Create Custom FILELESS MALWARE on FULLY PATCHED WINDOWS 10!

[@simochammoum878]

amazing tuto boss, I was struggling on bypassing Windows defender with some obfuscated meterpreter payload but was flagged immediately but yours fud malware made windows defender look like a fool. you just win not only a subscriber but a fan too

[@daniellowrie]

I'm really glad that you enjoyed the content and I really appreciate your kind words! Thanks for watching!

[@firosiam7786]

KZbin need more of your content sir as all of them are very informative

[@daniellowrie]

Thanks, Firos! I'm so glad you enjoy it!

[@ManeelxAkosAdor]

you got me subscribed with this video. First time I watched one of yours

[@daniellowrie]

I'm glad to hear that you enjoyed the content and thanks for the sub! It is much appreciated 👍😀

[@ajithrajendran3516]

Definitely what I was looking for. Thanks Daniel!!

[@daniellowrie]

Glad you found what you were looking for 😀👍

[@rubensaugusto7106]

That´s a good stuff man!! Help´s me a lot to understand the concept! Thank you!!!!!

[@daniellowrie]

Thanks, Rubens! I'm glad it was helpful to you 😀👍

[@Fido1hn]

One of the most fun and informative videos I’ve seen on KZbin. Some are informative but boring. Please make more sir.

[@daniellowrie]

That is one of the best compliments I've ever received! Thanks and thanks for watching! 😀

[@WarRior-rn4kb]

ciso subscribedddddddd!!!!!!!!! got my graduate degree, cissp, cism and now getting my oscp. lessssss gowwwwwwwww

[@daniellowrie]

Thanks for the sub, War Rior! 👍

[@mynamejeff5193]

i dont what it is it but its so facinating to see people break into systems considered safe or defeating antivirus etc ..... what language do u think one should learn for hacking

[@daniellowrie]

Thanks, mynamejeff! It's more like what LANGUAGES should you learn for hacking. Obviously PowerShell knowledge was useful in this situation. I would also learn Bash and Python. I would have some rudimentary knowledge of some web languages like HTML , PHP, and Javascript. Then go with some compiled language like C/C++ or C#. I'm currently learning Golang as it's super easy to cross compile. The good news is that if you pick something like Python, to start with, then you'll have a very useful language for most tasks, and you'll learn enough of programming concepts to more easily learn other languages.

[@loganathavishnubalaji9713]

Great video!! But i have a question. Can we make it work without an initial Double-click by user?

[@daniellowrie]

Thanks! I'm really glad you enjoyed it 👍 There are zero-click ways to deploy a payload, but that usually involves exploiting some RCE and then just dropping your C2 beacon. I built this "malware" to learn more about obfuscation, droppers, stagers, and AV bypass, so it I tried to have it more closely mimic infection through social engineering (which is typical to a lot of malware).👍

[@demoncanplay730]

Thank you for making this video 🙂

[@daniellowrie]

You're welcome and I'm glad you enjoyed it

[@jorgegarrido6620]

Daniel, congratulations on the material. It's very clear. I just have a consideration, I may be wrong, but it does not sound like a fileless attack because when the victim executes the "update_script.cmd" it downloads the "WinSecurityUpdate" file and executes it. Is it correct?

[@daniellowrie]

You raise a great question, Jorge! The fact is that not all fileless malware is completely fileless. What makes this considered 'fileless' is the fact that the malicious payload is never written to disk. You're correct when you point out that the 'update_script.cmd' file downloads the 'WinSecurityUpdate' file, but it never actually writes it to disk, but simply reads it into memory where it gets executed by PowerShell. The same is true for the 'a1' and 'r1' files. They don't get written to disk, but are read into memory where they are then executed. So the only file that actually gets written to the disk is the 'update_script' file and the only thing that it does is download a file from the internet to execute in a PowerShell script. Now, antimalware systems may be configured to block that type of activity, but this is why we obfuscated that process. Those obfuscations allowed the script to slip passed detection and since the other files are not written to disk they don't get scanned, and even if the antimalware system does scan them, they are also obfuscated so they should also slip passed detection. Also, the 'a1' script's function is to turn off detection. For more info on how fileless malware works you can check out this article from Norton AV us.norton.com/internetsecurity-malware-what-is-fileless-malware..html Great question!!!👍

[@laughoutloud1028]

This is cool stuff exactly what I have been looking for

[@daniellowrie]

Thanks! I'm glad you found it 😀

[@FieldObservatory]

youre the best I have seen on the internet today

[@daniellowrie]

Thanks, Hamza!

[@1science2code22]

The Amazing Daniel , is my new super hero :)

[@daniellowrie]

Many thanks for the compliment. You're too kind! 🙂

[@moe3551]

Great tutorial. Just tried it on myself and it works like a champ. btw will you do more CTF walkthroughs in the future ?

[@daniellowrie]

Thanks, Moe! I'm always glad to see another satisfied customer 😁 I'm also happy to inform you that there will most definitely be more CTF walkthroughs in the future 👍

[@b.nijjar]

Daniel, the code is getting executed as it should but not getting any reverse shell. Thanks for the video though, I am doing my Masters project on AV evasion and this video is really helpful.

[@daniellowrie]

Check the IP and Port on the listener and make sure that matches the reverse shell coded values. Check for firewalls blocking. When all else fails check the packet traffic with Wireshark. Hope that helps 👍

[@b.nijjar]

@@daniellowrie True it was an IP glitch, working like a charm now

[@daniellowrie]

@@b.nijjar I'm glad to hear you got it worked out

[@Tech_kenya]

That was great.... Always helpful

[@daniellowrie]

Thanks, Anthony! I'm glad you liked it 😀

[@meowcat220]

I finally found your channel . happy right 💖 I am a fan of bug 😂😂

[@daniellowrie]

Glad you found it! Welcome 😀👍

[@meowcat220]

@@daniellowrie Thank you ❤ . I hope to see a lot of CTF. And some things about pentesting on the web.

[@CaltonTech]

heyy Daniel, on the WinUpdateSec file, which extension does it have?

[@daniellowrie]

I don't remember, but the good news is that I have updated that script. It is now NEW AND IMPROVED with 100% more Golang!!! You can watch it here >>> kzbin.info/www/bejne/gpvScolphJljpck

[@av1871]

how can i switch to meterpreter here, ive tried many payloads in msfconsole (eg. windows/shell/reverse_tcp) but they all said "session is invalid" when running, do you know what to do?

[@daniellowrie]

This was all hand-built and not necessarily with Metasploit payloads in mind, in fact the reason I made this script was because I was having so much trouble with Metasploit payloads, so you might have trouble getting it to work. A few things you could check... Did you select the correct architecture for your target machine? The example payload you referenced (windows/shell/reverse_tcp) is for x86. If your target is x64, you may have better luck with windows/x64/shell/reverse_tcp. Maybe try a stageless payload instead of a staged payload? Are your payloads formatted for powershell? Not sure if any of those suggestions will work, but may be worth a try.

[@x-rootzone]

Wow.. absolutely cool. trying modified the progress status with powershell progressbar and using metasploit "exploit/multi/handler" with payload "windows/x64/shell_reverse_tcp" and it working, but when upgrade shell to meterpreter with "session -u [sesionid]" nothing happen. expected create new session with meterpreter... any advice? thanks in advance ☺

[@daniellowrie]

Hey, x-root! Thanks for watching. I'd have to put some time into recreating your scenario to see what might be causing the issue, but keep working on it and you might discover the answer.

[@x-rootzone]

@@daniellowrie Thank you... Working on it 😎

[@ahmadmansour1171]

Thanks alot boss, waiting for a video how to combine this with a legitimate file for more social engineering

[@daniellowrie]

I like how you think, Ahmad! 👍

[@florisbeekman8907]

Hi thanks for recommending this vid to me because it is perfect for me. but i do have a few questions. first one again about port forwarding: do i have to port forward to my linux or to my windows external ip? second one about changing the scripts: do i have to change ip addres in the update_script, a1 or r1 file to my external ip? if yes than again do i have to change it to my windows or linux external ip addres? last one about the ip addres and port where the "winsecurityupdate" is downloaded: If i google the ip and port where winsecurityupdate is downloaded (192...180/8000) the site doesn't show up. Does this have to do with the fact that i live in europe? or is this port taken offline and do i have to make a new one with the a1 and r1 files? O little edit: i just saw a video that said that malware files bigger than 750Mb will be harder to detect. Is it possible to implement this in these files? Thanks a lot for helping because it makes starting with this technical stuff way and way easeyer!

[@daniellowrie]

1) You port forward to the machine that is running your listener 2) If you're target is shoveling a shell across the Internet, then you'll need to set the IP to your external IP and the port you set up for forwarding 3) The IP scheme 192.168.x.x is a private IP range that isn't routable and is only used for internal devices, so you would only find a site at 192.168.x.180:8000 if one of your internal network devices had that IP and was running a service on port 8000 4) Not sure why malware size would be important. All the scripts used in these scripts are less than 2k in size and they slide right by Windows Defender without any issues. The thing with detection is usually signature and behavior. You can literally make an empty file and name it mimikatz.exe and it will get popped by Defender.

[@Fatima-hk8zx]

everything is working but sudo nc -nvlp 443 is not opening shell for me why

[@daniellowrie]

I hate to hear that you're having issues with your system and I wish I could tell you what's wrong, but without more details that is an impossible task. My suggestion is to work the problem using the standard troubleshooting methodology. Start with the basics then work your way up to the complex. You'll do a lot of googling, but this is how you build the skills and experience of a seasoned hacker. Keep trying and don't give up. Best of luck!

[@dcriley65]

Hi Daniel, (Spoiler Alert, decided I didn't want to head my head re-inventing the f*!king wheel) I trying to decide which I liked better Whonixlinux or QUBES and run my vm's that way. What'cha think?

[@daniellowrie]

Sounds like a solid plan!

[@abhinavgamercr1419]

Nice explanation sir . sir Powershell is important for Hackers I mean I already Learned Python and still Learning bash bash scripting

[@daniellowrie]

Thanks, Abhinav! You are on the right path! Those 3 languages will get you very far for sure!

[@codewithme6088]

Great! As always

[@daniellowrie]

Thank you so much! I'm so glad you liked the video 👍

[@dilanparadis741]

How do you switch computer like that ? Is one of the OS Virtualized ?

[@daniellowrie]

You guessed it, Dilan 👍 The Kali machine is being run in VMware Player and I just full-screen it on a different desktop. That is how I can just swipe from one system to the other.

[@florisbeekman8907]

Hey it is me again 😅. I think this is the last question i need to ask. So: the update_script downloads files from a site. Can i just make a public site with al the files (with correct ip’s) and replace the site link in the files? will that work?

[@daniellowrie]

That should work

[@florisbeekman8907]

@@daniellowrie great👌

[@no_winger]

Informative ❤️..

[@daniellowrie]

Thanks Crypto Neo, I'm glad you liked it and thanks for watching

[@abhinavgamercr1419]

Daniel sir I need your help sir I know Python bash script sir I started Learning web pentesting so sir I am currently learning xss and sir for that I didn't know JavaScript so sir I need to learn that JavaScript if I can Learn xss vulunbelity ??

[@daniellowrie]

Javascript is used a lot in web app scripts, but it's not the only language. You also can see ActiveX, Java, VBScript, Flash, and HTML. I will say this, the more Javascript you know, the better you'll be at finding and exploiting XSS, but you can use things like XSS Polyglots to help you test and bypass filters until your javascript skills are better. I hope that helps answer your question.

[@ravp8815]

It did work once, then after turning AV on, trying to run, it got blocked. I Disabled AV again and it doesnt get to the point to download WinSecurityUpdate anymore. Is this the case that it might got added to Defender sigantures somehow?

[@daniellowrie]

Hi Rav! It will definitely end up getting popped by Defender and other AV systems. I would suggest making some customizations to the script which could help it bypass AV again.

[@monakhaled8360]

Great tutorial , but I have a question if I want to perform a way to detect that a fileless malware occur how can I?

[@daniellowrie]

This kind of malware is difficult to detect due to the obfuscations, but some good countermeasures would be to disable PowerShell if at all possible and if not then to log PowerShell use and have email alerts set up when a PowerShell command is executed. You can also strengthen your egress filtering on your firewall to make it more difficult for the shell to connect. Lastly, make sure you're using IDS/IPS along with an updated AV/Antimalware/EDR solution. This script works well in the video, but it won't be long before samples are submitted to security firms and new AV signatures are created for detection. It's a cat and mouse game between attackers and defenders when it comes to detection and bypass.

[@gooniesfan7911]

is filesless MW still a thing? it seems trivial for any AV system or EDR to be able to detect because no legit software will look like this in the registry

[@daniellowrie]

Great question! Now please, keep in mind that this video is 2 years old and was meant to be more of a proof-of-concept/personal learning experience for me, the goal being "Can I bypass MS Defender detection specifically" and not other AV or EDR, so yeah, this is a super jenky thing. That said, fileless malware is indeed still quite popular. LodeInfo and HeadCrab are just 2 examples in my recent memory. The good news is that EDR and AV are getting better everyday and are making malware-based attacks much more difficult, but APTs keep modifying the way they behave and creating novel malware which is able to bypass AV/EDR detection, creating a bit of a "Cat and Mouse" game between threats and security vendors.

[@gooniesfan7911]

@@daniellowrie Dude thank you for this response, so thoughtful and crafted for me! You do an amazing job teaching and producing videos 10/10. Wishing you nothing but the finest and greatest of success, Love you bro!

[@daniellowrie]

I appreciate your comments and kind words,@@gooniesfan7911 ! You asked a really good question, so I'm happy to do my best to answer you directly. Glad you're enjoying my content and thank you so much for watching!

[@JD-qi3pk]

Thanks for this, very educational.. But I have a question. Let's assume I generated a payload executable and encoded it as usual, which i know would still get detected by some antivirus and even windows defender. So after I've edited the url in the script with mine and opened it in windows. My question goes like this, when I open script and it runs the command to download and execute the payload file through powershell, are there better chances of win defender and AV's not detecting it since the payload is not been executed on d disk. I'm just trying to get a better understanding. Also what if in the exec file I increase the the start-sleep time or give the payload let's say 15-30 secs just to let it trick the win defender. Because I believe that any executable opened in windows automatically defender and AVs scans the file to know exactly what the file is all about and what it does. So once the payload executable downloads and installs from the cmd, I could set the payload to stay idle and let it start running in a minute or maybe more. That can also trick Win defender and AVs not to flag it as a virus right?

[@daniellowrie]

Gold star, Johnson David! The 'fileless' part of this type of attack is that the malicious payload is never written to disk, but is downloaded and executed in memory. Your idea about using sleep to prevent the AV system from detecting is also spot on. Unfortunately, this has started to get picked up by AV, so using sleep can get a file flagged as malicious. A way around that is to make the 'malware' perform a mathematical computation or some other process that will cause a time delay without using sleep.

[@JD-qi3pk]

Thanks for your response... I was actually thinking of this at first, about letting it perform some other task that will delay it before it starts running. But I couldn't think of any, none comes to mind.. Can you suggest any?

[@daniellowrie]

@@JD-qi3pk A simple way that I do it is to use the date/time. I create a variable with the current datetime plus however many seconds I want to wait. Call that 'time1'. Then I create a while loop that checks the current datetime and compares it to 'time1'. The loop continues while the current datetime is lessthan or equal to 'time1'.

[@JD-qi3pk]

@@daniellowrie i could use the word "trickish" this should do a bypass. Because its could be really confusing. For windows. Even for me, I'd I've to think out the box to figure this one out. A little help would help a lot, if you would. Can I send you an email?

[@daniellowrie]

@@JD-qi3pk I sure don't mind trying to help, but I'd rather the conversation stay here so that everyone can benefit from the discussion 👍

[@nasalkhaldi9388]

Great video, is it possible to embed this into a word document or a pdf? thanks

[@daniellowrie]

I'm thinking about making a v2.0 of this and maybe that should be how it gets delivered.

[@nasalkhaldi9388]

@@daniellowrie I hope you have the time to do more videos,, ur teaching style is amazing! Do u have an online courses apart from what's on KZbin

[@daniellowrie]

Thanks for the compliments, Nas! I do training for ITProTV ( itpro.tv ) where I teach a wide variety of cybersecurity topics, mostly focused on ethical hacking and pentesting though.

[@kloser5299]

I can't open it in windows the error is “Windows cannot access the specified device path or file”

[@daniellowrie]

Sorry to hear you're having trouble. I found this link that may be able to help you out. support.microsoft.com/en-us/topic/-windows-cannot-access-the-specified-device-path-or-file-error-when-you-try-to-install-update-or-start-a-program-or-file-46361133-47ed-6967-c13e-e75d3cc29657

[@brent4217]

Appears that Defender is stopping it now. Have you tested it recently?

[@daniellowrie]

Thanks for the heads-up, Brent. Someone reported to me a few months ago that it was still working on both Win10 and Win11, but all good things must come to an end I guess LOL. That just means that update.exe v2.0 needs to happen, so that we can all enjoy those wonderful shells once again! 😁

[@allenclement5595]

All good until when I run the update_script file in the windows system, there's nothing happening and the python3 HTTP server shows as 404, message file not found. Pls help me out with this issue. 🥺

[@allenclement5595]

even the update_script file does not runs

[@daniellowrie]

I would say to just make sure that all your devices are able to communicate and that all your settings are set correctly. If you're getting a 404, then the update_script is trying to access a page that doesn't exist, or isn't in the directory where you are running the python http server. I'd start there. Hope that helps 👍

[@DEADCODE_]

ohhh Dani i swear i love you man say hi zach for me 😁

[@daniellowrie]

It's an honor to have you as a fan, Mr Alderson 😎👍

[@DCR600]

#SHARINGISCARING THANK YOU SO MUCH LOTS OF LOVE FROM INDIA

[@daniellowrie]

Thanks and much love back to all my followers in India! 😀👍

[@laughoutloud1028]

Hello , how do you send it to the email ? Email does not accept some extensions

[@daniellowrie]

You can just either change the extension of the file or add it to a zip archive and attach the zip. 👍

[@laughoutloud1028]

@@daniellowrie Thank you . But which extension is accepted to be uploaded on email? Any suggestions ?

[@daniellowrie]

@@laughoutloud1028 you'll have to test the system to see what makes it through 👍

[@trancongkhanh7904]

hey bro.. i can't connect to windows 10 machine can you guide me. thank you very much. 1 wish you good day

[@daniellowrie]

Not sure if I can help, but I'd start with verifying that the two devices can communicate over the network first. Check windows firewall. Can you browse to the kali web server with Chrome/Edge/Firefox?

[@navienkumar1524]

Bruh put an video over wan using this powershell revershell pls

[@daniellowrie]

Not a bad idea, Navien. Spoiler alert! I'd use ngrok or some cloud-based instance to catch the shell. 👍

[@mynamejeff5193]

where did u buy that spider man t-shirt i want one too

[@daniellowrie]

Thanks, Jeff! My kids got that shirt for me for my birthday. I think they got it from Target.

[@alec3217]

Is this actually considered fileless? Since it uses files and doesn’t operate completely in memory... I'm not so far into the video though

[@daniellowrie]

Right! How is malware that in any way utilizes files considered "fileless". I had the same question myself when I was learning about fileless malware and it seems to have some semantics involved in its definition. So, many fileless malware examples will utilize some RCE or other vulnerability to download, load in to memory, and execute their malicious payload. But some use a delivery mechanism such as a malicious macro in a Excel or Word file, or a temporary file. These files don't do any "malicious" per se. All they do is use PowerShell, or WMI, or some other built-in functionality to download and execute "something" from the internet (the malicious payload). Now, these things would also unalive themselves after run time (a step I left out of my example), leaving little to no trace to be signatured. So this is really a sub-type of fileless malware and not a pure fileless malware, but still gets kinda rolled-up into the "Fileless" moniker in general conversation. It seems a lot like the term "Red Team" with how we tend to call ALL things offensive cybersecurity "Red Teaming" and while not perfectly accurate, it is typically accepted in everyday conversation.

[@alec3217]

@@daniellowrie oh, I understand, thanks for the info, I thought the term only referred to malware that ran completely on memory

[@daniellowrie]

No problem! Thanks for the great question and for watching 😀

[@cot3chcot3ch96]

for some reason it didnt work for me. i guess i need detailed steps. would appreciate if you on kali

[@daniellowrie]

Sorry to hear that this isn't working for you and the steps are vendor agnostic and should work in Kali as they are. Do you have any guess as to where things might be going wrong? If so, maybe we can troubleshoot

[@cot3chcot3ch96]

@@daniellowrie do you have a email so i can show you my screen shots

[@daniellowrie]

[e-mail]

[@abdullahyasin3055]

sir i am waiting for nmap firewall bypassing video

[@daniellowrie]

That might be doable. I'm short on free time right now, but I'll put it on my short list of cool KZbin ideas. Thanks for the suggestion 👍

[@no_winger]

Sir plzz make a video about zero click payload and how its work

[@daniellowrie]

That's a cool idea! Not sure if I can pull it off, but it's definitely something I want to learn and will make a video about as soon as I do 😅👍

[@no_winger]

@@daniellowrie thanks Daniel ❤️

[@zaaffe24bs16]

how would i make this public? (port forwarding) i use ngrok btw

[@av1871]

same question but my comments keep getting deleted

[@daniellowrie]

ngrok is a fine way to make this public. You could also spin up Metasploit in some cloud instance on AWS/Linode/DigitalOcean/etc.

[@mynamejeff5193]

i will send the trojen to my school teacher and i will download all exam questions from her laptop heheh *evil laughter

[@daniellowrie]

That's funny 😂 . I'm pretty sure you're kidding, but seriously, don't do that. It's a quick way to find yourself getting real friendly with your new cell-mate. Repeat it like a mantra...Only hack systems I have own, or have permission! Only hack systems I have own, or have permission! Only hack systems I have own, or have permission! Only hack systems I have own, or have permission!

[@mynamejeff5193]

ok. good video btw

[@antoniojesusgil2966]

how do i use it with ngrok?

[@daniellowrie]

You would just need to change all the attacker IPs to be your ngrok URL. Ngrok has been mentioned a fair bit and rightfully so. Maybe it's time I do a video showing how to use it with something like this.

[@igornemorssa2936]

I try it, but not function 👎👎

[@daniellowrie]

Sorry to hear that, Igorne. Are you getting an error, or is Defender stopping it? Could it be a networking issue like wrong IP and/or Port? Can you see the scripts getting downloaded from your Python HTTP server? Did you verify your base64 encoding?

[@joefawcett2191]

Exception calling "FromBase64String"with "1" arguments(s): "The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters. " At line:33 char:1 + $update_a1 = [System.Text.Enconding]::UTF8.GetString([System.Convert]: ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +CategoryInfo : NotSpecified: (:) []. MethodInvocationException +FullyQualifiedErrorId : FormatException

[@daniellowrie]

Looks like your base64 has gotten a little wonky. How are you generating the base64 string? and can you paste that string here so we can see it?