WEBVTT

00:00:00.340 --> 00:00:03.420
Writing a custom shellcode runner as we did previously in

00:00:03.420 --> 00:00:06.760
the Meterpreter Deep Dive module is a good way to embed a

00:00:06.760 --> 00:00:09.390
stager inside an executable file.

00:00:09.490 --> 00:00:13.290
It also avoids many artifacts that may be left behind

00:00:13.350 --> 00:00:18.180
when using them msfvenom format, such as exe and exe‑only.

00:00:18.180 --> 00:00:22.830
In order to assess the evasiveness of our shellcode runner,

00:00:22.830 --> 00:00:25.180
let's upload it to VirusTotal.

00:00:25.290 --> 00:00:29.090
VirusTotal is an online service which is backed by roughly

00:00:29.090 --> 00:00:33.470
70 antivirus scanners and reputation services. Once our

00:00:33.470 --> 00:00:38.260
shellcode runner has been scanned, we can review the output. Surprisingly,

00:00:38.320 --> 00:00:44.180
only 24 out of 69 antivirus scanners flagged our file as being malicious.

00:00:44.430 --> 00:00:49.060
This is not bad considering that we have not obfuscated the stager in any way.