Metasploit-framework: Antivirus Detection : Payload Detected by Symantec and IPS.

[Tikam02]

While using Meterpreter variations as payload. Now I can bypass Anti-Virus and Firewalls easily, but Symantec Sonar and IPS always detect Meterpreter payloads and block the attacker IP.

Is there any better payload than Meterpreter that can bypass antiviruses like that are used by symantec and IPS ?

[vysecurity]

Just encrypt the stage? It's only detecting the stage. Or go stageless.

[wvu-r7]

Sounds about right.

[Pouya47]

Symantec detect reverse HTTPS with invalid SSL certificate you can use auxiliary/gather/impersonate_ssl to make correct SSL cert and bypass it.
more info:
https://niiconsulting.com/checkmate/2018/06/bypassing-detection-for-a-reverse-meterpreter-shell/
https://www.netresec.com/index.ashx?page=Blog&month=2011-07&post=How-to-detect-reverse_https-backdoors

[wvu-r7]

Nice!!