Veil – A Payload Generator to Bypass Antivirus

[Nytro]

[h=1]Veil – A Payload Generator to Bypass Antivirus[/h]Posted by CTruncer on May 30, 2013

NOTE: Please, be kind, and don’t submit any payloads to VirusTotal.

On nearly every assessment, pen testers have to fight a battle against antivirus solutions. The level of effort that goes into each “battle” relies on the AV solution, its definitions, etc. Researching methods to bypass antivirus solutions has been an interest of mine on and off for the past 6 months. About two months ago I started to take a more serious look in how I could take my recent research and turn it into something that more usable and useful. I set out with a couple goals:

• Bypass common AV solutions that I/we routinely encounter in most network environments
  
• Utilize payloads that are compatible with the Metasploit framework, and expand upon these in future releases
  
• Attempt to make each payload file as random as possible
  

With these goals in mind, I continued researching methods of bypassing AV. Since I wanted to maintain metasploit compatibility, I chose to use shellcode generated by the metasploit framework, specifically msfvenom. To accomplish this, I began looking into other available research, which is where I discovered a number of interesting techniques that a variety of people, such as Dave Kennedy and Debasish Mandal, already began to develop. From their research, I learned about really interesting ways to inject shellcode into memory through python. These methods were the foundation of the rest of my research.

Since the majority of our assessment are against predominantly Windows environments, it was important that the tool worked reliably against these systems. Since I chose to write the tool in Python, I had to figure out how to package the Python output files containing the obfuscated shellcode to execute on Windows without requiring Python to be installed on the target machine. One of the solutions I looked into was using Py2Exe. I knew other software used this method to convert their Python-based scripts or tools into an executable that could run on Windows and figured I could do the same. I began testing Py2Exe with the payload files I developed and was successful running the executables on various versions of Windows, so I stuck with that solution. The final part was for me to develop a tool that automated the payload generation process, and I’m happy to release Veil.

Note: Please be sure to check out https://www.veil-evasion.com, Veil’s website for the latest tutorials, updates, and repo location.

Veil is currently capable of using 7 different methods to make 21 different payloads, all of which result in meterpreter connections. Veil provides the user with the option of using either Pyinstaller or Py2Exe to convert their python payload into an executable. With Pyinstaller, Veil users and have their file converted into an executable all within Kali and does not require the use of a second VM/Machine. When using Py2Exe,Veil will generate three files to which are required to create the final executable; a payload file (in Python), a file with runtime instructions for Py2Exe, and a batch script which handles converting the payload file into an executable. To generate the final payload, copy the three output files to a Windows host with Python, Py2Exe, and PyCrypto installed and execute the batch script. This will build the final executable that is uploaded to the target. The executable file can be dropped anywhere, on any Windows system, as all required libraries are stored within the exe file. Once dropped on a system and executed, the payload will result in a meterpeter callback that is undetected by AV.

I’ve tested the packaged executable against multiple AV solutions (MSE, Kaspersky, AVG, Symantec, and McAfee), on both test systems and “in the wild,” and have a very high success rate, bypassing detection in almost every circumstance. I hope that, by releasing this tool, I can enable others in the community to provide more effective assessments by allowing them to focus their efforts on security risks and spend less time bypassing ineffective security measures that wouldn’t deter an actual adversary.

Setup:

For Kali:

1. Run the setup script (setup.sh) and follow the installation process.
   
2. Once the setup script has completed, delete the setup script.
   

For Windows (when using Py2Exe)

1. Install Python 2.7 - (tested with x86 – Python 2.7 Release)
   
2. Install Py2Exe - (py2exe - Browse /py2exe/0.6.9 at SourceForge.net)
   
3. Install PyCrypto - (The Voidspace Python Modules)
   

Instructions for Use:

1. Run Veil from Kali and generate your payload.
   
2. If using Pyinstaller, your payload will be converted into an executable and is available for immediate use.
   
3. If using Py2Exe
   
   • Move the payload.py along with its two accompanying files onto your Windows machine (that already has python and the other dependencies from above installed). All three files should be placed in the root of the directory Python was installed to (likely C:\Python27).
     
   • Run the batch script to convert the Python payload into an executable format.
     

[*]Place the payload file on your target machine through any means necessary!

Future Direction:

• Research new methods of encrypting or obfuscating the payload.
  
• Research other languages with direct access to the Windows API for delivering the payload.
  

Want to play with Veil? Feel free to do so. Download, clone, do anything you’d like with it. You can download Veil here - https://github.com/ChrisTruncer/Veil.

I hope that it can help others on their tests just as it has helped me. Please, if anyone has additional functionality they would like to add, I’d love to have input from the community!

To learn how to effectively use Veil on assessments, and other Red Team techniques, check out our class at Blackhat USA 2013! And check out our Pen Testing class as well!

References:

Dave Kennedy - http://www.trustedsec.com/files/BSIDESLV_Secret_Pentesting_Techniques.pdf

Debasish Mandal -

Debasish Mandal's Blog: Execute ShellCode Using Python

Sursa: https://www.christophertruncer.com/veil-a-payload-generator-to-bypass-antivirus/