🛡️Defense evasion

Desactivation d'AV

PCHunter

ressource: http://www.xuetr.com/

GMER

ressource: http://www.gmer.net/

Nsudo

ressource: https://github.com/M2Team/NSudo

PowerTool64

KillAV

Evasion de charges utiles

pycrypt

pycrypt est un outil python permettant de chiffrer des payloads afin de bypasser les anti-virus.

ressource: https://github.com/machine1337/pycrypt

Chimera

Chimera est un obfuscateur de payloads PowerShell.

Exemple d'utilisation:

./chimera.sh -f shells/Invoke-PowerShellTcp.ps1 -l 3 -o /tmp/chimera.ps1 -v -t powershell,windows,\
copyright -c -i -h -s length,get-location,ascii,stop,close,getstream -b new-object,reverse,\
invoke-expression,out-string,write-error -j -g -k -r -p

ressource: https://github.com/tokyoneon/Chimera

Bypass via accès vSphère

Recon

$ nmap -p 443 -v --script vmware-version 192.168.0.0/24

Mots de passe par défaut

List of VMware Default Usernames and Passwords