‫OK, so so far, we've seen how we can bypass pretty much all antivirus programs using Empire and the
‫far right.
‫The only problem is we were always getting detected by one or two antivirus programs.
‫So the result wasn't perfect.
‫Now the cool thing about the bat backdoor is generated with Empire, and the far right is that the code
‫in them is dos and PowerShell code.
‫So we can literally just open them using a normal text editor and we'll be able to modify that code
‫so that the backdoors are a bit more unique than the than the default backdoors that get generated using
‫these programs.
‫And then hopefully their signature will be different than the other backdoors that are generated using
‫Empire and the far right.
‫And therefore, we should be able to bypass more antivirus programs.
‫Now we can't open the backdoor generated with will use in a text editor because they'll generate ICSI
‫backdoors.
‫And if we open them using a text editor, we'll just get gibberish.
‫So what I'm going to do now is I'm just going to go to where I started my backdoor, which is I'm just
‫going to click on the navigation bar and go to VAR w WW hash HTML.
‫Evil files.
‫And we have our empire and our fight right back to it.
‫Now I'm going to do this example on Empire, so I'm going to right click it.
‫And open it with text editor, as you can see, if you don't see this, then just go on open with other
‫application and then open it with Lyford.
‫And as you can see, we have code that's actually readable and the code in here is literally windows
‫commands.
‫And then in here we have a PowerShell command which is going to run our shell code.
‫So this is the shell code and as you can see, it's actually encrypted.
‫And this is the part of the code that would give us a reverse connection and it'll allow us to gain
‫access or hack the target computer.
‫So I'm not a genius, what I did is I came to this file and the first thing I did is I removed everything
‫from the file and I literally only kept this this particular line, the shell code.
‫So I removed all of this.
‫And they removed all of this.
‫And then I uploaded this to not distribute just to see if the shellcode is getting detected.
‫If the shellcode is getting detected, then you need to play around with the parameters, with the ports,
‫with the stager that you're using.
‫So until you reach a shell code that's not detected, so you can't really just just modify the shell
‫code here from the text editor because as you can see, it's already encrypted and decrypted it and
‫then modifying the parameters will probably just break the hold back.
‫So I removed everything I tested it in, not distribute.
‫I just uploaded the file, as is.
‫I know this file is not going to work like this, but I uploaded it like this to know, distribute and
‫I bypassed all antivirus.
‫So it's like, OK, this is cool.
‫My shellcode is not getting detected, so I undo everything like I just did now.
‫And then I started playing around with the parameters one by one.
‫So after I did that, I just literally removed this whole line and then I tested with no distributor
‫again.
‫I saved the file uploaded to distribute.
‫I bypassed everything.
‫So I was like, OK, this is pretty cool, undo.
‫And I kept these two and I removed the rest.
‫Again, like sometimes literally just the word of PowerShell to trigger some antivirus programs.
‫So what I was trying to do is I wanted to isolate the part of the code, thus triggering antivirus programs.
‫So again, I deleted this.
‫I tested again.
‫I still bypassed everything.
‫So again, I added what I had, and I kept doing this until I literally reached this point where I just
‫put my PowerShell like this and I upload it and it still works.
‫It still bypasses all antivirus programs.
‫And I was like, OK, so the only difference here is the forward slash B. So this is just an argument
‫for the command.
‫I delete that uploaded to node distribute and I bypassed everything again.
‫So literally, if you actually upload this code right here to not distribute, it's going to bypass
‫everything.
‫And if you add the forward slash B to it, it's going to get detected by two antivirus programs like
‫we've seen before.
‫So what I did is I actually kept this and I just added another argument just to mix it up and make the
‫file look different.
‫So that's forward slash men, which basically tells Windows to minimize the pop up window, so it's
‫not to even show it on screen.
‫The point of this beauty here actually is to prevent the window from showing on screen as well.
‫So you can literally just remove this B or add another argument here and what this is going to do,
‫it's going to change the source code of the file.
‫It's going to change the signature of the file, and it's actually going to bypass all antivirus programs
‫by literally just adding one argument that doesn't really affect the whole code.
‫So let's upload this file now again to not distribute just to prove to you that it's actually bypassing
‫everything.
‫And this is my file right here.
‫As you can see, it just got modified.
‫I'm going to open it.
‫And can it?
‫And as you can see, it's getting detected by zero antivirus programs, and it's bypassing everything.
‫And again, we literally did that by on the ad in one argument to the command, which is forward slash
‫men.
‫Now, when you're testing dependent on the times that you're testing, your default back door might
‫actually bypass everything.
‫So maybe the back door that you're creating with the latest version of Empire just literally bypasses
‫everything.
‫Now, the main point to take from this is if your back door is getting detected by you three or two
‫antivirus programs, then open it and play around with the arguments.
‫But make sure the first thing you do is you test you remove everything and test if this shell code is
‫getting detected.
‫If the shell code is not getting detected, then play around with these arguments.
‫Play around with by adding arguments, removing arguments and literally just remove them all and add
‫them one by one.
‫Like I said, like the method I followed.
‫And each time you add something uploaded to another, distribute and see.
‫By doing that, you'll be able to isolate which part of the code is triggering the antivirus program,
‫and then you'll be able to remove it or modified or manipulate it in a way so that it produces a different
‫signature and therefore bypass antivirus programs.
‫Now let's test this backdoor because we actually modified its code, and we're not sure if this is going
‫to work now.
‫So I'm going to go to my Windows machine.
‫And I'm just going to download my file right here.
‫And I'm going to save it.
‫And then I'm going to open it.
‫And as you can see, we got our agent, so if we go to agents.
‫And as you can see, we have a connection so we can interact with it.
‫Just put CPR and tub.
‫Hit enter and we're inside, we have full access, full control over the target computer and we bypassed
‫all antivirus programs.