Posted by scriptjunkie in Metasploit on April 15, 2011
Payload executables generated by msfencode are commonly detected by antivirus engines, depending which antivirus engine is used. A common misconception is that the antivirus engines are actually detecting the shellcode, and therefore, the best way to avoid antivirus detection is to pick an encoder that the antivirus engine cannot handle, or encode many times. After […]
antivirus, encoder, exe, malicious, msfencode, payload, shellcode
Posted by scriptjunkie in /dev/urandom on April 14, 2011
In many situations, you can find yourself with a simple shell, able to read and write stdin/stdout, but some command that you are using requires a full terminal. Example: you got a netcat shell on a server or you’re writing a web application with popen() calls, etc. If you need to execute a command through […]
Posted by scriptjunkie in Metasploit on March 5, 2010
For all you shellcoders out there; to make Windows API calling easier, you can use Stephen Fewer’s block_api.asm in the Metasploit tree. http://www.metasploit.com/redmine/projects/framework/repository/revisions/8160/entry/external/source/shellcode/windows/x86/src/block/block_api.asm But you need the function hashes, which if you don’t have the DLL on your current OS, or the python file, or something like that can be annoying. So I posted a […]
Fusion theme by digitalnature | powered by WordPress
Entries (RSS) and Comments (RSS) ^