Penetration Testing with Windows Computer & Bypassing an Antivirus Using VEIL-Framework in Kali Linux

0
Bypassing an Antivirus

Pentesters have a hard time bypassing anti-viruses nowadays Since  Antiviruses are evolving as we speak. We at www.gbhackers.com decided to put some time to teach how to Bypassing an Antivirus with most common free AV’s we come across in our day today life.

Most novice users prefer AVAST or AVG since they are light weighted and don’t consume much of the computer resources so here we are using AVAST Free Anti Virus which is Running in the Windows 10 Computers.

Bypassing an Antivirus Prerequisites:

  1. KALI ,
  2. VEIL FRAMEWORK
  3. WINDOWS 10
  4. AVAST FREE ANTIVIRUS

Veil Framework is an old one to bypass antivirus, they generate payloads which are nearly undetectable by antiviruses.  Veil can be installed by opening a terminal and run

  • apt-get -y install git clone https://github.com/Veil-Framework/Veil-Evasion.git
  • cd Veil-Evasion/
  • cd setup
  • setup.sh -c

More Information can be found at their GitHub click here

Also Read:  Bypass an Anti Virus Detection with Encrypted Payloads using VENOM Tool

STEP 1 :

In this Kali Linux Tutorial , After installing open a terminal and navigate to veil framework directory.

Type   #python veil-evasion.py

STEP 2 :

There are few commands available, we will use list command here to check out the payloads available by default in a veil.

 

STEP 3 :

Now lets select the payload “python/shellcode_inject/arc_encrypt” numbered at 37 . The shellcode is encrypted by arc4 encryption and it’s decrypted using a key file in memory and then executed.

This information can be viewed in by issuing the info command. use the SET command to use phyrion encrypter to yes “SET USE_PHYRION Y”

STEP 4:

Now lets type generate the payload and use msfvenom by default and type the required handle. I have used the default reverse_tcphandler and fill out the LHOST and LPORT of kali Linux.

STEP 5:

Once the payload is successfully generated. The payload generated location and handler file for msf will be shown. Now lets type

#msfconsole -r /usr/share/veil-output/handlers/payload_handler.rc

STEP 6:

Now move your payload to windows and execute and We tested this on the latest free version of Avast.

Video Demonstration

The payload was executed with no pop-ups or anything from avast and kindly watch the video we have uploaded.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Disclaimer

This article is only for an Educational purpose. Any actions and or activities related to the material contained within this Website is solely your responsibility. The misuse of the information in this website can result in criminal charges brought against the persons in question. The Authors and www.gbhackers.com  will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law.