Local AI-Generated Shellcode Runner Bypasses Defender in Demonstration
· 51:14 · Watch on YouTube ↗
Summary
A presenter tests a local Outflank model for generating Windows shellcode runners. After troubleshooting and refining prompts, the presenter reports a working staged payload and a beacon with Defender enabled on Windows 11.
Key points
- The presenter tested a seven-billion-parameter local model and found that an initial server setup produced scattered code and unreliable results.
- An initial generated DLL used encrypted shellcode and an anti-debugging check, but the presenter did not obtain a working payload from that test.
- A later setup produced a working shellcode runner with RC4 encryption, using a separately generated test payload.
- The first attempt to stage the encrypted payload in a local file failed; more specific instructions produced a version that returned a beacon.
- The presenter reports that the final staged runner returned a beacon on Windows 11 with Defender enabled. The demonstration does not establish broad evasion against other configurations.
Article Details
- Topics
- [00:00] Local model and Defender evasion test
- [04:20] Initial model output and code formatting problems
- [09:15] Analysis of a generated DLL shellcode runner
- [19:22] Payload generation and initial execution failures
- [28:26] Alternative model setup and working encrypted runner
- [33:29] File staging, debugging, and prompt refinement
- [48:39] Test with Defender enabled on Windows 11