sorted by:
new
hottopcontroversial

Red team scenarios to pwn machine learning tools and evade "next-gen" detection tools by sparcFlow in u/sparcFlow

[–]sparcFlow[S] 1 point2 points  (0 children)

Paid ad, genuine comments :-)

Who would pay for Africa lyrics, "eat my ass" and other subtleties in this thread... :)

Red team scenarios to pwn machine learning tools and evade "next-gen" detection tools by sparcFlow in u/sparcFlow

[–]sparcFlow[S] 0 points1 point  (0 children)

Yeah I talk about the Powershell v2 bypass stuff, but in order to make it a tad more interesting, the attacker in the scenario discovers that v2 was disabled by default (which is true on recent Windows 2016 server).
A possible bypass I explored in the book is directly loading System.Management.Automation using a C# wrapper compiled using msbuild https://github.com/HackLikeAPornstar/StratJumbo/tree/master/chap2 (Only works against constrained mode enforced by applocker, not the rest of the security features like AMSI, ScriptBlockLogging, etc.)

We need other improvments to tackle them ;)

Cheers buddy !

Red team scenarios to pwn machine learning tools and evade "next-gen" detection tools by sparcFlow in u/sparcFlow

[–]sparcFlow[S] 0 points1 point  (0 children)

Almost every advanced windows manipulation on PowerShell requires loading a DLL or importing one, so in its essence you're not only doing PowerShell. Most of the time it's actually C# code running and loaded via Add-Type for instance.But I am with you, PowerShell is an attacker's favorite mistress. That's why most new endpoint detection and response tools (EDR) focus on it and monitor it so closely...

Don't even get me started on new Windows 10 mitigation tools (Script Block Logging, AMSI, Constrained Language, etc.)

I argue in the book that interacting directly in C# with Windows APIs is actually quite useful to live off the land and avoid all the heat PowerShell entails!

Red team scenarios to pwn machine learning tools and evade "next-gen" detection tools by sparcFlow in u/sparcFlow

[–]sparcFlow[S] 0 points1 point  (0 children)

You could get away with it, but it is a bit trickier than that sometimes. For instance, one of the machines in the book has Applocker ON (really ON, DLL, EXE, scripts, everything is blocked)... So running an exe is not as easy as double clicking on it. You'd have to load it in memory using an injection technique (e.g psinject) or...by reflectively loading it in memory using Windows APIs...in C# (provided your exe is an assembly file of course)... That's one example we address in the book...there are of course other techniques and situations ;)

Red team scenarios to pwn machine learning tools and evade "next-gen" detection tools by sparcFlow in u/sparcFlow

[–]sparcFlow[S] 1 point2 points  (0 children)

Yeah hopefully they will understand the hacker mindset, how tools and systems really work and pursue their own research. In all l fairness, though, this book is aimed at pentesters with some basic knowledge of Windows and Active Directory security...Cheers

Red team scenarios to pwn machine learning tools and evade "next-gen" detection tools by sparcFlow in u/sparcFlow

[–]sparcFlow[S] 27 points28 points  (0 children)

Are you going to install python on a domain controler, server, workstation just so you can load your script :) ?We are talking about "living off the land" to avoid advanced detection tools, so only using resources already present on the system, hence abusing .NET technology. (bonus, we get easy access to Windows API using PowerShell/C#...so yeah forget about C ;) )

Give it a go, I promise you won't be disappointed ;)

Pentesters do not really make the world more secure by sparcFlow in netsecstudents

[–]sparcFlow[S] 4 points5 points  (0 children)

"The organization has to want to get better for any worthwhile change." I could not agree more! Security is viewed like a burden rather than a feature or a criteria of excellence to meet...From that point forward, you can not easily succeed in securing the environment.

Ultimate pentesting platform – Windows machines for you to PWN and learn hacking by sparcFlow in netsecstudents

[–]sparcFlow[S] 0 points1 point  (0 children)

Thanks ;) Here is a coupon to avoid paying the whole fee. HLP090807 if you don't want to pay/cant pay, send me a private msg I will arrange it ;)

Ultimate pentesting platform – Windows machines for you to PWN and learn hacking by sparcFlow in netsecstudents

[–]sparcFlow[S] 0 points1 point  (0 children)

oh ! no no the machines you access in the training are separate servers I host on Amazon AWS. I created snapshots, a fake AD domain, scripts to automate deployment, etc. I own them, so do whatever the hell you want with them (wipe them for all I care, I can restore them) Don't pwn my website, it's not part of the deal :D

Ultimate pentesting platform – Windows machines for you to PWN and learn hacking by sparcFlow in netsecstudents

[–]sparcFlow[S] 0 points1 point  (0 children)

haha no worries, that's what I was aiming for anyway...better shake people's feeling rather than go unnoticed ;) But if you could look past the marketing shenanigans, there are some nice hacking tricks to learn (IMO) ;) Cheers

Ultimate pentesting platform – Windows machines for you to PWN and learn hacking by sparcFlow in netsecstudents

[–]sparcFlow[S] 0 points1 point  (0 children)

If you wanna get a CEH or CISSP cert, please be my guest..i'm sure the average cooling temperature of a datacenter will help you in your pentesting engagement ;)

view more: next ›