VincBreaker Posted March 9, 2017 Share Posted March 9, 2017 Hi there, I got my bunny today and while developing a payload to drop my meterpreter onto the computer, it actually got detected by my AV and deleted from the storage. At that point, I remembered a pretty boring defcon talk I once saw showing a device able to block every write / delete on an usb stick. Further it allowed to filter the data to get passed to the os so you can ultimatively hide any files until you need them which can be especially useful when you have a stick with multiple exploits / payloads on it and some of them may trigger the AV but are not necesserily needed at one stage or your usb stick get's checked when walking into a facility while pentesting (actually happened to me once :/). So I'm kindly requesting an extension to the API which: Allows to block every write to the usb stick. Allows to filter every read / write from / to the storage. I would suggest the visitor pattern, but I guess it is not compatible to bash :( Yours sincerely, VincBreaker Quote Link to comment Share on other sites More sharing options...
Bijleveldje Posted March 10, 2017 Share Posted March 10, 2017 It would probably still get detected when you move it to the pc, so this doesnt really help anything. There are other ways to bypass av's though. Just google it :p Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.