u/melvin2001in r/netsec • Recommends
msfpayload isn't dead yet: AV avoidance in payload delivery - melvin2001 - CarolinaCon9
0:00 / 0:00
#metasploit#msfpayload#antivirus-evasion
msfpayload isn't dead yet: AV avoidance in payload delivery - melvin2001 - CarolinaCon9
CarolinaCon
4.8K subscribers • 2 videos on Hallway
- Recommended by 1 person: 1 in engineering communities.
- Presented by melvin2001
- May be out of date. The tools, versions or practices it shows have likely moved on.
Advanced. Deep dive for people who know the field.
5.4K views13 years ago1 recommendation
SecurityExploits and vulnerabilitiesWeb and application security
A presentation on bypassing antivirus detection using assembly ghost-writing, binary-level encryption, and remote command execution.
Most, if not all, executables generated by msfpayload/msfencode/msfvenom get destroyed by every antivirus available. Msfpayload is still fantastic, but it's inevitable that something this fantastic will get a lot of attention from AV providers. It is crucial for security professionals to have reliable payloads to provide quality deliverables to their clients. Rather than having a theoretical discussion regarding various avoidance techniques, this talk will demonstrate methods that these chaps use on a regular basis with ridiculous success rates. Of particular focus will be ghost-writing ASM, use of binary-level encryption for payloads, and remote command execution for shell generation.