Nullcon Berlin 2023 | (In)Secure Remote Operations: What Sucks, Rocks, And A Super-CLI by Yossi
Abstract :
---------------
Every admin tool is an attack tool, yet there are no good or bad shells - that part is up to you. Coming from dozens of engagements consulting various role-based remote operations architectures & Red Team assessments for organizations in 4 continents, with a fresh research hijacking full tokens from network logon-type sessions - we’ll dive into a technical, hands-on set of examples for both Offensive and Defensive teams, of what SUCKS and what ROCKS on the Windows ‘Living off the land’ remote admin operations, Protocols, and APIs. We'll talk about the Pros and Cons of jump server architectures, as well as role-based shells, limiting PowerShell in creative ways. We'll also introduce fresh research to achieve Full Token hijack from network logon-type sessions, without any hash and/or TGT!
#tokenhijack #shellcode #infosec #NullconBerlin
-------------------------------------------------------------------------------------------------
Follow nullcon on Facebook: / nullcon
Twitter: / nullcon
LinkedIn: / nullcon
Website: https://nullcon.net