As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, as opposed to simply reporting them. If an AV detects the tools we use, clients often will disregard the vulnerability because they are not convinced by the risk it causes.
We noticed that Windows Defender detects the metsrv.dll from Metasploit Framework in memory and kills our shell. The detection is done by mpengine.dll and is either done by some kind of criteria on the emulated binary or is a pattern of bytes in the DLL.
Now that the context of the question is clear, here is the actual question: how could I proceed to pin point exactly what the signature for this file is ?
Before your answer, here are the conclusions I have already come to:
- Windows Defender's scanning engine detects metsrv.dll from Metasploit at the moment it is loaded into memory.
- I can use Taviso's loadlibrary to reproduce the detection statically on GNU/Linux, using the following command:
main(): Scanning metsrv.x64.dll...
EngineScanCallback(): Scanning input
EngineScanCallback(): Threat HackTool:Win64/Meterpreter.A!dll identified.
- I have reduced the sample size down from 200 kb to 13 kb using the GNU split utility and a "binary search" approach: the sample is split in two parts, both are fed to Windows Defender and the part that is detected is then split in two more parts. Repeat until it is possible, so as to minimize the test case.
- Disassembling mpengine.dll is not very helpful, because there are more than 30k functions found by IDA Pro in it.
- Code coverage analysis with Pin allows to reduce this set to 3k functions, which is still too much to analyze statically.
- mpengine.dll can be debugged in gdb. I put a watch point on the string "Win64/Meterpreter.A!dll" to see if I could find an interesting function that would read at this location, maybe at a time close to the verdict's time. Still lost because of the size of the code, even though the watch point is triggered two times.
- A script on GitHub called avwhy.py allows to infer signatures from AVs by changing one byte at a time and memorizing the ones that impact the AV's verdict. After running more than 16 hours, the tool returned me the whole file as part of the signature, which looks like a wrong result: it is improbable that using the split utility I have found the exact signature, because I expect to either have too much bytes or having removed useful bytes from the signature.
As you can see, I have spent numeral hours on this. The goal is to find the exact signature, not to evade it by applying some kind of transformation on metsrv.dll. I think it is a fun reverse engineering challenge but I am stuck for now.
What are the steps that I need to take in order to accomplish my goal?
Edit: In order to clarify what I'm trying to do, here is a self-published paper from Tavis Ormandy: Sophail: A Critical Analysis of Sophos Antivirus
At page 3, he shows the signature for the file "Attention 629". I am trying to achieve the same result. Of course I can attack the 3k functions and work from here, but I suppose Tavis had a more intelligent approach, and that is the type of answers I'm looking for.