Creating Remote Shells that Bypass Anti-Virus with “Veil”

Many people think that if they are running an Anti-Virus and a firewall, that they are generally safe from hacker attacks. But the truth is far from that. Meet “Veil” a remote shell payload generator that can bypass most current Anti-Virus programs.

Many Anti-Virus programs work by pattern or signature matching. If a program looks like malware that it has been programed to look for it catches it. If the malicious file has a signature that AV has not seen before, many will dutifully say that the file is clean and not a threat.

If you can change or mask the signature of malware, or a remote shell in this case, then most likely AV will allow it to run and the attacker gets a remote connection to the system.

Veil, a new payload generator created by security expert and Blackhat USA class instructor Chris Truncer, does just that. It takes a standard Metasploit payload and through a menu driven program allows you to create 21 different payloads that most likely will bypass anti-virus.

But how well does it work?

Following the directions on Chris’s page, I downloaded and installed Veil on my Kali (Backtrack) system.

Simply pick what payload you want:

Veil Payload Generator Menu

Then you can choose to use Metasploit’s standard msvenom shellcode or choose your own. I just chose the default, msfvenom:

Veil Options

Next choose the type of payload, I just chose reverse TCP. Then enter the IP address of the Kali system and the port you want to use:

Veil setting remote address

Veil will then create the payload and present you with two options. You can feed the payload into Pyinstaller or Py2Exe to create a Windows executable file.

This is where I got a bit stuck. For some reason Pyinstaller did not want to co-operate on my Kali machine. Fussed with it for a while, then just followed Chris’s instructions for creating the .exe file on a Windows machine and it worked without a hitch.

Basically install Python, Py2exe, and PyCrypto on Windows (all in the same directory). Then just copy over your created payload.py file, the RunMe.bat file and setup.py (found in your Kali Veil directory), into your Windows Python Directory.

Run the Bat file and sit back and watch the magic. When it is done you will have a payload.exe file. Any Windows system that runs it will try to connect out to the Kali system.

Finally start a Metasploit payload handler on your Kali system so the remote shell can connect to you. In Kali at a terminal prompt, type “msfconsole” and then:

Veil Running

Make sure you use the same IP address as LHOST and port as LPORT that you used in creating the payload.

Now, when a Windows system runs the payload.exe file we get this:

Veil Session

A remote session.

Then if we type “shell”:

Veil Shell

This was a fully updated Windows 7 system with a very good Anti-Virus installed and updated with an intrusion detection system running. It didn’t see a thing.

This should prove that you can not trust in your Firewall and AV alone to protect you from online threats. Unfortunately many times your network security depends on your users and what they allow to run. Instruct your users to never run any programs or open any files that they get in an unsolicited e-mail.

Blocking certain file types from entering or leaving your network is also a good idea.

And finally, using a Network Security Monitoring system will help track down what happened and what was compromised if the worst does happen.

For more information on Veil, and other pentesting topics, check out Chris’s training session at Blackhat USA 2013!

Advertisements

Bitdefender wins Anti-Virus Test while Microsoft AV Failed Certification

Interesting Anti-Virus news from AV-Test labs this week. Every two months AV-Labs puts Anti-Virus programs through the paces and scores them on how well they detect, protect and remove anti-viruses. One of our favorite Anti-Virus programs, Bitdefender won the contest again this month, while surprisingly Microsoft’s Security Essentials failed to be certified.

BitDefender won by earning 17 out of 18 points:

AV-Test Bitdefender

With a perfect score in Protection and Repair.

Microsoft, which missed the certification cut-off of 11 points, earned 10.5 points:

AV-Test Microsoft

Scoring only a 1.5 in protection and 3.5 in repair.

So how well did your favorite Anti-Virus make out?

Check out the full report.

zDefender and zCore – Active Malware Protection for your Mobile Device

Mobile threats are becoming as common as traditional attacks. Malicious sites, Zero-day vulnerabilities, malware apps, even man-in-the-middle attacks. But what can you do to protect yourself against these threats?

Earlier this month at Demo Spring 2012, security expert Itzhak Avraham founder of zImperium revealed their new zDefender active malware protection. zDefender, based on the zCore API technology can detect detects as they are happening and take action. The software runs at the core OS level, instead of the application level that many anti-virus programs operate at.

In the video above, Itzhak demonstrates the technology by implementing an ARP attack against a target mobile device. zDefender detects the incoming attack and actually shuts down the phone’s wireless adapter, stopping the attack cold.

Itzhak knows a thing or two about mobile security. The company also created the amazing Anti – Android Network Toolkit, which we talked about earlier this month.

zDefender and zCore are currently in Beta, but these products are definitely worth keeping an eye on.