Reverse Shell UNDETECTED by Microsoft Defender (hoaxshell) 

This is awesome to have the provider of this script comment on your channel John. You’re awesome man you motivate me daily.

Would you be able to put some of the stuff that doesn't fit into the URL into a header?

@@centdemeern1 you could, although, i believe the best approach would be to split the cmd output to multiple get requests (if output.length > 2064 ) and notify the hoaxshell server accordingly to combine a number of GET requests, e.g. via a custom header, like "X-Combine: 5" or whatever. There's actually an unlimited amount of awesome things you could do by enriching the powershell payload but the length of it is a major issue. I tried to keep the payloads generated by hoaxshell as short and compact as possible.

@@HaxorTechTones I see, that makes sense. Maybe something like this could be a command line flag (ex. --constrained-language-mode) with a warning that it'll make the payload larger. If not, maybe I'll fork it or something. If I feel like it. Who knows.

@@centdemeern1 yeah i was actually thinking to add exactly that in the next update.

Probably encoded UTF-8, since it only encounters problems with one or two characters it seems. UTF-8 is compatible with ASCII until you use characters not in ASCII, which get encoded as double width or wider. Possibly sublime detected the resulting file as UTF-8 when ASCII would have been better, or something. Difficult to know exactly where things screwed up.

❌He doesnt copy all of the B64 at 11:00 lol, thats why❌ Edit: nah nvm

@@handlemchandleson1 Not true. Also he's pasting there. If the base64 string was incomplete, there wouldn't be the == at the end

@@beyondcatastrophe_ he forgot the first line at the top

@@handlemchandleson1 He doesn't use the pasted content though when he tries to select it within the payload.b64 file. He directly specifies base64 -d payload.b64 (which contains the full payload) instead of doing an echo "PasteStringHere" | base64 -d

It's left-handed, as opposed to what you're referring to. Probably a stylized Hindu sauwastika. It's also a character in Chinese and Japanese script, or it could be something else entirely. Aliens? Tire burns for monster trucks? The possibilities are endless!

You’re forgetting @ippsec

and LiveOverflow!

@ippsec is probably not human LOL but certainly my best source into ethic hacking

yeah, you can definitely replace bombal from that list for a quality cyber sec channel... IPPSEC, hackersploit, The Cyber Mentor, etc.

No love for @jackrhysider ?

Executing code on a target is a trivial task, given the multitude of delivery methods ranging from phishing thru web-based scripts to USB disks or keyboard impersonators. If you can block all of those - and in theory it's not a bad idea - you'll end up in practice with a very limited-use computer, which might as well be running a RISC-based CPU & OS if it can still do its intended job in this state.

Enterprise nws probably would have a firewall

@@elllieeeeeeeeeeeeeeeeeeeeeeeee True, and a connection to Port 80 instead 8080 will be tunneled through the proxy, maybe 443 with SSL and the Firewall is not set up to decrypt the stream to inspect it. Could work, good Enterprise Networks do SSL Inspection, but only if the host is not having set up security measures like Google or Microsoft do. Problem is, like it always was, bring the code into a system and execute it. You can't send a ps1 file and say "hey, here is a patch", because per Default, script execution is disabled and a warning pops up. You can send an Exe file, which starts a powershell in a process in the background, but how do you get your App to your victim. Still, a nice tool to know.

@@elllieeeeeeeeeeeeeeeeeeeeeeeee proxies exist to allow firewall bypass for specific protocols. Users are often restricted in terms of what they can access via the proxy - ususlly based on categories defined by the proxy vendor, unless the company chooses to micromanage on a per-URL basis. Admins, however, often have way less restrictions, and are a more valuable target anyway. The solution is threat-hunting: someone must ensure logs are gathered from the end user devices, proxies, firewalls, switches & every other element in the chain, then built alerts and actions based on content found across all of those log types.

Should have said, alerting on obfuscated powershell in a SIEM would have detected that it ran

probably that powershell - e payload in under powershell process, we can hunt for that in sysmon

@@purplesprout5774 It would, but in a real world it probably wouldn't be obfuscated. It would be casually placed somewhere in a 'utility' that does something else. The code block that is running on the windows machine is so simple that it probably almost exists in the wild for legitimate limited reasons. A legitimate app would not be a raw running of an expression fetched from somewhere, but it may parse some data from somewhere into part of an expression and run that. This still seems like a bad idea because if the parsing can be escaped it becomes a shell, but that doesn't mean it isn't done. The problem is that this simple demonstration is not the real problem (though script kiddies will abuse it). More of an issue is deliberately weak parsing in an otherwise functional application involving invoke-expression. Preventing the use of invoke-expression on retrieved data would not be backward compatible, while detecting buggy parsing is 'hard' due to parsing being a Turing complete problem. This demonstrates that any use of invoke-expression on data retrieved from a remote server is potentially a reverse shell. At best it is an attack surface, at worst a deliberate backdoor. I guess you could go through the uses of invoke-expression and try to characterise and whitelist legitimate ones. Automated detection is extremely hard though, due to 'doing anything' being invoke-expression working as intended.

7 months lol is that supposed to be a bragg about windows security? lol

Easy to bypass , give it instructions to launch user level command prompt in the background (so user doesn’t see) obfuscate your new code so AV doesn’t pick up on the command prompt command , inject it into a legit application ( plenty of ways) and your good to go.

@@outcome2715 Cool. Thanks for the tips. You make it sound easy, I’ll have to try a little harder.

@@BrickTamlandOfficial no. If anything the opposite. But no that’s not at all why I said that. It was literally just the time that it was working then not.

I saw this from you first! Good stuff

@@Cossaw thanks mate but john hammond is great his all videos r on the whole different level

rip, about to not work anymore lol

avast sucks

@@elllieeeeeeeeeeeeeeeeeeeeeeeee got it for cheap, still better than win defender i guess

​@FsocietyI see what you mean, but... I know I won't let any stranger go inside my house, what I can do is atleast to lock the door.

Now the question is how many systems have it?

@@draugh1r219 Yup, that is also true.

yea, but if u modify the source code only a little and also obfuscate it in layers, maybe it could still bypass

Unfortunately?

@@syskey1402 The problem is that many who look at John do not have the experience to analyze or read a code and change it so that it then works. I fully agree with you that the change is not detected by the Sophos AV. Weekend task for me. 😜

@@hackximus lol, yes

Great idea

@@olivermejia3786 i was honestly shocked how simple and effective it was i even wrote a blog about it

@@wtfdoiputhere exclude.exe?

@@outlawnation5160 yes, using powershell commands you could tell Windows defender to exclude certain folders or file types from being scanned

@@wtfdoiputhere that’s pretty powerful (no pun intended). Do you have a GitHub for the script?

Yup but disabling it can be a part of the script.

no powershell needed I think

what do you need rdp for? Just use the system shell

@@Bruh-sp2bj yeah. But there is a swag of rdp.. With shell we can do a lot but with rdp we can even get passwords stored in the browser of a victim..

@@codewithraiju1424 bruh ? if you have a shell then just download the saved passwords/cookies from the browser directory stored locally with help of that shell

@@realavdhut yeah but I think they are encrypted, Aren't they?

@@codewithraiju1424 yeah they are .. but there are different methods to retrieve it ... for eg enum_chrome

I also found a way to drop eee male linx and you R L's into youtube comments without the spam bots detecting it...

How would the firewall block it? All I would need to do is find an open port like dns

@@y.vinitsky6452 damn,, cant wait for next video there must be an answer

Should still be bypassable. But it depends on your configuration. For example you can use unmanaged powershell instead of a normal powershell.exe instance.

Hamachi ?

Use a server that will give you a public IP. (AWS for example).

Just use ngrok

Windows defender uses AMSI to detect the execution of malicious PowerShell, like a reverse shell. The point of this is, you can use the undetected reverse shell as a communication method to your c2 Server like Malware often does

@@_Slaze I see

which language?

@@shinchanstheory8002 scratch

@@shinchanstheory8002 golang

@@castroonie golang is automatically detected by every ac as a false positive

@@shinchanstheory8002 python

Spaces probably never because of how databases and database connections work. Most allow special characters and some even full unicode