What a joy !
I just received tonight this nice email from github :
Meatballs1 merged commit
1a3b319into from
My 2 years old pull request to metasploit was just accepted !
Long story short
Annoyed to have to chain msfencode and msfencode and msfencode to bypass anti-virus during penetration testing, we wanted to create some packers that do the job. Better than that, we wanted to integrate it in metasploit to use it with all the framework features and improve our performances :D.
I firstly figured it out that most of AVs detect ‘exe’ loader creation technique (from msfpayload) even if you put a “foobar” payload : echo -n “foobar” | msfencode -t exe -e generic/none => HIGH SCORE on virustotal.
I proposed “exe-only” technique. Shortly, it write the payload at the original entry-point of your exe template and put the section RWX so it reduces the loader signature to one RWX section only.
So next we could focus on the payload encoding.
For information, I scanned every native windows exe and find that ntkrnlpa.exe and ntoskrnl.exe contains RWX section (if AVs shoots files for having RWX sections, it would shoot Windows native exe too).
After some debate this exe-only technique was added to metasploit.
Next part was to use it with the famous psexec module that nobody use anymore because every AVs trigger it.
It’s simply because service executable created by psexec module use subsitution method, replacing “PAYLOAD:” with the payload in a template. Again, AVs trigger template regardless of the payload and to create a working template it was such a pain that we prefered use a “normal” executable and send it using psexec custom_exe feature…
So I wanted to use the previously merged “exe-only” technique to create a register service payload prepended to the user encoded payload.
That’s that stuff that took two years to land in Metasploit, mostly because I’m a noob in ruby and git (booo) and a little bit of scepticism from some metasploit guys.
Anyway, I’m proud it’s finally merged, you could just track it for fun :
07/09/2012 – https://dev.metasploit.com/redmine/issues/7231
14/10/2012 – https://github.com/rapid7/metasploit-framework/pull/903
19/05/2013 – https://github.com/rapid7/metasploit-framework/pull/1850
20/11/2013 – https://github.com/rapid7/metasploit-framework/pull/2657
07/06/2014 – Merged !
I hope you will re-use psexec now and I’m sure it bypass a lot of BIG AV at this moment because their sandbox executes the service PE that actually register itself to the SVC manager and exit. SVC manager then re run the PE beginning at the registered service entry-point.
It was very cool to speak with Metasploit guys and I know I would have to persevere for my next pull request !