Re: against EMET?

[HD Moore <hdm () metasploit com>]

On 2/1/2012 8:06 AM, Stephen Haywood wrote:
> Is the stager typically caught by the AV because it gets written to disk
> but the payload doesn't get caught because it is in memory? If that is
> the case, then learning how to write custom stagers is a good skill to
> have for bypassing AV right?

The stager is used for both EXE generation and normal payloads
(in-memory). AV detection is usually due to the EXE generator's output
template hitting known signatures or the mechanics of the stager being
detected encoded on disk (but the former is much more common). Getting
some experience writing custom payloads of any type (whether its a
stager, stage, or single in metasploit terms) will help with HIPS, IDS,
and AV evasion.

-HD
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework