100% Anti-Virus evasion with Metasploit browser exploits (example with ms11-003)

Now days,  Windows based systems currently run anti-virus protection software in order to detect any malicious software. With msfencode we can encode our produced payload (meterpreter, reverse_tcp, etc…) in an attempt to make it harder to discover, but is not always so easy to avoid these detections…

The following article from foip isn’t an another tutorial which explains how to type “set encoder xxx” on your keyboard.  Foip showing you how to bypass McAfee Anti-Virus detection of your favorite exploits modifying the original source code by using a try-and-error method.

Read full article : http://funoverip.net/2011/04/100pc-anti-virus-evasion-with-metasploit-browser-exploits-from-ms11-003/

Syringe – DLL and Shellcode Process Injection Utility

If you remember about an old post of ours – Shellcodeexec, you might have a faint idea of what Syringe does. Shellcodeexec is a small script to execute in memory a sequence of opcodes. What it does is it spawns a new thread where the shellcode is executed in a structure exception handler (SEH). Syringe is a general purpose injection utility for the Windows platform. It supports injection of DLLs, and shellcode into remote processes as well execution of shellcode (via the same method of shellcodeexec). It can be very useful for executing Metasploit payloads while bypassing many popular anti-virus implementations as well as executing custom made DLLs.


Syringe can inject this modified version into the remote process and successfully execute shellcode in its context, interact with our shellcode and exit out of it, without damaging the remote process. Implimenting this technique, it provides users an easy way of injecting shellcode into 32-bit processes while bypassing most forms of antiviruses! Simply put, this technique is implimented by Syringe follows these steps:


Opens a handle to the remote process.
Uses VirtualAllocEx to allocate memory in the remote process with the necessary permissions of read, write, and execute.  Then uses WriteProcessMemory to copy the shellcode to the remote buffer.
Repeats step #2 with the assembly stub.
Starts the assembly stub via a call to CreateRemoteThread, with a pointer to the assembly stub as the function to execute and a pointer to the remote shellcode as the argument.