Testlab

Virtual machines
Assemblers
Compilers
Disassemblers
Debuggers
Decompilers
Exploit development
Exploitation tools

Process injection

Introduction
- What?
- Why?
- How?
Shellcode injection
- Overview
- C++ Code
- Injection
- Resources
Process hollowing
- Overview
- C++ code
- Injection
- Resources
Thread execution hijacking
Dynamic-link library injection
- Resources
Portable executable injection
- Resources
TrickBot
- Resources
  - Trickbot
  - Dyre(za)

AV evasion

Introduction
- What?
- Why?
- How?
Basic assembly shellcode
- Resources
Generate shellcode
Staged vs stageless payloads
Encoding and encrypting shellcode
Packers
- Packing
- Now what?
Binders
- Binders and AV

Obfuscation basics

Introduction
- What?
- Why?
- How?
Principles
- Resources
Protecting and stripping identifiable information

Signature evasion

Introduction
- What?
- Why?
- How?
Signature identification
Static code-based signatures
Static property-based signatures
Behavioural signatures
Real world challenge

Bypassing UAC

Introduction
- What?
- Why?
- How?
GUI based bypasses
- msconfig
- azman.msc
AutoElevating processes
- Fodhelper
- Lab
Fodhelper-curver exploit
- Lab
Bypassing Always Notify
- Lab
Automated exploitation

Runtime detection evasion

Introduction
- What?
- Why?
- How?
Study AMSI
- Resources
PowerShell downgrade
PowerShell reflection
Patching AMSI
- Code
- Resources
Automating, but …
- AMSI.fail
- AMSITrigger

Evading logging and monitoring

Introduction
- What?
- Why?
- How?
Study ETW
Powershell reflection
- Code
Patching tracing functions
- Code
Group policy takeover
- Code
Abusing log pipeline
- Code
Challenge

Living off the land

Introduction
- What?
- Why?
- How?
Windows sysinternals
- Resources
LOLBAS project
- Resources
File operations
- Certutil
- BITSAdmin
- Findstr
- Resources
File execution
Application whitelisting bypasses
Shortcuts
No PowerShell
- Lab
- Resources
Challenge: Astaroth
- Resources

Network security solutions

Introduction
- What?
- Why?
- How?
IDS/IPS systems
Evasion via protocol manipulation
Evasion via payload manipulation
Evasion via route manipulation
Evasion via tactical DoS
C2 and IDS/IPS evasion
Next-Generation security
- IDPS
- NGNIPS
- Challenges
- Resources

Firewalls

Introduction
- What?
- Why?
- How?
Firewall systems
- Classification of firewalls
- Firewall inspection abilities
Evasion via controlling the source MAC/IP/Port
Evasion via forcing fragmentation, MTU, and data length
Evasion via modifying header fields
Evasion using port hopping
Evasion using port tunnelling
- Lab
Evasion using non-standard ports
- Lab
Next-Generation firewalls

Sandbox evasion

Introduction
- What?
- Why?
- How?
An adversary walks into a sandbox
Common sandbox evasion techniques
Implementing evasion techniques
The Great Escape
- Code

Nature's cheats

Ty Myrddin Home
Unseen University
Improbability Blog
About
Contact

Index

Unseen University, 2024, with a forest garden fostered by /ut7.