> For the complete documentation index, see [llms.txt](https://blog.s1rn3tz.ovh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.s1rn3tz.ovh/post-exploitation/defense-evasion.md).

# Defense evasion

## Desactivation d'AV

### PCHunter

ressource: <http://www.xuetr.com/>

### GMER

ressource: <http://www.gmer.net/>

### Nsudo

ressource: <https://github.com/M2Team/NSudo>

### PowerTool64

### KillAV

## Evasion de charges utiles

### pycrypt

pycrypt est un outil python permettant de chiffrer des payloads afin de bypasser les anti-virus.

ressource: <https://github.com/machine1337/pycrypt>

### Chimera

Chimera est un obfuscateur de payloads PowerShell.

Exemple d'utilisation:

```
./chimera.sh -f shells/Invoke-PowerShellTcp.ps1 -l 3 -o /tmp/chimera.ps1 -v -t powershell,windows,\
copyright -c -i -h -s length,get-location,ascii,stop,close,getstream -b new-object,reverse,\
invoke-expression,out-string,write-error -j -g -k -r -p
```

ressource: <https://github.com/tokyoneon/Chimera>

## Bypass via accès vSphère

### Recon

*`$ nmap -p 443 -v --script vmware-version 192.168.0.0/24`*

### Mots de passe par défaut

{% embed url="<http://kendrickcoleman.com/index.php/Tech-Blog/list-of-vmware-default-usernames-and-passwords.html>" %}