Authenticated WMI Exec Via Powershell

https://packetstormsecurity.com/files/139762/Authenticated-WMI-Exec-Via-Powershell.html

This Metasploit module uses WMI execution to launch a payload instance on a remote machine. In order to avoid AV detection, all execution is performed in memory via psh-net encoded payload. Persistence option can be set to keep the payload looping while a handler is present to receive it. By default the module runs as the current process owner. The module can be configured with credentials for the remote host with which to launch the process.

Windows UAC Protection Bypass

Via Slui File Handler Hijack

https://packetstormsecurity.com/files/148004/bypassuac_sluihijack.rb.txt

Metasploit Fun

A series of blog posts from BHIS.

https://www.blackhillsinfosec.com/three-simple-disguises-for-evading-antivirus/
https://www.blackhillsinfosec.com/how-to-bypass-application-whitelisting-av/
https://www.blackhillsinfosec.com/click-to-enable-content/
https://www.blackhillsinfosec.com/modifying-metasploit-x64-template-for-av-evasion/

Windows WMI Recieve Notification

https://packetstormsecurity.com/files/147498/ms16_014_wmi_recv_notif.rb.txt

Some fun lately with custom payloads

Doing some testing on new AV. Been reading a lot about custom payloads. I now many of these are old, but the ideas may still be new to others.
Here are some of the more recent reads ......


http://e-spohn.com/blog/2012/08/02/pe-crypters-hyperion/

https://www.christophertruncer.com/bypass-antivirus-with-meterpreter-as-the-payload-hyperion-fun/

http://www.exploit-monday.com/2011/11/powersyringe-powershell-based-codedll.html

http://colesec.inventedtheinternet.com/obfuscating-meterpreter-payloads-with-veil/

http://colesec.inventedtheinternet.com/hacking-with-powershell-powersploit-and-invoke-shellcode/

https://github.com/rapid7/metasploit-framework/wiki/How-payloads-work

https://www.citadelo.com/en/how-we-bypassed-nod32-and-hacked-a-paranoid-customer-2/

Explain 'getsystem'

https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/

https://www.offensive-security.com/metasploit-unleashed/privilege-escalation/

http://carnal0wnage.attackresearch.com/2010/01/metasploit-getsystem-command.html?m=1

http://www.khromozome.com/windows-privilege-escalation-bypassuac/

https://www.redspin.com/it-security-blog/2010/02/getsystem-privilege-escalation-via-metasploit/

AV0id – Anti-Virus Bypass Metasploit Payload Generator Script

https://www.commonexploits.com/av0id-anti-virus-bypass-metasploit-payload-generator-script/

Microsoft Office Word Malicious Macro Execution

https://packetstormsecurity.com/files/140972/office_word_macro.rb.txt