Using classic methodology to get develop a detectable payload on Windows 10 and Windows 11. We'll use this as a springboard to more successful implants in the following sections
Malware development is coming back into vogue, and with its renewed relevance in mainstream red teaming it's important to review the basics, and some new things we've covered in the Deceiving Defender series that can enable more robust malware development for beginner and intermediate-level Red Team operators. Some of the material for this course was inspired by Sektor7 courses developed by reenz0h, check those out if you find the material covered in this series interesting.
In this series of writeups, what we're going to be interested in is achieving a classic reverse shell from up-to-date Windows 10 and Windows 11 machines. We have three goals in mind:
Initially survive on disk
Establish reverse shell
Survive on disk after we close the reverse shell
Making the payload
For this part of the series, we'll be using a standard msfvenom payload.
We're going to begin with msfvenom because it is the de facto standard for open-source payload generation, and most Pentesters and Red Teamers have some experience using this. Additionally, msfvenom payloads are signatured on Windows Defender, and that will force us to explore some obfuscation techniques that we would otherwise be able to forgo.
The code in C++
We write the following code to deploy our reverse shell in a folder excluded from Windows Defender scanning in order to validate that our code works.
This is a pretty standard payload delivery code, and we obviously get caught by Windows Defender when we move it to our test folder.
If we run ThreatCheck on implant.exe we find that it's our payload that's causing issues, so lets implement some encryption in the next version of our implant.
