Killing AV when it just will not Die!

So we get a shell/meterpreter session and we escalate to system.  As NT AUTHORITY\SYSTEM we should be able to remove those pesky AV/HIPS products that prevent us from completing our penetration test.

Metasploit has an awesome script called killav which will defeat many AV products.  Sometimes however, AV just will not die.

Looking at the processes running we see all the processes running.  Once again, I am picking on McAfee but Symantec and friends has the same type of setup. 

Killing the pid also doesn't work since the application is running as a service.

However.......  If one were to run the following:

net stop “McAfee Framework Service"

net stop "McAfee McShield"

net stop "McAfee Engine Service"

Running the process list again shows McShield and his band of brothers are McGone!

It should be noted that we leave McTray.exe allowed to run so that the user will still see the shield running in the task bar and will not be aware that we have disabled the protection of AV entirely. 

The attacker is now able to infect the machine with any payload they see fit.  Go Zeus?

AntiVirus Vulnerability- Detection after Execution

http://www.n00bz.net/antivirus-cve/

Presented at HackerHalted... This proof of concepts walks through a method of attack that AV products detect only after a known malicious payload is executed.  It is one attack that happens to work against multiple vendors; and it's not a Windows problem, it's that each vendor product allows the execution of a program before detecting the malware, by leveraging an unusual behavior of Help and Support Center through the hcp:// protocol handler.

The exploit used to trigger this behavior is CVE-2010-1885 (HelpCenter) released by Tavis Ormandy.  While this exploit is used, this is NOT a rehash of the Microsoft Helpcenter Exploit.  The purpose of this write up is to walk though the discovery and document the method used to effectively bypass AntiVirus and execute a malicious payload on a victims machine.