The first tool we will use is called Veil-Evasion. What is Veil-Evasion and how does it work? Most devices that have some kind of antivirus software will be able to detect basic Meterpreter binaries. These binaries are found within the payload. If you remember our lab in Chapter 4, Creating a RAT Using Msfvenom, we created a RAT using msfvenom and Meterpreter. When we created that RAT we used a popular Metasploit encoder named Shikata_ga_nai. This encoder was used to bypass antivirus protection in the Windows OS. Due to Shikata's popularity, most AVs solutions have recorded Shikata's signature in their databases. This results in Shikata being detected and stopped immediately by most AVs. A hacker may use Veil-Evasion to get around this.
Veil-Evasion uses a number of different encoding methods to change file signatures to avoid detection. When Veil-Evasion manipulates the file signature, AV...
