Главная
Study mode:
on
1
Introduction
2
Getting a foothold
3
SharpShooter
4
What does it do
5
NetTJScript
6
HTML Smuggling
7
SharpShooter Tricks
8
Targeting Skype for Business
9
SharpShooter Demo
10
Signatures
11
VirusTotal
12
MSZ
13
MSZ Architecture
14
OMSI
15
Squiggly
16
Calm Staging
17
Workflow
18
XML DOM
19
Exploit
20
Example
21
AMZ payload
22
DLL hijacking
23
MG scam before patch
24
Excel for trick
25
Excel for payload
26
Tradecraft
27
Indicators
28
Dry Permissions
29
Injection
30
Spoofing
31
Demo
32
Detection Prevention
33
Prevention Strategies
34
Conclusions
Description:
Explore advanced payload generation techniques for red team engagements in this 42-minute conference talk from Hack in Paris. Learn how to bypass next-generation endpoint protections, including Cylance, Palo Alto TRAPS, and FireEye, using the open-source SharpShooter framework. Discover methods for profiling organizations, circumventing static analysis on disk, in-memory, and across networks, and evading sandboxing through payload keying. Delve into novel scriptlet execution techniques using XML stylesheets, COM, and application whitelisting bypasses. Gain insights into targeting Skype for Business, understanding signature-based detection, and leveraging various payload delivery methods such as HTML smuggling and DLL hijacking. Examine the MSZM architecture, OMSI, and Squiggly Calm staging workflow for enhanced evasion. Conclude with a discussion on detection prevention strategies and tradecraft considerations for red teamers.

Cracking the Perimeter with SharpShooter - Dominic Chell - Hack in Paris - 2019

Hack in Paris
Add to list