As soon as Metasploit adds something, the AV vendors quickly create a definition for it. Here is a article that speaks to exactly what you're asking by scriptjunkie. I worked with him to create a completely undetectable payload. This will clear it up for you.

http://www.scriptjunkie.us/2011/04/why-encoding-does-not-matter-and-how-metasploit-generates-exes/

There are other ways of doing this as well like backdooring legitimate exe's by using something called a code cave but the published ways are usually picked up as well.

MaXe published this awhile back which is also helpful: http://intern0t.net/papers/BPAV%20-%20InterN0T.pdf

You're on the right track. Mine is done in C++.


Yep, but social engineering isnt as hard as you think 


They actually incorporated that into the OSCE course... The problem with the code cave is that a lot of the AV vendors will pick up the "stub" but there are ways around that too!

OK, I fired up my Borland on Windows and used the code that I found here.  He'd pulled some shellcode from the Windows Metasploit installation to have windows/exec run sol.exe.  I compiled it and everything worked like a charm on my Windows XP.  I repeated the experiment myself, pulling the shellcode for the same process from my BT4 R2 live CD.  The shellcode was different but it still compiled and did what it was supposed to do.

Then I started to get smart (so I thought!) and repeated the process with windows/meterpreter/reverse_tcp.  I examined the shellcode and there were two elements, one small and the other enormous.  I guess that's because it's a 2-stage process?  I put the first shellcode into my C++ code and it compiled fine.  I ran it, but it didn't do anything.  I repeated the process with the second chunk of shellcode and it didn't do anything either.  I checked netstat but, needless to say, there was no mention of port 4444.

I think (hope!) I'm on the right track.  I had hoped that running the shellcode in my compiled C++ code would connect to my BT R2 from where I could get a meterpreter shell, but that's eluding me at present.

Any further tips?  Am I wasting my time?

EDIT: I just ran the two executables in sequence, containing the small then the massive shellcode, whilst monitoring netstat -a 1.  Great, an entry looking for my BT laptop on port 4444 appeared with state = SYN_SENT!  I just need to figure out how to connect to it now from my BT laptop and create a meterpreter session.


Having seen what Muts did with Olly etc., it seemed a long-winded process.  I see that you've thrown a bit of a tantaliser at me there ... so there are ways of preventing the stub being "caught"!  I'll persist with my initial thoughts but might revisit this second idea after a bit of googling.

Thanks again for the clues!

The reason why the Metasploit shellcode was different, is because it is frequently updated and therefore, from version 3.0 to 3.4 and so forth, the shellcode differs. As time goes, more bypassing techniques / methods are implemented into the payloads, so they are up to date and usable. 

It also depends on what kind of payload you're using. Check out Metasploit Unleashed on the Offensive Security website. There's a good amount of information, where some should describe the different types of payloads as well.


When there's 2 parts of the shellcode, it's a 2-stage payload. The first stage is meant to be executed on the target computer. The 2nd stage is meant to be sent from your computer, as soon as the target computer requests it.

If it's a 2-staged shellcode, make sure as cd1zz said, to use the multi/handler.


Especially the "LISTENINGPORT" is important to set. If your listening port is below 1024 on Linux, and you're not running Metasploit as root, then the listening process will fail as you will need root privileges to bind to (listen on) a port lower than 1024.


Metasploit Unleashed Reference:
http://www.offensive-security.com/metasploit-unleashed/Metasploit_Unleashed_Information_Security_Training

Payloads: (Must Read)
http://www.offensive-security.com/metasploit-unleashed/Metasploit_Payloads
http://www.offensive-security.com/metasploit-unleashed/Payload_Types

There should be single-staged Payloads available within Metasploit, which doesn't need additional shellcode to be sent to the target machine, from the attacking machine. There's also a cool "xbackdoor", which you may want to play with:
http://www.ja-psi.fr/tools/xbackdoor/

I haven't really used it, but the concept behind it simply awesome in my humble opinion. Even though it doesn't seem cross-platform compatible, and to some even "outdated".

There's a bit more info below.

Additional Reference:
http://forum.intern0t.net/exploits-vulnerabilities-pocs/503-xbackdoor-3rd-generation-backdoor.html

I thought of you when I read this article from Dave Kennedy today. Pretty mother effing cool:

http://www.secmaniac.com/june-2011/creating-a-13-line-backdoor-worry-free-of-av/

That is one way to use it but his tool SET has a payload called the SET Interactive Shell that uses this. He's already built all the SE tools to make this all work nicely. It's very slick and if you have never played with SET go get a copy at secmaniac.com