WEBVTT

00:00:00.040 --> 00:00:02.620
Let's now recap what you've learned so far.

00:00:02.630 --> 00:00:05.650
We started off taking a look at how Metasploit's

00:00:05.650 --> 00:00:08.060
Meterpreter stages and payloads work.

00:00:08.070 --> 00:00:11.240
I walked you through the techniques used by the stager to

00:00:11.240 --> 00:00:14.210
resolve APIs and communicate with the handler.

00:00:14.220 --> 00:00:18.620
We also covered how the handler patches the payload's DOS header before sending

00:00:18.620 --> 00:00:22.060
it back to the stager so that it can be reflectively loaded.

00:00:22.140 --> 00:00:24.740
We also covered reflective DLL injection,

00:00:24.750 --> 00:00:28.540
a technique used by the payload during its initialization.

00:00:28.760 --> 00:00:32.780
Next, we covered antivirus and endpoint security solutions.

00:00:33.030 --> 00:00:36.620
I demonstrated how many of these solutions work by breaking them

00:00:36.620 --> 00:00:39.800
up into various components and explaining how they can be

00:00:39.800 --> 00:00:42.320
leveraged to detect malicious activity.

00:00:42.600 --> 00:00:43.350
Finally,

00:00:43.360 --> 00:00:46.890
we went through several modules focused on evading endpoint security

00:00:46.890 --> 00:00:50.960
solutions using Metasploit's Meterpreter stages and payloads.

00:00:51.280 --> 00:00:55.300
I demonstrated how detection can be evaded on disk through the use of

00:00:55.300 --> 00:00:59.060
encoders and custom templates, as well as custom stagers.

00:00:59.340 --> 00:01:02.910
We also covered how machine learning can be tricked by making slight

00:01:02.910 --> 00:01:06.720
changes to the files' appearance by loading modules and resolving their

00:01:06.720 --> 00:01:11.570
imports at runtime. We then covered defense evasion at runtime using

00:01:11.570 --> 00:01:15.690
various anti‑emulation and anti‑sandboxing techniques, as well as

00:01:15.690 --> 00:01:21.140
unhooking APIs. I also showed you how you can bypass AMSI using a variety

00:01:21.140 --> 00:01:22.400
of different techniques.

00:01:22.570 --> 00:01:26.560
I then demonstrated how to evade detection in memory, and showed you how

00:01:26.560 --> 00:01:30.990
the Meterpreter codebase can be customized to hide various artifacts,

00:01:31.000 --> 00:01:34.800
which may be leveraged by antivirus and EDR solutions to detect

00:01:34.800 --> 00:01:37.690
Meterpreter payloads and extensions in memory.

00:01:37.810 --> 00:01:40.820
Finally, we covered defense evasion over the network.

00:01:40.930 --> 00:01:44.010
I demonstrated how perimeter defenses can be defeated

00:01:44.020 --> 00:01:46.460
by encoding payloads and extensions.

00:01:46.640 --> 00:01:49.540
I also gave you some insight into how you can ensure you

00:01:49.540 --> 00:01:51.860
keep a low profile on the network.