All language subtitles for [English (auto-generated)] Malware Development Tutorial_ Bypassing Windows Defender With This EASY Technique [DownSub.com]

Okay, we are now going live. And

today it's not just a test stream. It's

a stream where we're going to do

something more practical, I guess. And

that is to write a bunch of uh pays and

see. So, I want to test my system, how

it behaves, uh how does it work, and so

on. And yeah, I think we're going to

have a little bit of fun.

Now, first I want to make sure that all

my adapters are the same. So, as you can

see, we have brided adapter here. Bridge

to specific name, which is uh W1 because

I'm connected to the Wi-Fi. And

essentially, we're going to need this to

be bridged for both of the VMs,

otherwise they will not be able to to

talk to each other and pretty much uh do

anything, right? So now we're going to

open the

KaliVM which we're going to actually use

as a server. So I would not need that to

be full screen but rather that. Yeah,

exactly. Uh here if you find any issues

at some point uh I'm also doing that on

Discord my server. So make sure to join.

Uh if you find any issues with the

stream just make sure to hit me up.

Yeah. So, I'm going to move that to here

and that to there and that to here.

Okay. What happened

now?

Okay. Okay. Now, I want to be that

window to be here. That to be

here.

Now

that. And here is the Cali. And here is

going to

be the windows. Come on.

Yeah, there it is. And here is going to

be the Windows

VM. Again, I don't want I don't want

full screen. That's fine. So, I

can switch easily with from VMs and so

on. Yeah, there it is. Boom. Boom. Boom.

Boom. Okay, I think we can do something

like

that. Can we resize the window?

Nope. Why that happens

now? Is it because I deleted the ISO

file? I think that's highly

possible H. Even though the copy paste

works. Oh, there it is. Okay. It needed

some time. It needed some time. Okay,

perfect. Uh

here I did not change the default

password so far. Ah I don't like

that. There it is. See the wallpaper.

The new kind wallpapers are nice chat. I

really like them. What do you think

about it? I enjoy them so much.

Especially that one. Okay. So here we're

going to use KI for our infrastructure.

We're going to host things on it because

right now it's uh empty. Nothing's

there. So, first I'm going to do fast w

to change my

password.

Okay. Yeah.

Okay.

Okay. I think everything is fine now. If

you experience any, you should just let

me know.

Okay. Uh, now what we want to install is

generally I think mic should be fine.

Yeah, I think mic should be fine. I'm

going to also

do performance mode. Just why not? And I

think doing my should be fine. What do

you think, chat? Mythic or

havoc? Let's do mythic. I think mythic

is fine. I'm going to open a browser. go

to Mix C2 and let's set up everything

from scratch. I think that's that can be

super useful for the stream and to see

how everything is be set up from the

very very bottom zero. So usually when

you want to install myic you want to

obviously clone the repo or sudo gone

and paste. Now I'm going to

use opt as a folder but

uh it's not 100% needed. So, I don't

mind if uh if the OP is not is not the

option. It's it's definitely no problem

at

all. On the Windows side, I think on the

Windows, we're good because in the

Windows, we have Visual Studio. Uh I

think yeah, we have So, with Visual

Studio up and running, I don't think

we're going to need anything else beside

that. So, we can code on VS. We

can pretty much do anything. We have C.

I think we have C. Let's see. We have C.

Let's

see. Okay. Console app. That's C sharp.

Uh console

app. That's a post. Yeah, there it is.

There it is. We good. We fine, chat. We

good. Okay, let's go back now from here.

Let me check the

pan. Okay, good. Now from

there, yeah, we need make. Uh, do we

have GCC? No. Yep, we have also make,

which is fine. So, we're going to go to

midic. And now here do

sudo. Yeah, first we need to do sudo

install docker kali and that's going to

install docker and docker compos plugin

because that's needed and I debug way

too much time for uh knowing that we

would need not only docker but uh docker

compos also. So that's

that's pretty much important on the

windows. I don't think anything else

we're going to need. So that's fine. So

don't mind

that here. Okay. If you have questions

in the meanwhile, you can do it in the

chat or hope that hop into the 20

discord and ask it there. So that's

that's the options. Yeah. So uh here

we're going to looks like

the update is now fixed

because at the pa in the past this file

was not working because I spoke with the

mic creator one of them and uh he

mentioned that it's

actually Ki sometimes bug things out and

they place a little bit a bunch of

packets so document compose was not

available at the time and you need to do

some kind of a tweaks to get it but now

I think it's So what we can do now is do

sudo make and when doing sudo make it's

going to pull everything and at the end

we're going to have that uh mic thing

where we can engage with mic. So we can

do sudo and then do mic ci and it's

fine. Now here we're going to need to to

add C2 profiles. So, mitic c2

profiles and this is pretty much how we

want to communicate with mitic. Yeah,

there's a bunch of documentation that's

why I like so much mic and not only for

that but uh that's one of the reasons.

So, there's a good documentation that

can help you with most of the stuff and

here we can choose what type of

connection we would need for the mx2. So

when we start the agent from the Windows

VM as soon as we start the agent here,

how that agent is going to communicate

with uh the via which protocol. Now

usually I enjoy this course so much. We

also did a workshop on in Sophia for

besides and I showcase how OP that is

and it's super hard to be traced because

this court is doing its own wall

balancing and things like that. So if

you have discord allowed in your

environment and organization, please

remove it. You don't need it. Trust me,

you don't need it. Then uh I didn't try

DNS so far. There's also GitHub, but the

GitHub and the Yeah. And the Discord are

only for Atheina. And now I don't think

we we want a tina because a tina is

generally net core based and I think the

whole execution part will be a little

bit more complex there. So we want

something like apple for now and let's

go for the raw play good http. So copy

the link go to the pseudo medics CLI

install github and just paste. That's

going to install the http container and

it's fine. Then we're going to also need

to have

the the agent which in that case is

going to be the

apple. So here we pretty much do the

same thing and just replace the URL with

the one with apple. So the

place here we can generate a

simple go to C++ go to next and do let's

call

that

stageless let's first do stages guys

because I think it's more simple to do

it. Yeah, create

that. Okay, now

here we have everything we need and we

can do mic cli start which going to boot

everything up. Yeah. Now generally what

I mean by staged and stages payw is as

follows.

So, where is

that? Where is

that? I'm going to stop my screen share

just for a

second. Be right

back. Okay, we are back now.

And uh now what I mean by stage and

stages now imagine the polling thing

that's the kali machine right

here that's the command do right

there right now we go along that the

payload is going to go http so the

connection is going to become it's going

to initiate from the commando to the

kali so we're going to do a reverse

connection to the kali itself

Okay. But uh it's going to be over HTTP.

Okay. And now the point is if it's

staged or stageless. In a nutshell, what

we want to do is uh staged because

stages is the following. The connection

is going to originate from a process,

right? It's not going to come from the

air. So the connection is going to come

from a process. This can be a pole.

Or it can be think something

like maybe

stageless.exe or DL side or anything in

between doesn't really matter but the

connection the connection is going to

come from a process. So the commando or

the victim would need to somehow start a

process and then this process is going

to connect directly to the cut machine

giving us call back and from a time

interval depending on

the depending on the time set then it's

going to connect more and give us the

call back interval in seconds and whoop

that thing. Okay, now that's a stage

stages part and the thing here is that

everything is is inside the pay wall

itself. That's it. So the binary

withdraw has the final payout. It can be

encrypted and can be not but it has the

full payout. So we execute the payout is

there and we have just one connection

which is the callback one and that's it.

Whereas with stageless we have a

slightly different scenario. Now here uh

that's we mean by that to be direct

callback. Now we have the same thing. We

have the commando and some form for

process because the connection must come

from anywhere. And now the first request

by the way first connection is not

direct callback but we have one uh read

the

payw then the payload is going to be

read from the remote server then it's

going to be dynamically allocated into

the memory and then we have connection

two which is going to

be call back. So here we have just one

initial request which is the call back

itself and here we have first reading

the pay part and then doing the call

back after the payout is read. Now

generally always always we want to do

something like a stageless communication

uh staged sorry because when you do

staged then just by staging the payload

you increase the chance reduce the

chance of it getting discarded by a lot

of percents. Of course, this may vary on

uh specific vendor and specific

environment, but generally speaking,

staged pays are always better than the

stageless ones. That's always the case.

Now, to make things first simple, I want

to generate super simple payload. So,

we're going to go to Kali. We're not

going to dive into my yet. So here we're

going to do I'm going to go to desktop

and use MSF venom. So MSF venom minus P

Windows x64 and here we have to define

staged and stageless. So if you do

things like let's do

Windows actually what was

it where was

TCP nah Windows

x64 what was I I I totally forgot the

name of

Windows. Yeah, that that that should be

it. That should be it. Windows x64

reverse

TCP. Yeah.

Oh yeah. Yeah. Windows shell reverse

DP. Yeah, that's it. Shell reverse TP.

Yeah. So now when you do it like that

and of course set up your options host

to be ETA airport, let's do

444. Yeah, why not? and format let's do

C and output to be

stageless C that's how you generate a

stageless pay in MSF venom so when you

have the that underscore part the payout

is stageless and as you can see 460

bytes are allocated so I can

cut pages and as you can see that's the

full payload so if I use that in some

form of a sh code exe execution then I

would have I I can get the shell with

netcat or with the MSF console because

the full payout is there. So let me

showcase that to you. Uh if I go

here and do that's a stageless the same.

Yeah the exactly the same one. We can

first go to the solution explorer and

make sure to rename that to C. So we

name stages C TPP to C. Do it like that.

Then on the main remove that then we

also don't need that. Now here I can do

include

stdio.h

include

windows.h and now here define the

payload. So paste and that's it. And

here we can do something like

uh how was that

pdr

equals virtual walk let's

do a address that's going to be no then

we have size we do size of book then we

have location type that want we want to

be name commit and

reserve. And we also want to have the

protection settings which are going to

be page and then

uh

page executive. Right? Yeah, we're going

to do the full memory permissions. Not

going to bother about doing object

things. Now uh then we want to copy the

the that payroll to the memory because

now it's just a variable in our code but

it's not written into the memory of the

process itself right it's just a

variable which is a hex string and now

we need to write that to the memory

because we want to execute it now

generally speaking shell codes like that

are machine instructions in hex so we

have that instructions And in order for

us to get it because that's at the end a

machine language and for order in order

for us to get it it's representing hex.

So all that hex value must be written to

the memory of the process ak of the

machine and then it can be executed from

there. So we can do something like main

copy and do things

like

destination. So that's going to

be source is going to be oh yeah

destination is going to be a DDR then

the source is going to be the pop and

then the size is going to be size of the

buff again okay and now at the last we

can simply execute it because we already

have all the permissions we need and

here we can do something like uh I don't

remember the syntax I need to hook it up

So, more

development.

Uhhuh. That

one and that one. There's no way I'm

getting that one

correct. So, here. Paste. And that

should be

it. Okay. Now, if I compile that, let's

see if it's first going to compile

without a problem.

I'm going to save, switch to release and

compile as

64. Okay, now I can simply try to

execute it. Do I have CMDR? I think so.

So, open file

location and from here pin

[Music]

to taskbar and do it like that and open

CDR.

There it

is. Now I can do I can directly execute

it like that. And now before executing

it, I want to of course set up my

listener. So I can do

NCOP

44 because that's the same port we

defined in the beginning where generated

the pay like here in this command. And

now from there I can try to run this

command. I have a defender on the

commando

gear. How's that even possible,

guys? How's that even possible, chat?

Hey, how you doing,

mate? Isn't that in the GP settings?

I don't get

it. I also don't get it. But never mind.

Now we stopped. So I can run it. And uh

it was divided by the fender. So I can

compile it again. And if we run it, the

show hangs which is generated a good.

And here we have a call back. Now the

reason why we have a call back and why

we can access the commando is simply

because we need some payload for bypass

window security. Yeah. Yeah. I know. But

now the topic is slightly different.

That's why I'm sticking to basic. And

now here uh the reason why that work

with with netcat is because as mentioned

the whole payload itself was into the

binary. So that show code you saw there

that payload that's the full payload

that show needs the footing and now the

footing is inside the binary. Now of

course if you want to evade it you can

do things like encryption and staging

because staging is one of the most I can

say techniques. So I enjoy staging and

now the whole the full buffer is here.

the full payload is there and that's why

we can catch the shell with netcat

because it's compatible with netcat

first the

whole the whole shell pay which is

windows x64 shp is compatible with

netcat and it stages okay if we generate

a staged pay you would not be able to

catch with netcat because if I want to

try to do it so here I can do shell and

here

do/tp which is going to be stage

pitched. Now if I try the same code with

the stage payload, it's going to fail.

And I can try

stage.c. I don't know why reverse shell

is bigger. Stage is bigger than stages,

but I don't care. So if I paste the same

code there the stage now and if I

compile that and rerun the same binary

while I have my listener running

here now it's not going to

work. See we have some kind of

connection but in that case this

connection is uh designed to read the

binary and not to directly give us a

shell. So it wants to see the payload as

a result and then to execute it and give

us a call back. And that's why in this

case it fails. Now if we do the same

thing via metasloit, metas-poit would

know how to store the payload that the

binary needs and then if it's read it's

going to be executed. One cool thing we

can do one uh cool trick is to set up a

Python server. So Python 3 minus m http

server and 44. And now from here execute

exactly the same uh binary and see what

it wants for. As you can see we have

some kind of

a strange

requests. It's not even a request. It's

an exception because looks like the

reverse TCP is not requesting the B the

shell code from uh HTTP but rather than

from other TCP file communication

process. Yeah. Yeah. So it's not HTTP.

Now in that case the only way we can

execute that is by using MSF MSF

console. So do MSF

console. Now here we can specify use

exploit multi handle because at the end

we want to receive communication.

Now set payload to be exactly the same.

So Windows x64 shell slash reverse PCP.

So remember the slash is staged whereas

this is stageless. So that's stage one.

And now from there do set a host to be

T0 set port to be 444. Run that. And now

it's going to start a TCP listener. So

it's not HTTP but it's a TCP listener.

As you can see started the reverse TCP

handler. So the payw uses some kind of a

TCP communication to get the final bytes

of the payw but uh I was expecting it to

be HTTP but it's not. Never mind. Now

when we execute it, we can first see

that standing stage to the machine and

then we have a session opened. So that's

the difference between staged and

stageless because in the stage we're

going to directly get a connection back

whereas in the staged the payload reach

to us we give him something

to add extra or to complete the final

bytes and the final pays then they

allocated to memory executed and then uh

the final pay gives us a call back

something if you if you want to

graphically uh visual Otherwise that it

happens something like that. So we first

read the payload, we send the sending

stage as as

metasoid says and then we have the call

back. That's cool. But now let's do that

a little bit more manual so we know what

happens. And now if you go to

offensive

cpp in my GitHub repo, you can see

invasion staging techniques. You can see

a bunch of them.

So we have ads stage we going to which

is going to actually going to use uh

alternative data stream which is super

nice and uh a little bit stealthier.

Then we have uh three main options. We

have vocal stage which is uh doing a

pretty good job. Vocal stage means this

going to be staged as in a file. So we

need to send the paywalt and the local

file and the payw would read the bytes

from the local file or the payw can

manually download the local file and

then read the bytes from that's also

thing. Uh then we have uh HTTP stage

which is going to use HTTP swashes to

perform the staging part via

HTTP and we have also uh stock staging

which going to perform the same thing

via sockets. So, we have a bunch of

options and I kind of enjoy the SMB one

because there it is. I kind of enjoy the

SMB one because usually when it comes to

internal networks and not only uh

there's an SMB traffic going on and if

you find the external SMB traffic which

is not that uncommon by the way you can

also use this kind of staging because

usually all the measurements are about

HTTP and what happens over it but if you

can go over different protocol like SMB

it's even better. So uh staging via SMB

is I can say uh super nice. Yeah. Now

this code is fairly simple. It has one

function which is read bin and this

function actually reads a file from

remote share which is going to actually

perform the staging because this we're

going to create a request to the server

reading the file from its uh share and

then executing that that uh and after

this one a new connection is going to be

made. So we can test that with midic and

let me first generate a payroll. So I

can exit that. I can go to

https

7443. Accept

that. Now do mic

admin cdop cd mic and cat env. Get my

password. I don't mind leaking that on

stream because it's walk either way. So

paste and now we're here. Now on the

mitx C2 we can go to the payloads and

now first let me check if everything

works. It is now by default the HTTP

profile uses port 80 for communication

and all HTTP. If you want to change that

you can go to CD installed services then

HTTP then HTTP again then C2 code and

here we have a

config.json. In this config.json JSON

you can do change the port you can

change US use SSL and essentially you

can uh uh even specify the key and

theert path also you can change the

server headers so of course if you have

a mic exported and to the external web

always change that just a nice

advice yeah so I'm not going to do it

now because I don't need to But the

whole thing is super simple as

mentioned. Change the port, change the

USSL and maybe the server headers and

that's it. So we don't need that for

now. Now the profile works. I think you

can also do it from there. So we can

click here and

maybe nah not here. Maybe here I don't

know. Yeah, never mind. I also like to

ch to have a saved instances so I can uh

do things like

http oh instance name wait that's going

to be

80 like that because I would know if I

see that instance I would know it's

going to be on that IP which I have now

and the port 80 now I can pretty much

copy the IP which is going to be here

remove the s change the callback

interval because I want that to be

shorter. The callback port is fine. I

don't want this to be modified for now.

We don't need it. And I can do click

create. Now let's generate the payload.

I can go to actions and new payout. Then

next, then apple. Then the default are

pretty much fine. Then I can for now

exclude all the commands rather

than the word

command like that. Next. Then I want to

go to my saved instance like that. See

how easy it is. Boom. And I can

click next.

Wait.

Windows

Apple. And we need a show code. Yeah,

that was super important because if we

wanted to be a .exz download to get it

to show code, but now it's going to be

done automatically. So shell code is

fine. Then everything stays the stays

the same like that. Go next. And here we

need to change the apple exit to

B. Wait

what? And that's

[Music]

it. Now we have to wait a little bit for

the table to be finished. And while that

happens, uh, we're going to go to the

offensive C++ and copy the staging part,

the whole code. So I'm going to go to my

commander here. Go here. Let's open

the Let me remove that. Yeah, the same

old payload. And I'll do new project

which is going to be staged. So uh

console app staged

create because it's good to stay

organized. I think that's super super

[Music]

important. Did I click create? I didn't.

Okay, there it is. Now here again,

change that to

C. Now

paste. Boom. And there it is. Now we

need to tweak a bunch of things. We need

to tweak the buffer

size. And the buffer size can be

retrieved from the uh payload itself. So

I can download the payload. You can see

it's 2 megabytes. But how exactly uh fed

it is? We can go to downloads and do

this minus la. And that's the final

size. So we can get the final size and

paste it there. And I always like to

have one up. So it's a 49 at the end. We

can do 50 because I always want to have

one bite extra in agencies because in

the past uh sometimes some techniques

failed because of that bite. At least

that's what I think. Now we have the

buffer. We adjusted the the size of it.

Now it's empty. Ideally, you want to you

want to do it uh dynamic. So without

static allocation, you can do dynamic

allocation with uh mok and then rewoke

if you need to reallocate more memory.

But that's ideally now it's not the

ideal case. Then we have the read beam

uh file the function which essentially

is going to do a create file Windows API

call against a specific path and then

this path is going to be just a remote

share and since we we can pass a remote

share the same Windows API is going to

be used as a reading local file and it's

going to work just like that. So the

same file that the same API that reads

local files can be used into reading uh

files from remote chairs. Nice, right?

Then we can call file read the handle

and pretty much that's it. So here we

need to also modify the ties and paste

it here. I think I need to do it better

here. I need I need I can I can automate

the whole thing, but I'm not going to do

it

now. Oh. Oh, see how smooth that is. I

can just scroll through the panes which

is so easy.

Boom. Okay. I didn't know that. Thanks,

Ubuntu.

Okay. Ah, now I

cannot. Oh, there it is. There it is.

Okay, there it is. Okay. Now, uh here we

use pretty much the same thing virtual

walk and we allocate the memory. We do a

read bin so we can read the file inside

this buffer variable. Then we write this

buffer variable to the memory and then

execute it via direct pointer. If you if

you don't know what direct pointer is, I

highly recommend you guys read the blog

post I've done a while ago which

explains what's a DP or direct pointer

and why it's so OP. So I highly

recommend to to check this one out.

Yeah. Uh now here we need to first make

sure we have the SMB server and the

right IP and the right share and the

right path. So in our case that's going

to be upload.bin. Then we have sh and we

have the IP of 185 at least I believe.

Yep it's 185. Now here we can do things

like we need to set up the whole uh SMB

server. So we can do impact SMB server.

It wants the share name and the share

path. So we have uh share the pad is

here. We have ts debug for time stamps

and debug messages and of course SMB2

support because it's super duper

important. Run that. And now I guess

we're fine guys. I think we we we are

now set up. So what that's going to do

is it's going to first uh allocate

memory then do one request to our

machine but via SMB and not via HTTP.

It's going to read the file. It's going

to allocate that into the buffer

variable where then it's going to be

written to the memory executed and the

first call back is going to come from

here. So in our case, if that works,

we're going to do that. So first we're

going to read the payload but this case

from SMB. Let's do it like that via SMB.

We're going to read the payw. the

payload is going to be back and then

it's going to be allocated written to

the memory and then the callback is

going to come from executing the payload

in memory. Why that's nice? Because now

if we scan this file I doubt not

something's going to detect it. I highly

doubt it. I can save and compile and we

can test that guys. I can save and

compile. Now we can go

to the folder itself like that. Go here.

Let's start defender now and let's scan

the file. So turn

on. Yeah, there it is. Now it's on. And

now let's

do

can no found. That's the magic of

staging. Whereas if I scan the previous

file because the payload is there is

going to be detected right off the bat.

Trust me on that. So just because it's

staged we avoid the signature detections

which have not less and our file is

generally behaving more stable. So I

generally recommend staging by any mean.

Uh now we can try to execute it. Now the

fender of course might uh focus on the

runtime because the apple is known

uh pay but let's just try it right. I

mean we have to try it to know. So, uh,

I can open CDR, go to here, and

do stage.exe, even though the name is

super suspicious. Now, let me make sure

the SMB is running. It is. I'm going to

go to callbacks tab, and I'm going to

start it.

Boom. And there it

is. There it is. Defender is running. No

threads are found. And that's how you

bypass the fender with a simple SMB

staging. Wow. And we also have the NTMB

hash which is super crazy. That's why I

I'm telling you guys to always go

staging. That's the reason. I mean this

not going to be enough for complex CDRs

and things like that. But as you can

see, just one technique, just one set of

technique was able to get our Apple

beacon out of the defender's way and we

bypassed it right off the bat. So we can

now issue commands and work with it. We

can do what? Who am I? And things like

that. And now enjoy our

beacon. Oh, they

also updated

it. Nice. Okay,

perfect. Where am I? And there it is.

There it is. And the funny part is

defender is running. I to be honest, I

didn't expect that. I expected Defender

to catch that on runtime because Appo is

a known agent. But as you can see,

staging is not to be

underestimated. There it

is. There it

is. That's crazy. So that was the the

whole idea of the stream to first test

my system how it behaves and to showcase

some practical things about staging and

stage vest. So the moral of the story is

that when possible always use payroll

staging no matter if it's a via SMB, if

it's an HTTP via local file or via

anything else. Just avoid placing the

payload directly into the file. always

stage it in some form by some third

party protocol or third party solutions.

So imagine the whole development part

not as a single OP technique that

bypasses all the vendors but rather it's

a setting combination of multiple

techniques then when working together

that can make our payout evasive and

effective. So now we can add maybe uh

encryption to the payw. We can also do

sandbox evasion, do a domain sandbox

evasion and things like that which can

boost the the the evasiveness of the

payw. But essentially the point is to

add many techniques combine them

together

and test a lot. So uh with that that's a

practical Windows defender bypass with

mic 2. So, I hope you enjoy guys the

video and uh that was it. If you have

any questions, you have just arrived.

What technique did you use for bypassing

defender? Yeah. Um SMB staging. Just

that. Just that. I was I didn't think

that would work to be honest. Uh I

expected some defender to catch us in

runtime when the payload is executed.

But just that code, see how simple it

is. I didn't do any D side loading. I

didn't do anything crazy. just a simple

exe with SMB staging and the staging

work perfectly. So that's why I always

say that this technique is my favorite

for M development because it's super

super OP. Trust me, if you have the

payload in the file, it's going to be

detected. So uh yeah, sorry for being

late. You missed it, but I'm going to

put this to YouTube either way. So uh

appreciate your time and I hope you

learn something new. If that's the case,

always subscribe. Yeah. Uh, thanks so

much. And yeah, you're going to be you

can watch that on YouTube. So, thanks so

much for sticking by and yeah, see you

guys.