Skip to content
This repository has been archived by the owner on Nov 6, 2023. It is now read-only.

Won't connect to msfconsole #61

Open
Jupiops opened this issue Jan 23, 2020 · 1 comment
Open

Won't connect to msfconsole #61

Jupiops opened this issue Jan 23, 2020 · 1 comment

Comments

@Jupiops
Copy link

Jupiops commented Jan 23, 2020

Don't know if I do something wrong but if I execute these File the process created consumes 50% of the cpu usage, but my msfconsole won't recognise any connections. on reverse_tcp just the same

[+] MODULE DESCRIPTION:

  Pure C reverse httpsstager 
  compatible with metasploit and cobaltstrike beacon
  [>] Local process stage execution type:
   > Thread                          
   > APC                             

  [>] Local Memory allocation type:

   > Virtual_RWX                     
   > Virtual_RW/RX                   
   > Virtual_RW/RWX                  
   > Heap_RWX                        

  [>] AUTOCOMPILE format: exe,dll 


  Press Enter to continue: 

[>] Insert Target architecture (default:x86):x64

[>] Insert LHOST: 192.168.*.***

[>] Insert LPORT: 4444

[>] Insert Exec-method (default:Thread):

[>] Insert Memory allocation type (default:Virtual_RWX):

[>] Insert Junkcode Intesity value (default:10):

[>] Insert Junkcode Frequency value  (default: 10):

[>] Insert Junkcode Reinjection Frequency (default: 0):3

[>] Insert Evasioncode Frequency value  (default: 10):20

[>] Dynamically load windows API? (Y/n):

[>] Add Ntdll api Unhooker? (Y/n):

[>] Masq peb process? (Y/n):

[>] Insert fake process path?(default:C:\windows\system32\notepad.exe):

[>] Insert fake process commandline?(default:empty):

[>] Strip executable? (Y/n):

[>] Use certificate spoofer and sign executable? (Y/n):

[>] Insert url target for certificate spoofer (default:www.windows.com:443):

[>] Insert certificate description (default:Notepad Benchmark Util):

[>] Insert output format (default:exe):

[>] Insert output filename:torpedo

[>] Generating code...                                                                                                                                     
                                                                                                                                                           

[>] Compiling...                                                                                                                                           
                                                                                                                                                           

[>] Strip binary...                                                                                                                                        
                                                                                                                                                           

[>] Sign Executable                                                                                                                                        
                                                                                                                                                           

[>] Signing torpedo.exe with osslsigncode...

[>] Succeeded


[<>] File saved in Phantom-Evasion folder

[>] Press Enter to continue
@Jupiops
Copy link
Author

Jupiops commented Jan 27, 2020

Played around a little with the values and figured out that if you change the “Insert Junkcode” values too much, it will break the reverse_tcp functionality. But all EXEs who have a working reverse_tcp function are detected by Windows Defender on Win10 with all updates. Even if you have an EXE who will not be detected by Windows Defender, it will be detected on execution at the latest.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant