WEBVTT

00:00:01.040 --> 00:00:01.490
Hello.

00:00:01.500 --> 00:00:05.560
I'm Matt Glass, and welcome to this course on Execution with Unicorn.

00:00:06.240 --> 00:00:07.180
Using Unicorn,

00:00:07.350 --> 00:00:11.090
we can execute our payloads on Windows hosts using a variety of attack

00:00:11.090 --> 00:00:14.060
methods to run the PowerShell commands Unicorn generates.

00:00:14.940 --> 00:00:18.560
But first, let's look at what Unicorn is and how it's used.

00:00:19.440 --> 00:00:23.650
Unicorn is a simple open source tool for using a PowerShell downgrade attack,

00:00:23.650 --> 00:00:25.650
originally created by Dave Kennedy.

00:00:26.240 --> 00:00:28.440
This tool is available on GitHub and is currently

00:00:28.440 --> 00:00:29.960
managed by multiple contributors.

00:00:30.740 --> 00:00:33.900
Unicorn is designed to generate PowerShell commands with

00:00:33.900 --> 00:00:36.050
Metasploit payloads or custom payloads.

00:00:36.740 --> 00:00:39.380
You can download versions of the tool from GitHub or

00:00:39.380 --> 00:00:41.480
clone the repository using Git.

00:00:41.480 --> 00:00:45.960
Once loaded on your host, Unicorn enables in‑memory execution of shellcode.

00:00:46.640 --> 00:00:50.130
Unicorn accomplishes this by using a PowerShell downgrade attack to

00:00:50.140 --> 00:00:53.850
execute your shellcode, tools like Cobalt Strike or Metasploit

00:00:53.850 --> 00:00:58.400
payloads. On the kill chain, Unicorn falls under exploit‑only.

00:00:58.400 --> 00:01:02.240
Although the programs and payloads Unicorn allows you to execute can

00:01:02.240 --> 00:01:03.860
be used to accomplish escalation,

00:01:04.239 --> 00:01:08.180
lateral movement, and action, Unicorn itself just enables the

00:01:08.180 --> 00:01:10.750
execution of these programs on the exploited host.

00:01:12.040 --> 00:01:14.970
The ATT&CK knowledge base developed by MITRE categorizes

00:01:14.970 --> 00:01:17.750
adversary tactics and techniques into multiple different

00:01:17.750 --> 00:01:20.160
categories to describe the adversary's behavior.

00:01:21.240 --> 00:01:24.250
The tactics are categories that cover different phases of an

00:01:24.250 --> 00:01:28.300
attack and allow defensive teams to model an adversary's actions

00:01:28.530 --> 00:01:30.560
and improve the defense of their networks.

00:01:31.440 --> 00:01:34.270
We'll cover two techniques that Unicorn can be used for,

00:01:34.520 --> 00:01:36.660
which both fall under the execution tactic.

00:01:37.440 --> 00:01:41.420
The first is the command scripting interpreter, PowerShell. The

00:01:41.420 --> 00:01:44.260
second is exploitation for client execution.

00:01:45.440 --> 00:01:49.010
Unicorn can accomplish this by enabling adversaries to generate

00:01:49.010 --> 00:01:52.940
PowerShell commands from their malicious payloads and easily embed them

00:01:52.950 --> 00:01:56.060
into an Office document or HTML applications.

00:01:57.040 --> 00:01:59.850
They could use these to target and exploit hosts and

00:01:59.850 --> 00:02:02.650
attempt to trick the users into running their PowerShell

00:02:02.650 --> 00:02:04.450
commands that execute the payload.

00:02:05.640 --> 00:02:06.970
If this command succeeds,

00:02:07.060 --> 00:02:11.060
the attackers can obtain control of the host through bind and reverse shells.