Social Engineer Vector

[Superflu0usRoot]

Hello one and all, I have returned (not that I was missed, but I plan to be around more consistently hopefully can help someone else out)
I checked the forum rules and don't think is not allowed. Hopefully I can post this clearly enough to prevent this from turning into a troll thread.

I was recently scammed by someone via WesternUnion. We were doing a joint venture project, after he got my money he "disappeared" for a week. When he came back, he claimed that he got scammed and doesn't have his half of the money, but he already put mine down as a down payment. I was able to trace his IP and the "guy who had the down payments" IP, and found out they're one in the same (I was already certain it was a scam, but after this proof wanted to lock down my plan to take my money back). I have cause to believe the guy has plenty of bitcoins on his machine, and I plan to recover enough to pay myself back.

In my course of social engineering the guy, I found out the following:
His IP address (It's in India, which makes sense. He also has no ports open, but a bunch filtered)
-He runs windows 7 x64
-He uses Firefox 24 or Internet Explorer 10 (I would assume pretty patched)
-He uses Avira anti-virus
-He uses Adobe Reader 11 (not sure if it's 11.0.4 yet or not).

So I don't think I'm gonna find an exploit (unless someone wants to point me where to search for zero days)

I'm planning on using metasploit, already built a payload and tested it on my VM machine. I figure if I can get it into his machine, I can set it up to persistent and with enough time keylogger him and get his bitcoin wallet.

Problem I'm having is with getting the .exe to NOT set off Avira. I've looked into packers and other methods, but they all seem out of date.

Any suggestions or points in the right direction would be helpful.

[rasenove]

I can either say,


Or, tough luck. Go get legal help.

[Superflu0usRoot]

Legal help is not an option for being scammed in a joint venture by someone in India.

I guess the story wasn't entirely necessary .

TL;DR?
"Trying to pack a metasploit payload to get around Avira anti-virus."

[DerpyTurtle]

If he has absolutely no ports open shoot for something on a common port like 80 or 8080, I would imagine he still allows http/s traffic to his machine. As far as getting around the av you could just kill it with metasploit otherwise there are some other dated options you could use. I would recommend a quick google search for ways to bypass av or search for vulns in the specific av you're trying to bypass and use that. You said you're looking for a zeroday I would suggest exploit-db or something similar.  I'm guessing you used nmap to scan his system for open ports?

[NovaCygni]

Crawl Pastebin and other similar sites for 0-days, every Anon I know puts them there (* as much as I wish they wouldnt... *), also, you could always SocialEngineer the guy into having a MSN/Skype or other form of vuln chat with you and hack him through that... countless people have been stung over MSN and its not much of a secret that Skype has more vulnerable's than kids in a Vietnamese Orphanage named "The Gary Glitter foundation"...

[proxx]

If he has absolutely no ports open shoot for something on a common port like 80 or 8080, I would imagine he still allows http/s traffic to his machine. As far as getting around the av you could just kill it with metasploit otherwise there are some other dated options you could use. I would recommend a quick google search for ways to bypass av or search for vulns in the specific av you're trying to bypass and use that. You said you're looking for a zeroday I would suggest exploit-db or something similar.  I'm guessing you used nmap to scan his system for open ports?

Not that it really matters but how many people do you know that run a webserver portforwarded on their home network? ....
Im pretty sure 99% of the home users dont have any ports open aka forwarded.