Skip to content

Evasion Tools

  • if advanced security is configured on the target, we can use automated obfuscation tools.

Linux:

  • Bashfuscation - https://github.com/Bashfuscator/Bashfuscator
  • sudo ./bashfuscator/bin/bashfuscator -c "cat /etc/passwd"
    • this will randomly choose an obfuscation technique and output a string of around 100 to million chars.
  • we will use flags to produce a shorter and simpler obfuscated command
  • sudo ./bashfuscator -c 'cat /etc/passwd' -s 1 -t 1 --no-mangling --layers 1

Windows

  • DOSfuscation - https://github.com/danielbohannon/Invoke-DOSfuscation 
    git clone https://github.com/danielbohannon/Invoke-DOSfuscation.git
cd Invoke-DOSfuscation
Import-Module .\\Invoke-DOSfuscation.psd1
Invoke-DOSfuscation
# Inside the command
Invoke-DOSfuscation> help
> tutorial # to see how to use commands
> SET COMMAND type C:\\Users\\htb-student\\Desktop\\flag.txt
> encoding
> 1
# RESULT here
  • Paste the result in windows to see the output.