This course focuses on retooling with .NET payloads for offensive toolkits and operational automation. The learning outcomes include mastering quick in-field retooling, dynamic execution of .NET implants, OpSec lessons from dynamic code compilation, and accessing native Windows API on-the-fly. The course teaches skills such as using the DLRium Managed Execution toolkit, reflective .NET DLR, hiding sensitive aspects in managed code memory, and utilizing dynamic DLR for code reflection. The teaching method involves a talk format with a syllabus covering strategic and technical goals, slim payload delivery, .NET managed code, dynamic DLR, and delivery of code through various evasion mechanisms. The intended audience for this course is Red Teams and security professionals interested in enhancing their offensive toolkit capabilities with .NET payloads.
Overview
Syllabus
Introduction
Retooling in the Field
Strategic Goals
Technical Goals
Slim payload delivery
Current options
NET Managed Code
Managed Execution Toolkit
What is NET
CodeDom
Whats Needed
Goal
Reflective Load
Invoke Contract
Code Cradle
CSX Extensions
Create Namespace
Code as Data
cfir
Process Manager
Limitations
Application Domains
Interrupt
Evasion
Interop
Start a process
Dynamic interrupt
Dynamic load
Dynamic compile
Flexible solution
Dynamic DLR
What is Dynamic DLR
What is Dynamic DLR used for
Code Reflection
PowerShell
Python
IronPython
DLR
DLL
Dynamic Python Files
CLR
CTypes
Delivery of Code
Typhoon
Other evasion mechanisms
How it works
Net Modules
Dynamic Net Modules
Hiding things into memory
Invoke Python
Shellcode
Memory Map
C Shellcode
C Python
C PowerShell
Python for Development
Alpha
Outro
Taught by
NorthSec
