[script] for AV evasion

[L21ZIFER]

See, here we go again.

[jonim]

Hi all. i try use crypter.py and have some error. How solve this error ?

*] Compiling trojan horse...
sh: i586-mingw32msvc-gcc: command not found[*] Stripping out the debugging symbols...
strip: 'a.exe': No such file[*] Moving trojan horse to web root...
mv: cannot stat `a.exe': No such file or directory

I don't know how find a.exe

[LHYX1]

@jonim Please install mingw32

apt-get install mingw32

And next time read the full post before you complain about error messages

[Radnuz]

Hi LHYX1,

Your script works great, many thanks!

I have been trying to take your work a step further and integrate an alternate executable template, but not having much luck to this point. It looks like the msfencode -x is not a viable option because it is getting XOR'ed and complied afterwards. I am now looking into modifying this "i586-mingw32msvc-gcc -mwindows temp.c" to accomplish the task, but I am not having much luck.

Any ideas?

[jonim]

Many Thanks .. cool script. I use to pentest on my virtual pc/
If you don't hard? please say how this script works.

and next question , it possible to crypts shell core use ( SET ) to create shell pdf file ?



Thanks

[L21ZIFER]

Many Thanks .. cool script. I use to pentest on my virtual pc/
If you don't hard? please say how this script works.

and next question , it possible to crypts shell core use ( SET ) to create shell pdf file ?
Thanks

"Cool script" - did you really look into the lines?
And how can it be so hard to just execute a script?
It's almost the exact same thing as launching SET.

[blackhawk2292]

Many thanks. Though I did want to point out that Avast Free detects it as a suspicious program.

[zallfaizall]

thz so much bro...tis script work for me
i already test on window7 with kasperky internet security 2011...

[LHYX1]

@Radnuz So as I understand, you would like to inject the payload into a real piece of software ?
You could just take the compiled payload & bind it together with a real piece of software.
You can find tons of binders on the internet. I use easy binder:
http://descargashack.blogspot.com/20...r-v10-fud.html

[e3HQ67S]

So am I to understand that this attempts to defeat heuristics by just stalling for several seconds, hoping the AV engine times-out? Because in my experience, while this will defeat some heuristics, others (like AVG's "identity protection" heuristics) monitor the process throughout it's life. So even if you wait a several minutes, and then do something sketchy like inject into another process, the AV will still catch it and throw up a big warning message. Anyone have similar experiences?

Kudos on the payload obfuscator though.