Главная
Study mode:
on
1
Introduction
2
Who am I
3
Solution
4
Macros
5
bitmap
6
valid
7
malicious payload
8
shellcode vs assembly
9
Introducing the cat
10
Modifying the image
11
Changing the image size
12
Changing the bitmap format
13
Changing the payload
14
Testing the payload
15
Testing the image on PowerPoint
16
Endpoint Problem
17
The Lazy Way
18
Visual Explanation
19
Shellcode
20
Endpoint Fire
21
PowerShell
22
Shell Code
23
Last Episode
24
PowerShell Oneliner
25
Cut Cave
26
Image Embedding
Description:
Explore a powerful tool for evading antivirus, sandboxes, and IDS/IPS systems in this 27-minute conference talk from NorthSec. Learn about a technique that abuses polyglot files and compact low-level obfuscation using assembly to create payloads that can be executed through various vectors like PowerShell or Windows executables. Discover how this tool can obfuscate a wide range of payloads, from classic meterpreter and empire payloads to Cobalt Strike beacons, DLLs, and executables. Understand the tool's ability to deobfuscate executables in memory and execute shellcode, providing a simple yet effective way to bypass multiple layers of security with a single payload. Gain insights into the tool's components, including macros, bitmap manipulation, shellcode vs. assembly, and PowerShell oneliners. This presentation is essential for pentesters targeting environments with multiple security products.

Don't Kill My Cat

NorthSec
Add to list
0:00 / 0:00