WEBVTT

00:00:01.040 --> 00:00:05.860
Hello, I'm Matt Glass, and welcome to this course on Execution with Donut.

00:00:06.540 --> 00:00:07.280
In this course,

00:00:07.290 --> 00:00:10.680
I'll show you how to use Donut to generate shell code and

00:00:10.680 --> 00:00:13.900
enable execution of programs by exploiting the way Windows

00:00:13.900 --> 00:00:16.950
handles .NET code through its native API.

00:00:18.040 --> 00:00:18.600
Using Donut,

00:00:18.600 --> 00:00:21.780
we can run other red team tools or C2 clients

00:00:21.790 --> 00:00:23.860
without triggering the host defenses.

00:00:24.640 --> 00:00:27.960
But first, let's look at what Donut is and how it's used.

00:00:29.040 --> 00:00:32.340
Donut is the shell code generation tool originally written by

00:00:32.340 --> 00:00:36.240
TheWover. This tool is available on GitHub and is currently

00:00:36.240 --> 00:00:37.960
managed by multiple contributors.

00:00:39.240 --> 00:00:43.470
Donut is designed to generate shell code from malicious executables or DLL

00:00:43.470 --> 00:00:48.100
files. Using the shell code, you can hide the tools within other

00:00:48.100 --> 00:00:51.660
executables or inject the code into running processes.

00:00:52.440 --> 00:00:55.590
You can download versions of the tool from GitHub or clone the

00:00:55.590 --> 00:01:00.530
repository using Git. Once loaded on your host, Donut enables

00:01:00.540 --> 00:01:03.460
in‑memory execution of a variety of file types.

00:01:04.040 --> 00:01:08.100
Donut accomplishes this by exploiting the way Windows machines handle

00:01:08.100 --> 00:01:13.660
.NET execution to evade defenses. On the kill chain,

00:01:13.790 --> 00:01:19.120
Donut falls under exploit and evasion. Although the programs Donut allows

00:01:19.120 --> 00:01:22.180
you to execute can be used to accomplish escalation,

00:01:22.280 --> 00:01:26.840
lateral movement, and action, Donut itself just enables the

00:01:26.840 --> 00:01:30.490
execution of these programs and evades defenses on the exploited

00:01:30.490 --> 00:01:35.420
host. The attack knowledge base developed by MITRE categorizes

00:01:35.420 --> 00:01:39.290
adversary tactics and techniques into multiple categories to

00:01:39.290 --> 00:01:41.060
describe the adversary's behavior.

00:01:41.940 --> 00:01:45.430
The tactics are categories that cover different phases of an

00:01:45.430 --> 00:01:49.820
attack and allow defensive teams to model an adversary's actions

00:01:49.830 --> 00:01:52.050
and improve the defense of their networks.

00:01:53.240 --> 00:01:56.260
We will cover three techniques that Donut can be used for.

00:01:56.900 --> 00:02:01.660
The first is Native API, which falls under the execution tactics.

00:02:02.240 --> 00:02:05.530
The second and third are Dynamic Link Library Injection

00:02:05.540 --> 00:02:07.910
and Portable Executable Injection,

00:02:08.000 --> 00:02:11.770
which are sub‑techniques of the Process Injection Technique,

00:02:12.020 --> 00:02:14.750
which falls under the Defense Evasion tactic.

00:02:16.240 --> 00:02:19.990
Donut can accomplish this by enabling adversaries to generate

00:02:19.990 --> 00:02:22.260
shell code from their malicious programs.

00:02:22.940 --> 00:02:27.510
They could use this shell code to target an exploited host and attempt to

00:02:27.510 --> 00:02:31.960
inject their executables or DLL files into existing processes.

00:02:32.940 --> 00:02:34.650
If this injection succeeds,

00:02:34.960 --> 00:02:39.420
the attackers can run applications like C2 clients, which will communicate back

00:02:39.420 --> 00:02:42.660
to the server and grant additional control over the host.

00:02:43.640 --> 00:02:44.610
Once injected,

00:02:44.770 --> 00:02:47.860
the client is now masked behind a legitimate program and

00:02:47.860 --> 00:02:50.060
evades the existing host's defenses.