WEBVTT

00:00:00.640 --> 00:00:03.670
Although we have already bypassed Windows Defender with our

00:00:03.670 --> 00:00:07.250
PowerShell‑based stager, let's now go through a demo in which I will

00:00:07.250 --> 00:00:10.910
apply some anti‑emulation techniques to our custom stager,

00:00:10.920 --> 00:00:14.170
which we wrote in C++ previously in an attempt to

00:00:14.170 --> 00:00:16.379
bypass Windows Defender's emulator.

00:00:16.840 --> 00:00:17.870
As you can see,

00:00:17.880 --> 00:00:20.690
I have already added the code designed to exhaust the

00:00:20.690 --> 00:00:23.210
emulator at the start of our main function.

00:00:23.270 --> 00:00:26.160
This will ensure that before the emulator is able to

00:00:26.160 --> 00:00:28.080
check what our stager is doing,

00:00:28.090 --> 00:00:31.420
it will have to emulate millions of CPU instructions.

00:00:31.430 --> 00:00:33.660
I chose to write the function in assembly.

00:00:33.740 --> 00:00:37.740
We can take a look at the code in the exhaustion.asm file.

00:00:37.750 --> 00:00:42.080
As you can see, I move a random high value into the rcx

00:00:42.080 --> 00:00:44.620
register, which will serve as a loop counter.

00:00:44.790 --> 00:00:48.970
I then enter the loop, which will execute four bogus instructions,

00:00:49.270 --> 00:00:53.860
decrement the RCX register and check if the RCX register is null.

00:00:54.040 --> 00:00:58.260
If it isn't null, the jump is taken back up to the start of our loop.

00:00:58.540 --> 00:01:02.270
This will keep occurring until the RCX counter is equal to

00:01:02.270 --> 00:01:05.680
null, at which point the function will return.

00:01:05.880 --> 00:01:10.320
The function is ran 10 times, followed by the actual stager code.

00:01:10.440 --> 00:01:15.060
We can go ahead and set up a Metasploit handler and compile and run this code.

00:01:17.540 --> 00:01:20.520
After a few seconds, you will notice that we get an

00:01:20.520 --> 00:01:23.280
antivirus alert. Interestingly, however,

00:01:23.290 --> 00:01:27.590
the process is not terminated. And if we go back to our Metasploit handler,

00:01:27.850 --> 00:01:31.710
we will find that we do indeed have a fully‑functional Meterpreter session

00:01:31.720 --> 00:01:36.190
despite the antivirus alert. The reason we did get an antivirus alert will

00:01:36.190 --> 00:01:39.850
be explained in later modules where we further discuss obfuscating the

00:01:39.850 --> 00:01:42.360
payload when it gets sent over the network.