search

govolution / avet

AntiVirus Evasion Tool
GNU General Public License v3.0
1.64k stars 333 forks source link

App crash #6

Closed enkeyz closed 7 years ago

enkeyz commented 7 years ago

So I used that bash script from Example 1, compiled it with mingw, and when I open exe on my VM, I get appcrash. virtualbox_win7_x86_02_06_2017_14_37_09

govolution commented 7 years ago

Did you compile it as described here? https://govolution.wordpress.com/2017/02/04/using-tdm-gcc-with-kali-2/

enkeyz commented 7 years ago

Looks like not:D Will report back, if it works!

govolution commented 7 years ago

OK. I always had problems like that when using different compilers, don't know why. If any problems let me know.

enkeyz commented 7 years ago

So, now exe is running fine, but metasploit is stuck at here: screenshot_20170602_151532

I'm not running any AVs, and firewall is off. It's a clean virtual machine.

govolution commented 7 years ago

OK, looks like a msf problem or config problem. Send the shellscript you used (with your settings included) and I have a look.

govolution commented 7 years ago

Also might be a network problem... VirtualBox sometimes sucks at this.

enkeyz commented 7 years ago

Network is fine. I tried with a simple msfvenom payload.

Script: https://pastebin.com/D4F3gbS3

Edit: rebooted my VMs, still same problem.

govolution commented 7 years ago

Your handler is tcp, but the payload is https, so: set payload windows/meterpreter/reverse_https on msfconsole.

enkeyz commented 7 years ago

LOL man! Did I really missed that? :D Thanks:)

Bye the way, thanks for your work, it's fully undetectable by AVs - 0/61 - really nice work!

govolution commented 7 years ago

No problem ;).

enkeyz commented 7 years ago

I tried Veil Framework and Shellter before, but they get caught immediately. I'm not really into these things, but why are your project works, and others not?

govolution commented 7 years ago

Hard to say without a closer look. Might be my tool is newer and is not recognized because of that. Or maybe the evasion techniques that are used are effective. If you want to know more check out: https://deepsec.net/docs/Slides/2014/Why_Antivirus_Fails_-_Daniel_Sauder.pdf https://govolutionde.files.wordpress.com/2014/05/avevasion_pentestmag.pdf