WEBVTT

00:00:01.540 --> 00:00:02.080
[Autogenerated] Hey there.

00:00:02.090 --> 00:00:03.150
Welcome to parasites.

00:00:03.360 --> 00:00:04.310
My name is Ricardo.

00:00:04.370 --> 00:00:05.220
In this course,

00:00:05.310 --> 00:00:08.820
you learned how to bypass defense mechanism using the invoke obfuscation,

00:00:08.820 --> 00:00:09.110
too.

00:00:09.740 --> 00:00:12.310
One of the main objectives off a Red team engagement is to

00:00:12.310 --> 00:00:14.880
perform attacks exactly as a real attacker would.

00:00:14.880 --> 00:00:17.090
Er, And in the reward scenario,

00:00:17.160 --> 00:00:20.250
an attacker will try to be a senator is possible to not get caught.

00:00:21.570 --> 00:00:23.950
So imagine you're working at Red Team Project.

00:00:24.340 --> 00:00:25.930
You already got access a few machines,

00:00:25.940 --> 00:00:28.310
and now you're working on a really important server,

00:00:28.470 --> 00:00:31.050
which you believe it contains a database with sensitive data.

00:00:32.009 --> 00:00:34.070
This ever is a really secure server,

00:00:34.110 --> 00:00:36.780
and he has Windows defender and even in the antivirus

00:00:36.780 --> 00:00:39.460
install a night as you're running out of time,

00:00:39.530 --> 00:00:41.760
you decide to use a mattress plight payload in the

00:00:41.760 --> 00:00:45.280
server to see forget something, and that's a big mistake.

00:00:45.420 --> 00:00:48.460
The inter virus detected malicious payload and informs the

00:00:48.460 --> 00:00:50.400
soccer team about a suspicious activity.

00:00:51.140 --> 00:00:54.690
The starting investigate out the logs and finds out everything of them.

00:00:55.300 --> 00:00:55.970
In this case,

00:00:56.070 --> 00:01:00.360
you just gotta car because a really simple mistake in case like those where

00:01:00.360 --> 00:01:02.550
you don't have time to develop your own customs creates,

00:01:02.630 --> 00:01:04.550
you can use invoke obfuscation, too.

00:01:05.140 --> 00:01:05.800
In this way,

00:01:05.810 --> 00:01:08.760
we can try to obfuscate your malicious payload so the anti

00:01:08.760 --> 00:01:10.750
virus don't detect us and we don't get caught.

00:01:12.610 --> 00:01:13.940
The vocal obfuscation, too,

00:01:14.030 --> 00:01:16.670
is a framework that help us to apply several prescription

00:01:16.670 --> 00:01:18.840
techniques to bypass defense mechanism.

00:01:19.940 --> 00:01:22.470
This, too, was developed by Daniel Bohannon,

00:01:22.480 --> 00:01:25.050
which is a well known member of the cybersecurity community.

00:01:25.500 --> 00:01:27.290
You can find several of his talks on the Internet,

00:01:27.300 --> 00:01:30.050
or you can check some of his projects in his website,

00:01:30.440 --> 00:01:32.900
and there's a lot of interesting stuff there and think so.

00:01:32.900 --> 00:01:35.070
Daniel will have such an amazing obfuscation, too.

00:01:35.490 --> 00:01:36.560
So thanks, Daniel.

00:01:37.940 --> 00:01:39.730
In my opinion, they invoke obfuscation,

00:01:39.730 --> 00:01:42.910
too is one of the most complete frameworks for a script obfuscation.

00:01:43.440 --> 00:01:47.530
Basically, it is a two developing in power show that is able to obfuscate order.

00:01:47.530 --> 00:01:48.450
Power shows creates.

00:01:49.040 --> 00:01:50.950
And this means that instead of trying to mentally

00:01:50.950 --> 00:01:54.450
change the code to evade detection, this too is everything for you.

00:01:56.230 --> 00:01:58.170
What I like about invoke obfuscation, too,

00:01:58.320 --> 00:02:01.750
is that it's completely open source, and they're a pash 2.0 license,

00:02:02.240 --> 00:02:04.740
and this means that it can don't know the source code from get

00:02:04.740 --> 00:02:06.750
hub and modified it as most of you want.

00:02:07.840 --> 00:02:11.090
Also, this too is developed to obfuscate power show script.

00:02:11.540 --> 00:02:13.450
So your payload should be in power shell.

00:02:14.100 --> 00:02:17.110
The framework contained five obfuscation methods and a total

00:02:17.120 --> 00:02:18.750
20 different amplification techniques.

00:02:19.390 --> 00:02:22.100
And these two is neighborly quoted for Windows environments.

00:02:22.170 --> 00:02:24.110
However, as we've seen this course,

00:02:24.160 --> 00:02:28.250
we can't sell Persian Lennox and run the two in the Carolinas environment.

00:02:28.980 --> 00:02:31.490
And this is really important because it can have this

00:02:31.490 --> 00:02:33.140
doing my normal writing laptop.

00:02:33.540 --> 00:02:35.550
I don't have to have a Windows virtual machine for it.

00:02:36.610 --> 00:02:38.510
And on everything that I love about this too,

00:02:38.610 --> 00:02:41.650
is that is released to use and has a really good documentation.

00:02:43.340 --> 00:02:45.750
So if you're familiar with the red team coaching,

00:02:45.760 --> 00:02:49.850
we can use this to anywhere between exploitation face and the action face.

00:02:50.540 --> 00:02:54.250
Davey here is that in every single movement, we want to be undetectable.

00:02:54.700 --> 00:02:57.500
So if you're compromised your first several or extra

00:02:57.500 --> 00:02:59.130
trading data out of the company,

00:02:59.210 --> 00:03:02.150
it is important to obfuscate your code and not be detected.

00:03:03.840 --> 00:03:04.350
If the map,

00:03:04.350 --> 00:03:07.670
the techniques that were laying this course to the minor attack from work,

00:03:07.870 --> 00:03:11.950
you see that here we focus on a warming area which is defensive Asian.

00:03:12.740 --> 00:03:15.550
Inside of the famous evasion recover too many techniques.

00:03:16.090 --> 00:03:19.960
The main one is a teeth 10 27 which is obfuscating files and

00:03:19.960 --> 00:03:23.010
information and also during execution.

00:03:23.020 --> 00:03:25.320
We sometimes need to deal for Escape the files,

00:03:25.400 --> 00:03:28.060
which is covering the technique t 11 40.

00:03:28.840 --> 00:03:34.870
As you can see, we combine two techniques into one attack before we go to a demo.

00:03:34.880 --> 00:03:37.450
I want you to understand how defensive Asian works in

00:03:37.450 --> 00:03:39.050
the real world writing project.

00:03:39.640 --> 00:03:41.900
So imagine you're working the Red Team engagement.

00:03:42.230 --> 00:03:44.450
You just found out a really important server,

00:03:44.540 --> 00:03:48.010
but it hasn't entered virus and solid as you don't have

00:03:48.010 --> 00:03:51.770
too much time to write your own tools, you decide to use it some normal issues,

00:03:51.770 --> 00:03:52.150
too.

00:03:52.540 --> 00:03:57.050
So what do you do first issued creative birch machine with

00:03:57.050 --> 00:03:59.350
the exact same softer as your targets ever,

00:03:59.940 --> 00:04:01.950
And this means the same window version.

00:04:02.100 --> 00:04:07.090
This seems softer version and the same anti virus version they d here is

00:04:07.090 --> 00:04:10.160
They can use these virtual machine to task your obfuscation techniques

00:04:10.210 --> 00:04:12.550
before sending the pillow to the Rio Server,

00:04:12.990 --> 00:04:16.670
and these may take several attempts and you get something once

00:04:16.670 --> 00:04:18.420
in front of the station taking that it works,

00:04:18.430 --> 00:04:21.089
and there's not to get any inter virus you can then

00:04:21.170 --> 00:04:22.550
send you to your target server.

00:04:23.190 --> 00:04:25.450
In this way, you minimize the chance of getting called.

00:04:26.980 --> 00:04:29.330
And the thing to note here is that there is no single

00:04:29.330 --> 00:04:30.910
solution for bypassing anti virus.

00:04:31.390 --> 00:04:34.650
Each detection to has their own ways of the taking, malicious behavior.

00:04:35.040 --> 00:04:38.350
So you may have to play a little bit with the obfuscation techniques and

00:04:38.350 --> 00:04:40.450
to find something that works in that specific scenario.

00:04:41.300 --> 00:04:44.250
And remember, just because you bypassed one type of 20 verse,

00:04:44.340 --> 00:04:46.810
it doesn't mean that it will work in every other interview a solution.

00:04:47.340 --> 00:04:49.230
So you should always create a clone,

00:04:49.230 --> 00:04:51.640
a foreign targets ever and has the payload in there.

00:04:53.540 --> 00:04:55.860
When we talk about obfuscation techniques, you should.

00:04:55.860 --> 00:04:57.950
There are several ways off opens, get and skirt.

00:04:58.540 --> 00:04:59.100
To be honest,

00:04:59.120 --> 00:05:02.350
we could spend hours or even days in discussing details off those techniques,

00:05:02.920 --> 00:05:03.470
and actually,

00:05:03.580 --> 00:05:05.820
there's some cyber secure specialists that only focus the

00:05:05.820 --> 00:05:07.950
researching ways to bypass detection mechanism.

00:05:08.340 --> 00:05:11.150
But let me show you a quick overview on how that's done.

00:05:12.140 --> 00:05:14.000
For example, let's say you have deal basis,

00:05:14.000 --> 00:05:17.470
create that you want to obfuscate first you can do a simple

00:05:17.470 --> 00:05:20.350
obfuscation by replacing the variable names in this crypt.

00:05:21.200 --> 00:05:24.030
Some anti virus solutions look for key words on the quote,

00:05:24.160 --> 00:05:25.850
so this may work in some cases.

00:05:27.040 --> 00:05:30.060
Or it can change the order of actions in your scripts as

00:05:30.060 --> 00:05:31.650
long as it doesn't affect the outcome.

00:05:32.940 --> 00:05:35.230
Another technique is creating sub functions to

00:05:35.230 --> 00:05:37.000
break the linearity off the court.

00:05:37.940 --> 00:05:40.150
As you can see, the court looks totally different now.

00:05:40.840 --> 00:05:44.150
Anyways, you got the idea there several ways off getting a cold,

00:05:44.640 --> 00:05:47.080
and those ones are the most simple ones there.

00:05:47.080 --> 00:05:49.310
Several more complex ways off skating _______.

00:05:50.010 --> 00:05:53.560
And that's exactly where invoke obfuscation will help you with this, too.

00:05:53.570 --> 00:05:56.120
We can apply one or more advanced presentation techniques

00:05:56.220 --> 00:06:00.180
in just few seconds to follow her demos.

00:06:00.190 --> 00:06:03.560
A Drew come in, you creating a small of environment to play with this, too.

00:06:04.390 --> 00:06:06.880
For this course, you need to virtual machines.

00:06:07.130 --> 00:06:10.250
Want to be the attack mission and want to be the target mission.

00:06:11.180 --> 00:06:13.060
Remember, in the real road scenario,

00:06:13.170 --> 00:06:16.660
they should be a clone of her target as their attacker machine.

00:06:16.700 --> 00:06:20.640
I will be using color Lennox's version 2020 even though the in

00:06:20.640 --> 00:06:23.540
vocal provocation is a two development power show.

00:06:23.610 --> 00:06:28.150
I do like to use my regular collects so I can have all my tools in one place.

00:06:29.140 --> 00:06:30.040
In our first demo,

00:06:30.090 --> 00:06:33.890
you see how to stall portion Lennox and I hoped to run this do in college.

00:06:34.440 --> 00:06:36.610
If you don't want to use Carolyn's, it started.

00:06:36.610 --> 00:06:37.000
Okay,

00:06:37.230 --> 00:06:39.530
you can use the Windows First Machine or any other

00:06:39.530 --> 00:06:42.710
linens distribution as a target machine.

00:06:42.750 --> 00:06:44.950
I create a Windows Server 2016.

00:06:45.580 --> 00:06:49.550
This machine has the Windows Defender enabled and house install a very famous

00:06:49.550 --> 00:06:53.490
enter via a solution in a real project of the greater server.

00:06:53.490 --> 00:06:55.380
That is exactly like my target server.

00:06:55.660 --> 00:06:59.810
So I can properly test the detection off my malicious script in your lab.

00:06:59.900 --> 00:07:01.840
It can use any Windows machine that you want,

00:07:02.050 --> 00:07:03.550
as long as you have power shown it.

00:07:04.440 --> 00:07:05.710
So enough talking,

00:07:05.830 --> 00:07:08.470
let's go to our calendar next and see how things told the two

00:07:08.480 --> 00:07:10.470
and how to bypass and diverse attractions