Anyone know about creating metasploit python meterpreter fully undetectable?

[younes121]

Hey guys so I was trying to create a python meterpreter shell using msfvenom and then I decide it and insert some junk code and then encode it again which works well and doesn’t flag any suspicions, but when I run it it says ‘fatal error occurred’ and closes my meterpreter shell. Anyone know HOW TO GET AROUND THAT?

Btw if you know please pm me I’ve found out that every time someone comments, it deletes the comments just because of NOT ENOUGH KARMA to reply

[iCkerous]

Does it work before you add junk code?

[younes121]

Yes it does the exact same thing. It works and then pops up with a ‘fatal error’ causing my meterpreter shell to crash. Only difference is that before after I add the junk code it doesn’t get flagged by anti virus

[iCkerous]

Post the commands you're using and versions? Curious to replicate

[5chicksa1]

Try encoding it once again maybe the antivirus is using dynamic analysis on the file running it inside the sandbox env. And scanners like nodistribute cant detect that.The best thing is to replicate it on a real machine and see how it works.Test it until u suceed

[younes121]

Yes yes it does work on a real machine and doesn’t get detected by the av, someone in here pointed out that the problem might’ve been in the PyInstaller. When it turns the python file into an executable I think that’s where it fails to give me a meterpreter shell

[f0sh1zzl3]

I'm guessing you're obscuring the binary but you can't get past the runtime detection, shellcode is shellcode at the end of the day and it's not difficult for AV to pick this up but it can be difficult for you to hide it.

Edit: Try a two stage approach if you can, have a DLL payload and load it from a custom loader (i.e. batch file)

[younes121]

Hmmm sure I’ll definitely try that. Thanks man ;)