SlideShare a Scribd company logo
1 of 40
Download to read offline
AV Evasion
With the
Veil Framework
#avlol
@HarmJ0y
@ChrisTruncer
@TheMightyShiv
@VeilFramework
@VeilFramework
●  Will Schroeder @HarmJ0y
○ 

Former national research lab keyboard monkey

●  Chris Truncer @ChrisTruncer
○ 

Florida State Graduate - Go Noles!

●  Michael Wright @TheMightyShiv
○ 

Pulled away on assessment : (

●  Veris Group pentesters by day, antivirus
evasion researchers by night
Overview
•  The Problem
•  Public Reaction and Ethical Considerations
•  The Veil Framework
•  Payload Releases
•  Veil-Evasion Demo
•  Payload Delivery
•  Veil-Catapult Demo
•  How to stop us
The Problem
Antivirus can’t catch malware but does catch
pentesters
Our Solution
•  A way to get around antivirus as easily as
professional malware

•  Don’t want to roll our own backdoor each
time

•  Find a way to execute existing shellcode in
an av-evading way
Our Solution
Veil-Evasion’s Approach
•  Aggregation of various shellcode injection
techniques across multiple languages
o 

These have been known and documented in other
tools

•  Focused on automation, usability, and
developing a true framework

•  Some shellcodeless Meterpreter stagers as
well
Ethical Considerations
●  The disclosure debate is not new...
●  Pentesters are 5+ years behind the
professional malware community
●  This is already a problem the bad guys have
solved
HD Moore’s Take
“The strongest case for information disclosure is
when the benefit of releasing the information
outweighs the possible risks. In this case, like
many others, the bad guys already won.”
https://community.rapid7.com/community/metasploit/blog/2009/02/23/the-best-defense-is-information
Our Take
•  We chose the path of full public disclosure

•  We want to help the security industry better
emulate threats

•  AV vendors can see our code!
Public Reaction
●  “surely this will just result in 21 new signatures for all
major AVs and then we're back to square one?”
●  “Isn't our entire field meant to be working towards
increasing security, rather than handing out fully
functioning weapons?”
●  “The other point here is that anything that helps to
expose how in-effective AV really is at stopping
even a minimally sophisticated attacker is a good
thing.”
http://www.reddit.com/r/netsec/comments/1fc2xp/veil_a_metasploit_payload_generator_for_bypassing/
The Veil
Framework
Veil-Evasion
Veil-Evasion Features
•  Can use Metasploit-generated or custom
shellcode
o 

MSF payloads/options dynamically loaded

•  Third party tools can be easily integrated
o 

Hyperion, PEScrambler, BackDoor Factory, etc.

•  Command line switches to allow scriptability
Armitage Integration
•  The veil_evasion.cna script allows for the
graphical integration of Veil-Evasion into
Armitage/Cobalt Strike

•  Payloads can be generated and optionally

substituted into all psexec calls seamlessly

http://blog.strategiccyber.com/2012/08/03/cortana-real-time-collaborativehacking-with-bots/
Native Compilation
Python: pyinstaller/py2exe
C#: mono for .NET
C: mingw32
Module Development
•  Implement your own obfuscation methods

•  Lots of reusable functionality
o 

Shellcode generation is abstracted and can be
invoked as needed

•  https://www.veil-framework.com/tutorial-veilpayload-development/
Am I Getting Caught?
•  A running hash list of every payload

generated is kept in ~/veil-output/hashes.txt

•  Mubix’s vt-notify script* can alert us if a
customer submits a Veil payload to
virustotal.com

*https://github.com/mubix/vt-notify
checkvt
Shellcode Injection
•  Void pointer casting
o 

no guarantee the memory region is executable

•  VirtualAlloc
o 

allocate memory as RWX, copy code in and create a
thread

•  HeapAlloc
o 

create a heap object and manually allocate memory
DEP and Pyinstaller
•  Pyinstaller produced .exe’s are DEP enabled
by default
o 

this ruins some shellcode injection methods

•  Luckily Pyinstaller is open source
o 

we can recompile to turn off DEP opt-in

•  https://www.veil-evasion.com/deppyinstaller/
Payload
Releases
#VDay
V-Day
•  We release at least one new payload on the
15th of every month

•  24 currently published payloads
•  20+ additional payloads have been
developed so far
o 

we’re going to be releasing for a while :)
Shellcodeless Stagers
●  Stage 1 Meterpreter loaders don’t have to be
implemented in shellcode
●  Meterpreter stagers can be written in higherlevel languages
●  https://github.com/rsmudge/metasploitloader
Veil Stagers
●  The following are the stagers currently
available in the framework:
Language

Stager

C

meterpreter/rev_tcp

C

meterpreter/rev_tcp_service

C#

meterpreter/rev_tcp

python

meterpreter/rev_tcp

python

meterpreter/rev_http

python

meterpreter/rev_https
Stager Basics
How a Meterpreter stager works:
1) a tcp connection is opened to the handler
2) the handler sends back 4 bytes indicating
the .dll size, and then transfers the .dll
3) the socket number for this tcp connection
is pushed into the edi register
4) execution is passed to the .dll just like
regular shellcode (void * or VirtualAlloc)
DEMO #1
Veil
Framework
Veil-Catapult
Veil-Catapult
●  Our payload delivery system
●  Features nice integration with Veil-Evasion
for on-the-fly payload generation
●  Cleanup scripts generated for payload killing
and deletion
●  Command line flags for every option
Veil-Catapult
.EXE Delivery
●  Users can invoke Veil-Evasion to generate a
payload, or specify an existing .exe
●  Payloads are delivered in one of two ways:
○ 
○ 

upload/execute using Impacket and pth-toolkit
host/execute UNC path to the attacker’s box

●  UNC invocation gets otherwise
detectable .EXEs right by some AVs (lol
@MSE)
Standalone Payloads
●  Powershell: shellcode injector, bye bye disk
writes
○ 

http://www.exploit-monday.com/2011/10/exploitingpowershells-features-not.html

●  Barebones python: uploads a minimal python
installation to invoke shellcode (see: next slide)
●  Sethc backdoor: issues a registry command to
set up the sticky-keys RDP backdoor
Barebones Python
●  Uploads a minimal python .zip installation
and 7zip binary
●  Python environment unzipped, shellcode
invoked using “-c …”
●  The only files that touch disk are trusted
python libraries and a python interpreter
●  Gets right by reputation filters and antivirus!
DEMO #2
How to Stop Us
#avlol
Predictable Behavior
•  A lot of malware and Veil-Evasion payload
behaviors are fairly predictable:
o 
o 

Immediate reverse connection to a target
RWX memory page allocation, binary code copying,
thread creation, etc.

•  A small set of APIs are usually used in a
very specific and non-standard way
Ambush IPS
•  An intrusion prevention system that allows
for flexible rules to be written for API calls

•  Rules can be written to stop Meterpreter

stagers without affecting normal execution

•  http://ambuships.com/
EMET
•  Microsoft’s Enhanced Mitigation Experience
Toolkit

•  Has some mechanisms that stop the ability
for an executable to inject shellcode

•  Ruins powershell shellcode injection
• 

http://technet.microsoft.com/en-us/security/jj653751
Where to Find Veil
•  Web: https://www.veil-framework.com

•  Now in Kali! apt-get install veil
•  Github:

https://github.com/Veil-Framework/Veil/
Questions?
•  harmj0y@veil-framework.com
o  @harmj0y

•  chris@veil-framework.com
o  @ChrisTruncer

•  shiv@veil-framework.com
o  @TheMightyShiv

More Related Content

What's hot

PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingNikhil Mittal
 
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementUsing IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementJoe Vest
 
aclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundDirkjanMollema
 
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2WTF is Penetration Testing v.2
WTF is Penetration Testing v.2Scott Sutherland
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentTeymur Kheirkhabarov
 
Introduction to Vault
Introduction to VaultIntroduction to Vault
Introduction to VaultKnoldus Inc.
 
Detection Rules Coverage
Detection Rules CoverageDetection Rules Coverage
Detection Rules CoverageSunny Neo
 
Thick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash CourseThick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash CourseScott Sutherland
 
BloodHound Unleashed.pdf
BloodHound Unleashed.pdfBloodHound Unleashed.pdf
BloodHound Unleashed.pdfn00py1
 
Waf bypassing Techniques
Waf bypassing TechniquesWaf bypassing Techniques
Waf bypassing TechniquesAvinash Thapa
 
Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop Hossam .M Hamed
 
Red Team Methodology - A Naked Look
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked LookJason Lang
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemRoss Wolf
 
ReCertifying Active Directory
ReCertifying Active DirectoryReCertifying Active Directory
ReCertifying Active DirectoryWill Schroeder
 

What's hot (20)

PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple Teaming
 
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementUsing IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
 
aclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHound
 
How fun of privilege escalation Red Pill2017
How fun of privilege escalation  Red Pill2017How fun of privilege escalation  Red Pill2017
How fun of privilege escalation Red Pill2017
 
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2WTF is Penetration Testing v.2
WTF is Penetration Testing v.2
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
 
Hashicorp Vault ppt
Hashicorp Vault pptHashicorp Vault ppt
Hashicorp Vault ppt
 
Introduction to Vault
Introduction to VaultIntroduction to Vault
Introduction to Vault
 
Api security-testing
Api security-testingApi security-testing
Api security-testing
 
Broken Authentication and Authorization(1).pptx
Broken Authentication and Authorization(1).pptxBroken Authentication and Authorization(1).pptx
Broken Authentication and Authorization(1).pptx
 
Detection Rules Coverage
Detection Rules CoverageDetection Rules Coverage
Detection Rules Coverage
 
Thick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash CourseThick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash Course
 
BloodHound Unleashed.pdf
BloodHound Unleashed.pdfBloodHound Unleashed.pdf
BloodHound Unleashed.pdf
 
Ssrf
SsrfSsrf
Ssrf
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
 
Waf bypassing Techniques
Waf bypassing TechniquesWaf bypassing Techniques
Waf bypassing Techniques
 
Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop
 
Red Team Methodology - A Naked Look
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked Look
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
 
ReCertifying Active Directory
ReCertifying Active DirectoryReCertifying Active Directory
ReCertifying Active Directory
 

Viewers also liked

A Battle Against the Industry - Beating Antivirus for Meterpreter and More
A Battle Against the Industry - Beating Antivirus for Meterpreter and MoreA Battle Against the Industry - Beating Antivirus for Meterpreter and More
A Battle Against the Industry - Beating Antivirus for Meterpreter and MoreCTruncer
 
The Art of AV Evasion - Or Lack Thereof
The Art of AV Evasion - Or Lack ThereofThe Art of AV Evasion - Or Lack Thereof
The Art of AV Evasion - Or Lack ThereofCTruncer
 
Ever Present Persistence - Established Footholds Seen in the Wild
Ever Present Persistence - Established Footholds Seen in the WildEver Present Persistence - Established Footholds Seen in the Wild
Ever Present Persistence - Established Footholds Seen in the WildCTruncer
 
Bringing Down the House - How One Python Script Ruled Over AntiVirus
Bringing Down the House - How One Python Script Ruled Over AntiVirusBringing Down the House - How One Python Script Ruled Over AntiVirus
Bringing Down the House - How One Python Script Ruled Over AntiVirusCTruncer
 
The State of the Veil Framework
The State of the Veil FrameworkThe State of the Veil Framework
The State of the Veil FrameworkVeilFramework
 
Higher Level Malware
Higher Level MalwareHigher Level Malware
Higher Level MalwareCTruncer
 
Passive Intelligence Gathering and Analytics - It's All Just Metadata!
Passive Intelligence Gathering and Analytics - It's All Just Metadata!Passive Intelligence Gathering and Analytics - It's All Just Metadata!
Passive Intelligence Gathering and Analytics - It's All Just Metadata!CTruncer
 
AntiVirus Evasion Reconstructed - Veil 3.0
AntiVirus Evasion Reconstructed - Veil 3.0AntiVirus Evasion Reconstructed - Veil 3.0
AntiVirus Evasion Reconstructed - Veil 3.0CTruncer
 
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013midnite_runr
 
An EyeWitness View into your Network
An EyeWitness View into your NetworkAn EyeWitness View into your Network
An EyeWitness View into your NetworkCTruncer
 
Pen Testing, Red Teaming, and More
Pen Testing, Red Teaming, and MorePen Testing, Red Teaming, and More
Pen Testing, Red Teaming, and MoreCTruncer
 
Hacking - Breaking Into It
Hacking - Breaking Into ItHacking - Breaking Into It
Hacking - Breaking Into ItCTruncer
 
What Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data ExfiltrationWhat Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data ExfiltrationCTruncer
 
Pentester++
Pentester++Pentester++
Pentester++CTruncer
 
Egress-Assess and Owning Data Exfiltration
Egress-Assess and Owning Data ExfiltrationEgress-Assess and Owning Data Exfiltration
Egress-Assess and Owning Data ExfiltrationCTruncer
 
EyeWitness - A Web Application Triage Tool
EyeWitness - A Web Application Triage ToolEyeWitness - A Web Application Triage Tool
EyeWitness - A Web Application Triage ToolCTruncer
 
The Supporting Role of Antivirus Evasion while Persisting
The Supporting Role of Antivirus Evasion while PersistingThe Supporting Role of Antivirus Evasion while Persisting
The Supporting Role of Antivirus Evasion while PersistingCTruncer
 

Viewers also liked (20)

The Veil-Framework
The Veil-FrameworkThe Veil-Framework
The Veil-Framework
 
A Battle Against the Industry - Beating Antivirus for Meterpreter and More
A Battle Against the Industry - Beating Antivirus for Meterpreter and MoreA Battle Against the Industry - Beating Antivirus for Meterpreter and More
A Battle Against the Industry - Beating Antivirus for Meterpreter and More
 
The Art of AV Evasion - Or Lack Thereof
The Art of AV Evasion - Or Lack ThereofThe Art of AV Evasion - Or Lack Thereof
The Art of AV Evasion - Or Lack Thereof
 
Ever Present Persistence - Established Footholds Seen in the Wild
Ever Present Persistence - Established Footholds Seen in the WildEver Present Persistence - Established Footholds Seen in the Wild
Ever Present Persistence - Established Footholds Seen in the Wild
 
Bringing Down the House - How One Python Script Ruled Over AntiVirus
Bringing Down the House - How One Python Script Ruled Over AntiVirusBringing Down the House - How One Python Script Ruled Over AntiVirus
Bringing Down the House - How One Python Script Ruled Over AntiVirus
 
The State of the Veil Framework
The State of the Veil FrameworkThe State of the Veil Framework
The State of the Veil Framework
 
Higher Level Malware
Higher Level MalwareHigher Level Malware
Higher Level Malware
 
Passive Intelligence Gathering and Analytics - It's All Just Metadata!
Passive Intelligence Gathering and Analytics - It's All Just Metadata!Passive Intelligence Gathering and Analytics - It's All Just Metadata!
Passive Intelligence Gathering and Analytics - It's All Just Metadata!
 
AntiVirus Evasion Reconstructed - Veil 3.0
AntiVirus Evasion Reconstructed - Veil 3.0AntiVirus Evasion Reconstructed - Veil 3.0
AntiVirus Evasion Reconstructed - Veil 3.0
 
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
 
An EyeWitness View into your Network
An EyeWitness View into your NetworkAn EyeWitness View into your Network
An EyeWitness View into your Network
 
Pen Testing, Red Teaming, and More
Pen Testing, Red Teaming, and MorePen Testing, Red Teaming, and More
Pen Testing, Red Teaming, and More
 
Hacking - Breaking Into It
Hacking - Breaking Into ItHacking - Breaking Into It
Hacking - Breaking Into It
 
What Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data ExfiltrationWhat Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data Exfiltration
 
Pentester++
Pentester++Pentester++
Pentester++
 
Egress-Assess and Owning Data Exfiltration
Egress-Assess and Owning Data ExfiltrationEgress-Assess and Owning Data Exfiltration
Egress-Assess and Owning Data Exfiltration
 
Veil-Ordnance
Veil-OrdnanceVeil-Ordnance
Veil-Ordnance
 
EyeWitness - A Web Application Triage Tool
EyeWitness - A Web Application Triage ToolEyeWitness - A Web Application Triage Tool
EyeWitness - A Web Application Triage Tool
 
L2
L2L2
L2
 
The Supporting Role of Antivirus Evasion while Persisting
The Supporting Role of Antivirus Evasion while PersistingThe Supporting Role of Antivirus Evasion while Persisting
The Supporting Role of Antivirus Evasion while Persisting
 

Similar to AV Evasion with the Veil Framework

Adventures in Asymmetric Warfare
Adventures in Asymmetric WarfareAdventures in Asymmetric Warfare
Adventures in Asymmetric WarfareWill Schroeder
 
The Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldThe Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldDevOps.com
 
Creating Havoc using Human Interface Device
Creating Havoc using Human Interface DeviceCreating Havoc using Human Interface Device
Creating Havoc using Human Interface DevicePositive Hack Days
 
Building world-class security response and secure development processes
Building world-class security response and secure development processesBuilding world-class security response and secure development processes
Building world-class security response and secure development processesDavid Jorm
 
Hacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass FirewallsHacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass FirewallsNetsparker
 
PowerShell Defcon for Cybersecurity Topics
PowerShell Defcon for Cybersecurity TopicsPowerShell Defcon for Cybersecurity Topics
PowerShell Defcon for Cybersecurity TopicsDev 010101
 
[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...
[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...
[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...Hackito Ergo Sum
 
Security research over Windows #defcon china
Security research over Windows #defcon chinaSecurity research over Windows #defcon china
Security research over Windows #defcon chinaPeter Hlavaty
 
Rooted con 2020 - from the heaven to hell in the CI - CD
Rooted con 2020 - from the heaven to hell in the CI - CDRooted con 2020 - from the heaven to hell in the CI - CD
Rooted con 2020 - from the heaven to hell in the CI - CDDaniel Garcia (a.k.a cr0hn)
 
EMBA Firmware analysis - TROOPERS22
EMBA Firmware analysis - TROOPERS22EMBA Firmware analysis - TROOPERS22
EMBA Firmware analysis - TROOPERS22MichaelM85042
 
Demystifying Binary Reverse Engineering - Pixels Camp
Demystifying Binary Reverse Engineering - Pixels CampDemystifying Binary Reverse Engineering - Pixels Camp
Demystifying Binary Reverse Engineering - Pixels CampAndré Baptista
 
Building an Empire with PowerShell
Building an Empire with PowerShellBuilding an Empire with PowerShell
Building an Empire with PowerShellWill Schroeder
 
Docker en kernel security
Docker en kernel securityDocker en kernel security
Docker en kernel securitysmart_bit
 
Dynamic Languages in Production: Progress and Open Challenges
Dynamic Languages in Production: Progress and Open ChallengesDynamic Languages in Production: Progress and Open Challenges
Dynamic Languages in Production: Progress and Open Challengesbcantrill
 
Reverse Engineering Presentation.pdf
Reverse Engineering Presentation.pdfReverse Engineering Presentation.pdf
Reverse Engineering Presentation.pdfAbdelrahmanShaban3
 
Deep dive nella supply chain della nostra infrastruttura cloud
Deep dive nella supply chain della nostra infrastruttura cloudDeep dive nella supply chain della nostra infrastruttura cloud
Deep dive nella supply chain della nostra infrastruttura cloudsparkfabrik
 
Pitfalls and limits of dynamic malware analysis
Pitfalls and limits of dynamic malware analysisPitfalls and limits of dynamic malware analysis
Pitfalls and limits of dynamic malware analysisTamas K Lengyel
 
Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...
Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...
Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...sparkfabrik
 
Analysis of-quality-of-pkgs-in-packagist-univ-20171024
Analysis of-quality-of-pkgs-in-packagist-univ-20171024Analysis of-quality-of-pkgs-in-packagist-univ-20171024
Analysis of-quality-of-pkgs-in-packagist-univ-20171024Clark Everetts
 

Similar to AV Evasion with the Veil Framework (20)

Adventures in Asymmetric Warfare
Adventures in Asymmetric WarfareAdventures in Asymmetric Warfare
Adventures in Asymmetric Warfare
 
The Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldThe Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote World
 
Creating Havoc using Human Interface Device
Creating Havoc using Human Interface DeviceCreating Havoc using Human Interface Device
Creating Havoc using Human Interface Device
 
Building world-class security response and secure development processes
Building world-class security response and secure development processesBuilding world-class security response and secure development processes
Building world-class security response and secure development processes
 
Hacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass FirewallsHacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass Firewalls
 
PowerShell Defcon for Cybersecurity Topics
PowerShell Defcon for Cybersecurity TopicsPowerShell Defcon for Cybersecurity Topics
PowerShell Defcon for Cybersecurity Topics
 
[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...
[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...
[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...
 
Security research over Windows #defcon china
Security research over Windows #defcon chinaSecurity research over Windows #defcon china
Security research over Windows #defcon china
 
Rooted con 2020 - from the heaven to hell in the CI - CD
Rooted con 2020 - from the heaven to hell in the CI - CDRooted con 2020 - from the heaven to hell in the CI - CD
Rooted con 2020 - from the heaven to hell in the CI - CD
 
EMBA Firmware analysis - TROOPERS22
EMBA Firmware analysis - TROOPERS22EMBA Firmware analysis - TROOPERS22
EMBA Firmware analysis - TROOPERS22
 
Demystifying Binary Reverse Engineering - Pixels Camp
Demystifying Binary Reverse Engineering - Pixels CampDemystifying Binary Reverse Engineering - Pixels Camp
Demystifying Binary Reverse Engineering - Pixels Camp
 
Building an Empire with PowerShell
Building an Empire with PowerShellBuilding an Empire with PowerShell
Building an Empire with PowerShell
 
Docker en kernel security
Docker en kernel securityDocker en kernel security
Docker en kernel security
 
Dynamic Languages in Production: Progress and Open Challenges
Dynamic Languages in Production: Progress and Open ChallengesDynamic Languages in Production: Progress and Open Challenges
Dynamic Languages in Production: Progress and Open Challenges
 
Reverse Engineering Presentation.pdf
Reverse Engineering Presentation.pdfReverse Engineering Presentation.pdf
Reverse Engineering Presentation.pdf
 
Deep dive nella supply chain della nostra infrastruttura cloud
Deep dive nella supply chain della nostra infrastruttura cloudDeep dive nella supply chain della nostra infrastruttura cloud
Deep dive nella supply chain della nostra infrastruttura cloud
 
Pitfalls and limits of dynamic malware analysis
Pitfalls and limits of dynamic malware analysisPitfalls and limits of dynamic malware analysis
Pitfalls and limits of dynamic malware analysis
 
Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...
Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...
Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...
 
Analysis of-quality-of-pkgs-in-packagist-univ-20171024
Analysis of-quality-of-pkgs-in-packagist-univ-20171024Analysis of-quality-of-pkgs-in-packagist-univ-20171024
Analysis of-quality-of-pkgs-in-packagist-univ-20171024
 
Sonatype DevSecOps Leadership forum 2020
Sonatype DevSecOps Leadership forum 2020Sonatype DevSecOps Leadership forum 2020
Sonatype DevSecOps Leadership forum 2020
 

Recently uploaded

2024 April Patch Tuesday
2024 April Patch Tuesday2024 April Patch Tuesday
2024 April Patch TuesdayIvanti
 
All These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFAll These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFMichael Gough
 
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...BookNet Canada
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersNicole Novielli
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfpanagenda
 
Glenn Lazarus- Why Your Observability Strategy Needs Security Observability
Glenn Lazarus- Why Your Observability Strategy Needs Security ObservabilityGlenn Lazarus- Why Your Observability Strategy Needs Security Observability
Glenn Lazarus- Why Your Observability Strategy Needs Security Observabilityitnewsafrica
 
Irene Moetsana-Moeng: Stakeholders in Cybersecurity: Collaborative Defence fo...
Irene Moetsana-Moeng: Stakeholders in Cybersecurity: Collaborative Defence fo...Irene Moetsana-Moeng: Stakeholders in Cybersecurity: Collaborative Defence fo...
Irene Moetsana-Moeng: Stakeholders in Cybersecurity: Collaborative Defence fo...itnewsafrica
 
Varsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
Varsha Sewlal- Cyber Attacks on Critical Critical InfrastructureVarsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
Varsha Sewlal- Cyber Attacks on Critical Critical Infrastructureitnewsafrica
 
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...Alkin Tezuysal
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfNeo4j
 
Landscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfLandscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfAarwolf Industries LLC
 
Zeshan Sattar- Assessing the skill requirements and industry expectations for...
Zeshan Sattar- Assessing the skill requirements and industry expectations for...Zeshan Sattar- Assessing the skill requirements and industry expectations for...
Zeshan Sattar- Assessing the skill requirements and industry expectations for...itnewsafrica
 
JET Technology Labs White Paper for Virtualized Security and Encryption Techn...
JET Technology Labs White Paper for Virtualized Security and Encryption Techn...JET Technology Labs White Paper for Virtualized Security and Encryption Techn...
JET Technology Labs White Paper for Virtualized Security and Encryption Techn...amber724300
 
Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024TopCSSGallery
 
Kuma Meshes Part I - The basics - A tutorial
Kuma Meshes Part I - The basics - A tutorialKuma Meshes Part I - The basics - A tutorial
Kuma Meshes Part I - The basics - A tutorialJoão Esperancinha
 
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesMuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesManik S Magar
 
Long journey of Ruby standard library at RubyConf AU 2024
Long journey of Ruby standard library at RubyConf AU 2024Long journey of Ruby standard library at RubyConf AU 2024
Long journey of Ruby standard library at RubyConf AU 2024Hiroshi SHIBATA
 
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Nikki Chapple
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality AssuranceInflectra
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPathCommunity
 

Recently uploaded (20)

2024 April Patch Tuesday
2024 April Patch Tuesday2024 April Patch Tuesday
2024 April Patch Tuesday
 
All These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFAll These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDF
 
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software Developers
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
 
Glenn Lazarus- Why Your Observability Strategy Needs Security Observability
Glenn Lazarus- Why Your Observability Strategy Needs Security ObservabilityGlenn Lazarus- Why Your Observability Strategy Needs Security Observability
Glenn Lazarus- Why Your Observability Strategy Needs Security Observability
 
Irene Moetsana-Moeng: Stakeholders in Cybersecurity: Collaborative Defence fo...
Irene Moetsana-Moeng: Stakeholders in Cybersecurity: Collaborative Defence fo...Irene Moetsana-Moeng: Stakeholders in Cybersecurity: Collaborative Defence fo...
Irene Moetsana-Moeng: Stakeholders in Cybersecurity: Collaborative Defence fo...
 
Varsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
Varsha Sewlal- Cyber Attacks on Critical Critical InfrastructureVarsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
Varsha Sewlal- Cyber Attacks on Critical Critical Infrastructure
 
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdf
 
Landscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfLandscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdf
 
Zeshan Sattar- Assessing the skill requirements and industry expectations for...
Zeshan Sattar- Assessing the skill requirements and industry expectations for...Zeshan Sattar- Assessing the skill requirements and industry expectations for...
Zeshan Sattar- Assessing the skill requirements and industry expectations for...
 
JET Technology Labs White Paper for Virtualized Security and Encryption Techn...
JET Technology Labs White Paper for Virtualized Security and Encryption Techn...JET Technology Labs White Paper for Virtualized Security and Encryption Techn...
JET Technology Labs White Paper for Virtualized Security and Encryption Techn...
 
Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024
 
Kuma Meshes Part I - The basics - A tutorial
Kuma Meshes Part I - The basics - A tutorialKuma Meshes Part I - The basics - A tutorial
Kuma Meshes Part I - The basics - A tutorial
 
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesMuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
 
Long journey of Ruby standard library at RubyConf AU 2024
Long journey of Ruby standard library at RubyConf AU 2024Long journey of Ruby standard library at RubyConf AU 2024
Long journey of Ruby standard library at RubyConf AU 2024
 
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
Microsoft 365 Copilot: How to boost your productivity with AI – Part one: Ado...
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to Hero
 

AV Evasion with the Veil Framework

  • 1. AV Evasion With the Veil Framework #avlol @HarmJ0y @ChrisTruncer @TheMightyShiv @VeilFramework
  • 2. @VeilFramework ●  Will Schroeder @HarmJ0y ○  Former national research lab keyboard monkey ●  Chris Truncer @ChrisTruncer ○  Florida State Graduate - Go Noles! ●  Michael Wright @TheMightyShiv ○  Pulled away on assessment : ( ●  Veris Group pentesters by day, antivirus evasion researchers by night
  • 3. Overview •  The Problem •  Public Reaction and Ethical Considerations •  The Veil Framework •  Payload Releases •  Veil-Evasion Demo •  Payload Delivery •  Veil-Catapult Demo •  How to stop us
  • 4. The Problem Antivirus can’t catch malware but does catch pentesters
  • 5. Our Solution •  A way to get around antivirus as easily as professional malware •  Don’t want to roll our own backdoor each time •  Find a way to execute existing shellcode in an av-evading way
  • 7. Veil-Evasion’s Approach •  Aggregation of various shellcode injection techniques across multiple languages o  These have been known and documented in other tools •  Focused on automation, usability, and developing a true framework •  Some shellcodeless Meterpreter stagers as well
  • 8. Ethical Considerations ●  The disclosure debate is not new... ●  Pentesters are 5+ years behind the professional malware community ●  This is already a problem the bad guys have solved
  • 9. HD Moore’s Take “The strongest case for information disclosure is when the benefit of releasing the information outweighs the possible risks. In this case, like many others, the bad guys already won.” https://community.rapid7.com/community/metasploit/blog/2009/02/23/the-best-defense-is-information
  • 10. Our Take •  We chose the path of full public disclosure •  We want to help the security industry better emulate threats •  AV vendors can see our code!
  • 11. Public Reaction ●  “surely this will just result in 21 new signatures for all major AVs and then we're back to square one?” ●  “Isn't our entire field meant to be working towards increasing security, rather than handing out fully functioning weapons?” ●  “The other point here is that anything that helps to expose how in-effective AV really is at stopping even a minimally sophisticated attacker is a good thing.” http://www.reddit.com/r/netsec/comments/1fc2xp/veil_a_metasploit_payload_generator_for_bypassing/
  • 13. Veil-Evasion Features •  Can use Metasploit-generated or custom shellcode o  MSF payloads/options dynamically loaded •  Third party tools can be easily integrated o  Hyperion, PEScrambler, BackDoor Factory, etc. •  Command line switches to allow scriptability
  • 14. Armitage Integration •  The veil_evasion.cna script allows for the graphical integration of Veil-Evasion into Armitage/Cobalt Strike •  Payloads can be generated and optionally substituted into all psexec calls seamlessly http://blog.strategiccyber.com/2012/08/03/cortana-real-time-collaborativehacking-with-bots/
  • 15.
  • 17. Module Development •  Implement your own obfuscation methods •  Lots of reusable functionality o  Shellcode generation is abstracted and can be invoked as needed •  https://www.veil-framework.com/tutorial-veilpayload-development/
  • 18. Am I Getting Caught? •  A running hash list of every payload generated is kept in ~/veil-output/hashes.txt •  Mubix’s vt-notify script* can alert us if a customer submits a Veil payload to virustotal.com *https://github.com/mubix/vt-notify
  • 20. Shellcode Injection •  Void pointer casting o  no guarantee the memory region is executable •  VirtualAlloc o  allocate memory as RWX, copy code in and create a thread •  HeapAlloc o  create a heap object and manually allocate memory
  • 21. DEP and Pyinstaller •  Pyinstaller produced .exe’s are DEP enabled by default o  this ruins some shellcode injection methods •  Luckily Pyinstaller is open source o  we can recompile to turn off DEP opt-in •  https://www.veil-evasion.com/deppyinstaller/
  • 23. V-Day •  We release at least one new payload on the 15th of every month •  24 currently published payloads •  20+ additional payloads have been developed so far o  we’re going to be releasing for a while :)
  • 24. Shellcodeless Stagers ●  Stage 1 Meterpreter loaders don’t have to be implemented in shellcode ●  Meterpreter stagers can be written in higherlevel languages ●  https://github.com/rsmudge/metasploitloader
  • 25. Veil Stagers ●  The following are the stagers currently available in the framework: Language Stager C meterpreter/rev_tcp C meterpreter/rev_tcp_service C# meterpreter/rev_tcp python meterpreter/rev_tcp python meterpreter/rev_http python meterpreter/rev_https
  • 26. Stager Basics How a Meterpreter stager works: 1) a tcp connection is opened to the handler 2) the handler sends back 4 bytes indicating the .dll size, and then transfers the .dll 3) the socket number for this tcp connection is pushed into the edi register 4) execution is passed to the .dll just like regular shellcode (void * or VirtualAlloc)
  • 29. Veil-Catapult ●  Our payload delivery system ●  Features nice integration with Veil-Evasion for on-the-fly payload generation ●  Cleanup scripts generated for payload killing and deletion ●  Command line flags for every option
  • 31. .EXE Delivery ●  Users can invoke Veil-Evasion to generate a payload, or specify an existing .exe ●  Payloads are delivered in one of two ways: ○  ○  upload/execute using Impacket and pth-toolkit host/execute UNC path to the attacker’s box ●  UNC invocation gets otherwise detectable .EXEs right by some AVs (lol @MSE)
  • 32. Standalone Payloads ●  Powershell: shellcode injector, bye bye disk writes ○  http://www.exploit-monday.com/2011/10/exploitingpowershells-features-not.html ●  Barebones python: uploads a minimal python installation to invoke shellcode (see: next slide) ●  Sethc backdoor: issues a registry command to set up the sticky-keys RDP backdoor
  • 33. Barebones Python ●  Uploads a minimal python .zip installation and 7zip binary ●  Python environment unzipped, shellcode invoked using “-c …” ●  The only files that touch disk are trusted python libraries and a python interpreter ●  Gets right by reputation filters and antivirus!
  • 35. How to Stop Us #avlol
  • 36. Predictable Behavior •  A lot of malware and Veil-Evasion payload behaviors are fairly predictable: o  o  Immediate reverse connection to a target RWX memory page allocation, binary code copying, thread creation, etc. •  A small set of APIs are usually used in a very specific and non-standard way
  • 37. Ambush IPS •  An intrusion prevention system that allows for flexible rules to be written for API calls •  Rules can be written to stop Meterpreter stagers without affecting normal execution •  http://ambuships.com/
  • 38. EMET •  Microsoft’s Enhanced Mitigation Experience Toolkit •  Has some mechanisms that stop the ability for an executable to inject shellcode •  Ruins powershell shellcode injection •  http://technet.microsoft.com/en-us/security/jj653751
  • 39. Where to Find Veil •  Web: https://www.veil-framework.com •  Now in Kali! apt-get install veil •  Github: https://github.com/Veil-Framework/Veil/
  • 40. Questions? •  harmj0y@veil-framework.com o  @harmj0y •  chris@veil-framework.com o  @ChrisTruncer •  shiv@veil-framework.com o  @TheMightyShiv