• XSS.stack #1 – первый литературный журнал от юзеров форума

Статья Generating Undetected Payload & Changing extension to jpg

qGodless

(L2) cache
Пользователь
Регистрация
10.07.2022
Сообщения
385
Реакции
106
This forum has helped me a lot. Its time to give back
So this method isn't new or made by me its just SFX feature in WinRAR With my personal modifications. Though I'm surprised that this isn't widely abused by attackers

Table of content
  • Generating payload
  • Getting your icon
  • Changing the settings
  • Testing if worked (It did)
  • Changing the file extension to jpg

The first step is to generate the payload and listener. I assume you already know this

1660600265619.png


Now we are going to make our executable look like an image, as at the moment the icon is the default one that looks suspicious!
Download your favorite JPG image from the internet and save it in the same directory where you saved your executable payload, according to the screenshot below.

1660600401241.png


Now change it to .ico

1660600428154.png


Well, we have all the files (.ico, .jpg and .exe) as shown below:


1660600500386.png


In the next step, you need to create a file that combines both files into one, that is ( image.jpg and virus.exe ), as shown below:


1660600514819.png


After that, just set all the things as mentioned in the screenshot below:

  • Filename: (Enter any name)
  • File format: RAR
  • Compression method: Better
  • Dictionary size: 256 MB
  • Archiving options: [Select] Create SFX archive
and then click the tab Advanced.

1660600534790.png


In the tab for advanced, Click on SFX Options.

1660600542445.png


A new dialog box will further open where you need to configure a few options such as:

  • Export route: E: \
Here, do not put C: \ in this field because when you click on the final image at the end, it will ask you to run it with administrator privileges and your target will easily understand that it is a virus. To trick him, always use D: \ or E: \ or you can also leave it blank.

But if you leave this field blank, then it will export both files (image.jpg and virus.exe) to the same directory.

1660600569430.png


In addition, go to the 2nd tab where you need to add two lines of code to which the first line will be the name of your image, ie image.jpg and the second line contains will contain the name of your payload that is virus.exe in the area "Execution after export”(Run after extraction).

1660600583926.png


Now you also need to set the icon as a thumbnail in “Load SFX icon from file”(Load SFX icon from the file) so that the file looks like a suitable image file.

1660600596808.png


And you also have to change the choice silent operation into a Hide all in section "Functions”As shown below:

1660600618134.png


In the last but not least important step, click on “Replace all files On the tab information, because every time the user opens this image, the exported files will be immediately replaced in the same directory that we created in the step above.

1660600632198.png


In the last but not least important step, click on “Replace all filesOn the tab information, because every time the user opens this image, the exported files will be immediately replaced in the same directory that we created in the step above.


1660600639718.png


When someone clicks on this image, it will open in the default photo editor and at the same time, the exe file or virus will run in the background.

1660600685165.png


Back on our machine, ie Kali Linux, the Meterpreter session was successfully connected and we now have access to our target machine (Windows 10), as shown below.

Type Sysinfo to learn more about your target operating system and architecture.

1660600701561.png


You can also execute further useful commands such as pwd (Present Working Directory), getpid (Current Process ID) and Screenshot (Active Window) etc.


But if the target has the "Show File extension" option ON. It would raise suspicion. To avoid that we need to change the extension by using the "Extension spoofing" Exploit

This trick uses Right to Left unicode to reverse the last six characters so that the extension is spoofed. For example, a notes.exe file can be renamed to notesexe.txt. Although the file extension clearly shows as .txt in Explorer, the Windows operating system still recognizes the file as an application.

1660602071076.png


Since the Right to Left override character cannot be typed from the keyboard you can copy it from here: https://unicode-explorer.com/c/202E

Unfortunately most major web browsers have stepped up to blacklist the right to left override character so that the correct file extensions are shown correctly when a user attempts to download the file with a spoofed extension. Winrar As well


Results
 

Вложения

  • 1660602073536.png
    1660602073536.png
    13.8 КБ · Просмотры: 107
  • 1660604449085.png
    1660604449085.png
    41.4 КБ · Просмотры: 106
  • 1660604476489.png
    1660604476489.png
    41.4 КБ · Просмотры: 108
  • 1660604872671.png
    1660604872671.png
    41.5 КБ · Просмотры: 96
Последнее редактирование:
This is an old tecnique and has very limited functionality - it's just the poor man's "dropper". The reason it is limited is that although you could in theory "smuggle" some virus.exe past "scan time" detection in this way, it will still be detected immediately upon execution because it is dropping the virus.exe payload which is detected. If you were to protect the virus.exe with encryption and packing, then that just shifts which exe is protected and the whole idea of using rarsfx to smuggle is meaningless. Any normal user will see a windows defender alert and they won't even be ABLE to run your payload, their computer won't even allow it.

A much smarter method is to inject a payload directly into memory, and there are hundreds of different EDR bypass methods for this now, seems a new method posted to github every day or two.
 
zeneq, I agree, This is a poor man's dropper. But you have to agree that most people here do not know what the fuck a dropper is. This is a method to show you how a dropper works by creating one manually.
I could give everyone here a shitty RATTED FUD Cryptor. But my goal is to teach people how to create they're own and not be skids.
I would never share something wouldn't work or a Cryptor that would infect them (maybe like u). Again my goal is to teach!

And I did mention that this would not be efficient unless you create something out of your mind. Like changing comp method or Making an SFX inside of an SFX
To get 0/26. You have to compress the sfx with RAR4 not RAR. Thats because everyone uses RAR so it gets known

Посмотреть вложение 41428
 
Wow, you actually had the temerity to unload this steaming pile of vacuous reply?
1. you accuse xss.pro members of not knowing "what the fuck" a dropper is. really? 🤔
2. you imply that you were thinking of giving out a backdoored cryptor, which the very idea is insulting and oblivious
3. you are peddling some skid shit from 20 years ago and then have the balls to paint xss.pro users as, this time, "skids"!
4. then you embarass yourself further, pretending like your Matryoshka solution will somehow solve detection! you are still ultimately dropping a detected exe to disk! wake up and think!
qGodless, you really need to check yourself and up your game because this is all just pathetic.
old_ass_techniques_regurgitated_by_skids.png
 
Последнее редактирование:


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх