Bypass Windows Defender with C++ .DLL Payload File - Meterpreter Reverse Shell

Be better than yesterday -

This video showcases how it was possible to modify several publicly available tools and customise a template C++ file that will perform shellcode process injection which bypasses Windows Defender, obtaining a fully functional reverse shell on a victim's Windows machine.

It was possible to generate a .DLL payload file with cross-compilation on a Kali machine that performs shellcode process injection with AES encryption by utilising references from a publicly available Github repository.

The video provides a step-by-step walkthrough guide and a practical demonstration on how you can generate a .DLL payload file in C++ that will achieve a Meterpreter reverse shell on a Windows machine that has Windows Defender running.

The video also provides a high-level explanation on why .DLL payload files are useful, and shares an article which discuss a practical use case referencing Microsoft Teams, whereby .DLL payload files can be leveraged for persistence and proxy execution.

DISCLAIMER:
All content posted on this Youtube channel is SOLELY FOR Educational and Awareness purposes ONLY. Any actions and/or activities related to the material presented in this Youtube channel is entirely YOUR responsibility.

We DO NOT promote, support, encourage any illegal activities such as hacking, and we WILL NOT BE HELD responsible in the event of any misuse and abuse of the content resulting in any criminal charges.

Stay connected:

Github repository reference:

Github repository with the source code used:

Microsoft Teams article reference:

Gemini Security Awesome Hacking T-Shirts - Support the channel:

[bdboy_]

thnx bro for showcasing TheD1rkMtr tools, eager to see more, take love <3

[nhoxxz]

Thank you very much for comparing your knowledge great brother

[nyshone]

Do you think XORing each byte with your pre-defined value could also achieve same result? It would also entirely change signature of the shellcode.

[_marcobaez]

It worked perfectly! No detection at all, however, I can't get it to connect back to Kali on port 8443? (Tried different ports too, and tried listening direclty on mfsconsole but nothing :/, any idea?

[TamonashGupta]

Update on December 2023. Now the DycryptAES function is detected as meterpreter malware. Yes you read it right. DycryptAES=METERPRETER according to Windows defender. The very existence of this function in your code triggering the windows defender. I tested this by removing all other functions from the dll code and only keeping this function. Remember that in this code there are no shellcode. But as soon as the dll is dropped the defender is starting to scream malware!!!

[fokyewtoob]

Great content brother thank you for sharing your knowledge with us!

[denst]

how can i inject our payload (exe file) into existing process in windows?

[wolfrevokcats]

2:26 thanks for the awesome video, btw can you share the modified code @ 2:26?

It would be better if your code editor has line number easier to refer. Thanks

[ofekvegas]

Please is there an option for a guide on bypassing antivirus like eset..?

[Henriqueoi]

How do I create a payload with the port I want? I want a dll like that, but without using meterpeter, but a server of mine to execute shell commands

[overthinker]

Why u don't share the last payload u make it into your repository to make it easy for us

[hiddengo]

Pentest Active directory using sliver c2

[mrri]

I assume what’s next is turning this DLL into exe? Or embedding it to exe ? Also would it bypass smart screen filter etc ? Sorry I’m noob . Thank you.

[ELIAS-ogvf]

Bro i have exe File How to extract shellcode from it