WEBVTT

00:00:00.140 --> 00:00:03.970
We discussed in previous modules that encoders and encryptors

00:00:03.980 --> 00:00:07.160
can be used to hide our shell code on disk.

00:00:07.170 --> 00:00:11.010
Things are not so straightforward in memory because we have to decode or

00:00:11.010 --> 00:00:15.230
decrypt stages and payloads in memory before executing them.

00:00:15.340 --> 00:00:19.070
We can use a different approach to get around this issue by modifying

00:00:19.070 --> 00:00:22.060
the actual code which will be executed in memory.

00:00:22.440 --> 00:00:26.210
Evading in‑memory signatures can be a time‑consuming process.

00:00:26.260 --> 00:00:29.110
My suggestion would be to identify strings,

00:00:29.120 --> 00:00:29.970
constants,

00:00:29.980 --> 00:00:34.750
exports, and any hard‑coded shell code used inside the payload or

00:00:34.750 --> 00:00:38.770
extensions, which are unlikely to be altered by compiler‑specific

00:00:38.770 --> 00:00:42.520
settings, and focus your effort on those artifacts in your code

00:00:42.520 --> 00:00:46.490
refactoring process. You will need to clone the Meterpreter payload

00:00:46.490 --> 00:00:50.030
project from GitHub and set up a build environment.

00:00:50.140 --> 00:00:54.000
A good way to identify signature candidates is to take a look at the

00:00:54.000 --> 00:00:58.100
payload and extensions using tools such as PeStudio,

00:00:58.300 --> 00:01:02.290
which will help you identify blacklisted strings and imports.

00:01:02.440 --> 00:01:06.840
You can then go ahead and attempt to remove those artifacts using various

00:01:06.840 --> 00:01:10.050
techniques, which we will take a look at during the demo.

00:01:10.150 --> 00:01:12.770
Another option you might want to take is to

00:01:12.770 --> 00:01:15.070
automate the code refactoring process.

00:01:15.230 --> 00:01:18.050
This will be more complex and time consuming at first,

00:01:18.060 --> 00:01:20.120
but can be interesting on the long run.

00:01:20.150 --> 00:01:23.370
You can, of course, also make manual changes to the code,

00:01:23.380 --> 00:01:25.750
which is how we will be doing it during the demo.

00:01:25.840 --> 00:01:29.170
Another technique we can leverage is to identify forks of the

00:01:29.180 --> 00:01:33.180
Meterpreter GitHub repository which have already been refactored and

00:01:33.180 --> 00:01:36.310
obfuscated in an attempt to make it more evasive.

00:01:36.320 --> 00:01:37.050
Finally,

00:01:37.060 --> 00:01:41.260
we can attempt to reverse engineer the solutions we are trying to bypass,

00:01:41.410 --> 00:01:43.870
which is definitely not the most generic approach.