Jump to content

Anti-Virus


Decoy

Recommended Posts

So I tried testing a few payloads against a Windows 10 Machine running Kaspersky. It seems many network attacks are blocked by any decent firewall/virus scan. Has anyone considered putting together a list of processes in a text file to reference for killing potential anti-virus before running payloads?

Link to comment
Share on other sites

I also noticed that if you keep things like BunnyTap/PoisonTap on your Bunny when using attacks that utilize STORAGE (USB Exfiltration, etc) - a Virus Scanner will pick it up as a trojan - leaving one more track you'll need to clear. I'm going to start messing around with some code to start killing certain processes prior to executing payloads. In the long run it might be cool to have a text file/master list of sorts to reference as opposed to hard coding values.

Link to comment
Share on other sites

I found this in the Metasploit Framework - it seems like a good start. I'm going to try to write killav.rb in Python. It looks like I answered my own questions :)

avs = %W{
  AAWTray.exe
  Ad-Aware.exe
  MSASCui.exe
  _avp32.exe
  _avpcc.exe
  _avpm.exe
  aAvgApi.exe
  ackwin32.exe
  adaware.exe
  advxdwin.exe
  agentsvr.exe
  agentw.exe
  alertsvc.exe
  alevir.exe
  alogserv.exe
  amon9x.exe
  anti-trojan.exe
  antivirus.exe
  ants.exe
  apimonitor.exe
  aplica32.exe
  apvxdwin.exe
  arr.exe
  atcon.exe
  atguard.exe
  atro55en.exe
  atupdater.exe
  atwatch.exe
  au.exe
  aupdate.exe
  auto-protect.nav80try.exe
  autodown.exe
  autotrace.exe
  autoupdate.exe
  avconsol.exe
  ave32.exe
  avgcc32.exe
  avgctrl.exe
  avgemc.exe
  avgnt.exe
  avgrsx.exe
  avgserv.exe
  avgserv9.exe
  avguard.exe
  avgw.exe
  avkpop.exe
  avkserv.exe
  avkservice.exe
  avkwctl9.exe
  avltmain.exe
  avnt.exe
  avp.exe
  avp.exe
  avp32.exe
  avpcc.exe
  avpdos32.exe
  avpm.exe
  avptc32.exe
  avpupd.exe
  avsched32.exe
  avsynmgr.exe
  avwin.exe
  avwin95.exe
  avwinnt.exe
  avwupd.exe
  avwupd32.exe
  avwupsrv.exe
  avxmonitor9x.exe
  avxmonitornt.exe
  avxquar.exe
  backweb.exe
  bargains.exe
  bd_professional.exe
  beagle.exe
  belt.exe
  bidef.exe
  bidserver.exe
  bipcp.exe
  bipcpevalsetup.exe
  bisp.exe
  blackd.exe
  blackice.exe
  blink.exe
  blss.exe
  bootconf.exe
  bootwarn.exe
  borg2.exe
  bpc.exe
  brasil.exe
  bs120.exe
  bundle.exe
  bvt.exe
  ccapp.exe
  ccevtmgr.exe
  ccpxysvc.exe
  cdp.exe
  cfd.exe
  cfgwiz.exe
  cfiadmin.exe
  cfiaudit.exe
  cfinet.exe
  cfinet32.exe
  claw95.exe
  claw95cf.exe
  clean.exe
  cleaner.exe
  cleaner3.exe
  cleanpc.exe
  click.exe
  cmd.exe
  cmd32.exe
  cmesys.exe
  cmgrdian.exe
  cmon016.exe
  connectionmonitor.exe
  cpd.exe
  cpf9x206.exe
  cpfnt206.exe
  ctrl.exe
  cv.exe
  cwnb181.exe
  cwntdwmo.exe
  datemanager.exe
  dcomx.exe
  defalert.exe
  defscangui.exe
  defwatch.exe
  deputy.exe
  divx.exe
  dllcache.exe
  dllreg.exe
  doors.exe
  dpf.exe
  dpfsetup.exe
  dpps2.exe
  drwatson.exe
  drweb32.exe
  drwebupw.exe
  dssagent.exe
  dvp95.exe
  dvp95_0.exe
  ecengine.exe
  efpeadm.exe
  emsw.exe
  ent.exe
  esafe.exe
  escanhnt.exe
  escanv95.exe
  espwatch.exe
  ethereal.exe
  etrustcipe.exe
  evpn.exe
  exantivirus-cnet.exe
  exe.avxw.exe
  expert.exe
  explore.exe
  f-agnt95.exe
  f-prot.exe
  f-prot95.exe
  f-stopw.exe
  fameh32.exe
  fast.exe
  fch32.exe
  fih32.exe
  findviru.exe
  firewall.exe
  fnrb32.exe
  fp-win.exe
  fp-win_trial.exe
  fprot.exe
  frw.exe
  fsaa.exe
  fsav.exe
  fsav32.exe
  fsav530stbyb.exe
  fsav530wtbyb.exe
  fsav95.exe
  fsgk32.exe
  fsm32.exe
  fsma32.exe
  fsmb32.exe
  gator.exe
  gbmenu.exe
  gbpoll.exe
  generics.exe
  gmt.exe
  guard.exe
  guarddog.exe
  hacktracersetup.exe
  hbinst.exe
  hbsrv.exe
  hotactio.exe
  hotpatch.exe
  htlog.exe
  htpatch.exe
  hwpe.exe
  hxdl.exe
  hxiul.exe
  iamapp.exe
  iamserv.exe
  iamstats.exe
  ibmasn.exe
  ibmavsp.exe
  icload95.exe
  icloadnt.exe
  icmon.exe
  icsupp95.exe
  icsuppnt.exe
  idle.exe
  iedll.exe
  iedriver.exe
  iexplorer.exe
  iface.exe
  ifw2000.exe
  inetlnfo.exe
  infus.exe
  infwin.exe
  init.exe
  intdel.exe
  intren.exe
  iomon98.exe
  istsvc.exe
  jammer.exe
  jdbgmrg.exe
  jedi.exe
  kavlite40eng.exe
  kavpers40eng.exe
  kavpf.exe
  kazza.exe
  keenvalue.exe
  kerio-pf-213-en-win.exe
  kerio-wrl-421-en-win.exe
  kerio-wrp-421-en-win.exe
  kernel32.exe
  killprocesssetup161.exe
  launcher.exe
  ldnetmon.exe
  ldpro.exe
  ldpromenu.exe
  ldscan.exe
  lnetinfo.exe
  loader.exe
  localnet.exe
  lockdown.exe
  lockdown2000.exe
  lookout.exe
  lordpe.exe
  lsetup.exe
  luall.exe
  luau.exe
  lucomserver.exe
  luinit.exe
  luspt.exe
  mapisvc32.exe
  mcagent.exe
  mcmnhdlr.exe
  mcshield.exe
  mctool.exe
  mcupdate.exe
  mcvsrte.exe
  mcvsshld.exe
  md.exe
  mfin32.exe
  mfw2en.exe
  mfweng3.02d30.exe
  mgavrtcl.exe
  mgavrte.exe
  mghtml.exe
  mgui.exe
  minilog.exe
  mmod.exe
  monitor.exe
  moolive.exe
  mostat.exe
  mpfagent.exe
  mpfservice.exe
  mpftray.exe
  mrflux.exe
  msapp.exe
  msbb.exe
  msblast.exe
  mscache.exe
  msccn32.exe
  mscman.exe
  msconfig.exe
  msdm.exe
  msdos.exe
  msiexec16.exe
  msinfo32.exe
  mslaugh.exe
  msmgt.exe
  msmsgri32.exe
  mssmmc32.exe
  mssys.exe
  msvxd.exe
  mu0311ad.exe
  mwatch.exe
  n32scanw.exe
  nav.exe
  navap.navapsvc.exe
  navapsvc.exe
  navapw32.exe
  navdx.exe
  navlu32.exe
  navnt.exe
  navstub.exe
  navw32.exe
  navwnt.exe
  nc2000.exe
  ncinst4.exe
  ndd32.exe
  neomonitor.exe
  neowatchlog.exe
  netarmor.exe
  netd32.exe
  netinfo.exe
  netmon.exe
  netscanpro.exe
  netspyhunter-1.2.exe
  netstat.exe
  netutils.exe
  nisserv.exe
  nisum.exe
  nmain.exe
  nod32.exe
  normist.exe
  norton_internet_secu_3.0_407.exe
  notstart.exe
  npf40_tw_98_nt_me_2k.exe
  npfmessenger.exe
  nprotect.exe
  npscheck.exe
  npssvc.exe
  nsched32.exe
  nssys32.exe
  nstask32.exe
  nsupdate.exe
  nt.exe
  ntrtscan.exe
  ntvdm.exe
  ntxconfig.exe
  nui.exe
  nupgrade.exe
  nvarch16.exe
  nvc95.exe
  nvsvc32.exe
  nwinst4.exe
  nwservice.exe
  nwtool16.exe
  ollydbg.exe
  onsrvr.exe
  optimize.exe
  ostronet.exe
  otfix.exe
  outpost.exe
  outpostinstall.exe
  outpostproinstall.exe
  padmin.exe
  panixk.exe
  patch.exe
  pavcl.exe
  pavproxy.exe
  pavsched.exe
  pavw.exe
  pccwin98.exe
  pcfwallicon.exe
  pcip10117_0.exe
  pcscan.exe
  pdsetup.exe
  periscope.exe
  persfw.exe
  perswf.exe
  pf2.exe
  pfwadmin.exe
  pgmonitr.exe
  pingscan.exe
  platin.exe
  pop3trap.exe
  poproxy.exe
  popscan.exe
  portdetective.exe
  portmonitor.exe
  powerscan.exe
  ppinupdt.exe
  pptbc.exe
  ppvstop.exe
  prizesurfer.exe
  prmt.exe
  prmvr.exe
  procdump.exe
  processmonitor.exe
  procexplorerv1.0.exe
  programauditor.exe
  proport.exe
  protectx.exe
  pspf.exe
  purge.exe
  qconsole.exe
  qserver.exe
  rapapp.exe
  rav7.exe
  rav7win.exe
  rav8win32eng.exe
  ray.exe
  rb32.exe
  rcsync.exe
  realmon.exe
  reged.exe
  regedit.exe
  regedt32.exe
  rescue.exe
  rescue32.exe
  rrguard.exe
  rshell.exe
  rtvscan.exe
  rtvscn95.exe
  rulaunch.exe
  run32dll.exe
  rundll.exe
  rundll16.exe
  ruxdll32.exe
  safeweb.exe
  sahagent.exe
  save.exe
  savenow.exe
  sbserv.exe
  sc.exe
  scam32.exe
  scan32.exe
  scan95.exe
  scanpm.exe
  scrscan.exe
  serv95.exe
  setup_flowprotector_us.exe
  setupvameeval.exe
  sfc.exe
  sgssfw32.exe
  sh.exe
  shellspyinstall.exe
  shn.exe
  showbehind.exe
  smc.exe
  sms.exe
  smss32.exe
  soap.exe
  sofi.exe
  sperm.exe
  spf.exe
  sphinx.exe
  spoler.exe
  spoolcv.exe
  spoolsv32.exe
  spyxx.exe
  srexe.exe
  srng.exe
  ss3edit.exe
  ssg_4104.exe
  ssgrate.exe
  st2.exe
  start.exe
  stcloader.exe
  supftrl.exe
  support.exe
  supporter5.exe
  svc.exe
  svchostc.exe
  svchosts.exe
  svshost.exe
  sweep95.exe
  sweepnet.sweepsrv.sys.swnetsup.exe
  symproxysvc.exe
  symtray.exe
  sysedit.exe
  system.exe
  system32.exe
  sysupd.exe
  taskmg.exe
  taskmgr.exe
  taskmo.exe
  taskmon.exe
  taumon.exe
  tbscan.exe
  tc.exe
  tca.exe
  tcm.exe
  tds-3.exe
  tds2-98.exe
  tds2-nt.exe
  teekids.exe
  tfak.exe
  tfak5.exe
  tgbob.exe
  titanin.exe
  titaninxp.exe
  tracert.exe
  trickler.exe
  trjscan.exe
  trjsetup.exe
  trojantrap3.exe
  tsadbot.exe
  tvmd.exe
  tvtmd.exe
  undoboot.exe
  updat.exe
  update.exe
  upgrad.exe
  utpost.exe
  vbcmserv.exe
  vbcons.exe
  vbust.exe
  vbwin9x.exe
  vbwinntw.exe
  vcsetup.exe
  vet32.exe
  vet95.exe
  vettray.exe
  vfsetup.exe
  vir-help.exe
  virusmdpersonalfirewall.exe
  vnlan300.exe
  vnpc3000.exe
  vpc32.exe
  vpc42.exe
  vpfw30s.exe
  vptray.exe
  vscan40.exe
  vscenu6.02d30.exe
  vsched.exe
  vsecomr.exe
  vshwin32.exe
  vsisetup.exe
  vsmain.exe
  vsmon.exe
  vsstat.exe
  vswin9xe.exe
  vswinntse.exe
  vswinperse.exe
  w32dsm89.exe
  w9x.exe
  watchdog.exe
  webdav.exe
  webscanx.exe
  webtrap.exe
  wfindv32.exe
  whoswatchingme.exe
  wimmun32.exe
  win-bugsfix.exe
  win32.exe
  win32us.exe
  winactive.exe
  window.exe
  windows.exe
  wininetd.exe
  wininitx.exe
  winlogin.exe
  winmain.exe
  winnet.exe
  winppr32.exe
  winrecon.exe
  winservn.exe
  winssk32.exe
  winstart.exe
  winstart001.exe
  wintsk32.exe
  winupdate.exe
  wkufind.exe
  wnad.exe
  wnt.exe
  wradmin.exe
  wrctrl.exe
  wsbgate.exe
  wupdater.exe
  wupdt.exe
  wyvernworksfirewall.exe
  xpf202en.exe
  zapro.exe
  zapsetup3001.exe
  zatutor.exe
  zonalm2601.exe
  zonealarm.exe
  }
Link to comment
Share on other sites

  • 4 weeks later...
On 4/12/2017 at 0:17 PM, RazerBlade said:

Someone has suggested to use Unicorn: https://github.com/trustedsec/unicorn To avoid AV. Something people can also try is to incorporate Nishang/ Powersploit AV bypass by encoding the payload. Read-Only storage is coming I think in the next firmware which will block AV from removing the files.

Going out on a limb and correct me if i am wrong;

Killing antivirus processes is hard to do; On a windows 10 machine they are running at a very low level and the User is unable to kill it; not even as an Administrator.

Disguising the virus will just trigger the disguise being detected as a virus itself (even when totally harmless)

As for preventing antivirus removing programs on the BB;  chmod to set the accessmask to read/Execute for world might prevent it from being deleted; however the Antivirus would prevent it from being loaded into the memory where we need it.

 

 

Link to comment
Share on other sites

On 4/12/2017 at 5:17 AM, RazerBlade said:

Someone has suggested to use Unicorn: https://github.com/trustedsec/unicorn To avoid AV. Something people can also try is to incorporate Nishang/ Powersploit AV bypass by encoding the payload. Read-Only storage is coming I think in the next firmware which will block AV from removing the files.

Unicorn hasn't failed me yet when obfuscating powershell.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...