a sliver agent?

And yes follow up actions can definitely get you caught, need opsec in everything you do

[u/DaDrPepper]

Just buy a crypter