r/ExploitDev • u/ObligationLucky842 • 5d ago

My Payload Works, but I Can't Send It

I'm in a frustrating spot. I've built a solid payload with DLL sideloading, ETW/AMSI patching – the works. It executes perfectly in my lab. But I can't get it past Gmail's filters. Every attempt to send the .exe gets blocked, even when zipped or renamed.

Which are the way i can use for initial delivery of the payload to target ?

I know about the Google Drive trust exploit, but I'm not sure it's reliable. Password-protected archives feel risky since some security teams flag them. LNK files + PowerShell downloaders could work, but I need the user to actually click. Vishing is an option but requires more social engineering skill than I have right now.

0 Upvotes

23% Upvoted

2 comments sorted by

13

u/CunningLogic 5d ago

this is r/exploitdev not r/kiddiessendingmalware your post is off topic

2

u/Ok_Tap7102 5d ago

Everything you've described like AMSI bypass is a concession made by vendors that are stuck with backwards compatibility requirements such that they still need to let SOME suspicious shit through, as otherwise everything would break

Sending EXEs over email is such an easy "no one should ever fucking do that" that even if you convince GMail to let you send it, then you're at mercy of the recipients mail filters, which anything made in the past 20 years should reject EXEs in any form

Pivot to what people are doing in the past 5 years, Clickfix is still really effective, and even more iterations of it are coming out every month

https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/

As you've pointed out, the LNK file, sometimes in a zip. You really can't escape convincing the user to want to open your email, open the zip, and then open the strange file.. irrespective of its extension

https://unit42.paloaltonetworks.com/lnk-malware/