That’s Just a Tool – Not Good Nor Bad. That Part is Up to YOU
Every admin tool is an attack tool, yet there are no good or bad shells – that part is up to you. Coming from dozens of engagements consulting various role-based remote operations architectures & Red Team assessments for organizations in 4 continents – we’ll present technical, hands-on examples of what SUCKS and what ROCKS on the Windows ‘Living off the land’ remote admin operations, Protocols and APIs. from IPC mechanisms (Named Pipes, mailslots etc’) through RPC (WMI / DCOM / Multiple LoLBins), WinRM / PSRemoting, RDP and more. Pros and Cons for jump server architectures, as well as role-based shells for everyone! We’ll also present how to limit powershell in creative ways, and demonstrate a super CLI, fully audited, whitelisted to do exactly what you want it to do, single port, fully encrypted, copies files, sends local variables to remote sessions and much more! but.. also show how we can manipulate remote sessions without any credentials exposed to fully take over the account 🙂
About the Speaker
H@כk3r & seasoned InfoSec researcher/red team trainer. Yossi Sassi has accumulated extensive experience in information security for over 30 years, on assessments in 4 continents, conducting DF/IR investigations and more, including Fortune100. Ex-Javelin Networks (acquired by Symantec). Ex-Technology Group Manager at Microsoft (coded windows server resource kit tools). Sassi was warded 4 Peace and friendship awards from governments and universities, and speaks regularly at various security conferences around the globe. Volunteer for youth at risk, Oriental-Rock bouzoukitarist & an aviator.