All language subtitles for [English (auto-generated)] Bypassing Windows Defender (Windows 11) with Manual PE Loading (Public to

Hello everyone. Welcome back to another

video. In today's video, we will be

showcasing this GitHub repository,

IronPE, to bypass the latest Windows

Defender running on a Windows 11

machine. Before we begin, please note

that this video is created strictly for

educational and cybersecurity awareness

purposes. All demonstrations are

conducted within a simulated virtual

environment using systems that are

owned, authorized, or intentionally

configured for security research and

training. The techniques, tools, and

methodologies discussed are widely

documented within the cybersecurity

industry and are presented to help

security professionals, students, and

organizations better understand how

attacks work so they can defend against

them. This content does not promote,

encourage, or support unauthorized

access, hacking, or illegal activities

of any kind. Any attempt to use the

information provided in this video

against systems without explicit written

authorization is illegal and unethical.

The creator of this channel assumes no

responsibility or liability for any

misuse or damage caused by the

information presented. By watching this

content, you acknowledge that the

material is intended solely for

legitimate cybersecurity education,

defensive research, and professional

development.

>> Let's get started. So, this is a minimal

PE loader that is written in Rust to

load and execute Windows portable

executable files on Windows. Feel free

to read more about this project on your

own. We will not be wasting time reading

off word by word. Let's jump right into

demonstration.

Let's hop over to our Kali machine and

get clone the repository.

The project is built for Windows

compilation. We can simply do a cross

compilation on our Kali machine to

produce a Windows EXE binary with Rust.

Let's install whatever that is

necessary. I don't think I have Rust

installed on my Kali machine yet. Once

installation is done, we should be able

to cross compile this project without

any issues.

Nice. The compiled EXE binary should be

in the Windows release folder over here.

The loader itself does not contain any

malicious payload, so I don't think

Windows Defender is going to pick it up.

Awesome. No detection so far on the

loader.

If you are paying attention, you should

notice there is a limitation here on

this loader. It only takes in a local

file parameter. This means that most

likely the payload will have to be on

the victim machine as well.

Let's generate a EXE meterpreter reverse

shell payload on our Kali.

Now, if we were to transfer the

meterpreter EXE over to our Windows

machine for the loader, obviously, this

is going to trigger Windows Defender on

the meterpreter EXE payload.

So, what can we do in order to

circumvent this loader's limitation?

It's pretty easy. We can implement a

feature to load the EXE payload remotely

over a HTTP endpoint instead. Let's

locate the file read function in the

source code first.

This should be the read file function

here.

Now, let's copy and paste this into

ChatGPT and ask it to implement the

fetching of payload remotely over HTTP.

Let's be as detailed as possible and

paste in the loader help menu for

ChatGPT to refer.

Awesome. Let's follow the instructions

and add in the HTTP request dependency

first.

Let's copy in the use FS and use path

statements here as well.

FS is already here. So, let's just use

path.

Now, let's copy the entire file read

function and overwrite the existing one.

This contains the remote payload

fetching over HTTP logic.

This should do it. Now, let's recompile

the project to produce a new IronPE.exe

loader, which contains our new

implementation.

This looks good. Let's transfer the new

IronPE loader to our Windows machine.

Let's spin up a web server using Python

to host our payload.

All right. Moment of truth here. Let's

execute the IronPE loader and fetch our

payload remotely via HTTP. This looks

good.

Nice. We did it. We were able to

successfully bypass Windows Defender

[music] and establish a functional

meterpreter reverse shell.

All right, all. This is it to this

video. A quick and straightforward

knowledge and tool sharing video without

all the fluff. I hope you have found the

video to be useful. I have started a

membership on my YouTube channel for

people who would like to support the

channel. Else, please help to like the

video and subscribe to the channel. It

will really help out the channel a lot.

Thanks all. I appreciate it, and I will

see you all soon in the next one. Bye.