How To Bypass FULLY Updated Windows Defender & Windows 11 With Nim - [EDUCATIONAL PURPOSES ONLY]

--- In this video, I demonstrate how to compile malicious code written in Nim into a .exe Windows Binary that spawns a stable reverse shell when clicked on by a user.

This bypass is working on fully updated versions of Windows 11 running the latest Defender signatures as of November 27th, 2023.

Enjoy!

This content is intended for educational purposes only. All demonstrations and techniques shown are designed to teach ethical hacking and improve cybersecurity. Any use of the information provided in these videos is done at your own risk and should be used responsibly. Unauthorized hacking, illegal activities, or violations of privacy are not endorsed or encouraged. Always ensure you have proper authorization before attempting any security testing or hacking.

[ITSecurityLabs]

This is awesome Tyler! I am glad it still works. I just created another nim loader that can reach out and execute the payload in memory from a remote server. Amazing stuff!

[takurox]

it was working but it seems like the nim reverse shell code isn't working anymore

[egg]

Amazing tutorial, great job. It worked perfectly for me and I was looking for something like this for a while and this is the first thing that worked. Thank you abd amazing work.

[starlox]

Wow!! That's Awesome....really worked😯

[Mike-cptj]

when the shell is terminated on Kali seems that the windows VM would get a `OSError` prompt, which makes it less stealthy, tho
still - a fun poc for further research

[edwardvanbiljon]

Thanks Tyler, love you videos. I tested this out on Windows Server 2022 that has Defender fully running and up-to-date and I performed the same steps, defender didn't pick me up.

[MathisPizza]

But how to make im persistant like if the user restart Windows we get the connexion back

[eto]

good video and new knowledge for me. TQ

[omarsamy]

How to append the payload to my python script for bufferoverflow in bytes

[zalert-]

I test your video about scarecraw, it works on win11 ok. but in updated windows server, it not working anyway...
so, what do u think about these tools?
is windows defender was diffrent in win11 vs win-server?
is this new tool, works on windows server?

by the way, tanx for your videos...very cool

[lollocanzo]

I haven't tried it yet, but why would it work i.e. what made it undetectable?

[karanprasadbhatt]

Window defender is able to detect this. I have just tested.

[Sam-nCmf]

Hey, what are the coding languages we are supposed to learn to become a better hacker?. Great video as always

[mergimrrahmani]

This is only unnoticed if you download it via powershell but if I download it via my apache2 server it is recognised immediately, is there a solution for this?

[simosafi]

is possible hacked with One click link ?

[New_Zero_]

Program 'a.exe' failed to run: The file or directory is corrupted and unreadableAt line:1 char:1
+ ./a.exe
+
At line:1 char:1
+ ./a.exe
+
+ CategoryInfo : ResourceUnavailable: (:) [], ApplicationFailedException
+ FullyQualifiedErrorId : NativeCommandFailed

[WORKanonymus]

└─# nim c -d:mingw --ap:gui --opt:speed -o:Caclulator.exe rev_shell.nim
Command 'nim' not found, did you mean:
command 'nam' from deb nam
command 'nom' from deb nom
command 'num' from deb quickcal
command 'nix' from deb nix-bin
command 'ni6' from deb ipv6toolkit
command 'zim' from deb zim
command 'fim' from deb fim
command 'nvim' from deb neovim
command 'npm' from deb npm
command 'nm' from deb binutils
command 'nsm' from deb linuxptp