[Autogenerated] Hey there.
Welcome to parasites.
My name is Ricardo.
In this course,
you learned how to bypass defense mechanism using the invoke obfuscation,
too.
One of the main objectives off a Red team engagement is to
perform attacks exactly as a real attacker would.
Er, And in the reward scenario,
an attacker will try to be a senator is possible to not get caught.
So imagine you're working at Red Team Project.
You already got access a few machines,
and now you're working on a really important server,
which you believe it contains a database with sensitive data.
This ever is a really secure server,
and he has Windows defender and even in the antivirus
install a night as you're running out of time,
you decide to use a mattress plight payload in the
server to see forget something, and that's a big mistake.
The inter virus detected malicious payload and informs the
soccer team about a suspicious activity.
The starting investigate out the logs and finds out everything of them.
In this case,
you just gotta car because a really simple mistake in case like those where
you don't have time to develop your own customs creates,
you can use invoke obfuscation, too.
In this way,
we can try to obfuscate your malicious payload so the anti
virus don't detect us and we don't get caught.
The vocal obfuscation, too,
is a framework that help us to apply several prescription
techniques to bypass defense mechanism.
This, too, was developed by Daniel Bohannon,
which is a well known member of the cybersecurity community.
You can find several of his talks on the Internet,
or you can check some of his projects in his website,
and there's a lot of interesting stuff there and think so.
Daniel will have such an amazing obfuscation, too.
So thanks, Daniel.
In my opinion, they invoke obfuscation,
too is one of the most complete frameworks for a script obfuscation.
Basically, it is a two developing in power show that is able to obfuscate order.
Power shows creates.
And this means that instead of trying to mentally
change the code to evade detection, this too is everything for you.
What I like about invoke obfuscation, too,
is that it's completely open source, and they're a pash 2.0 license,
and this means that it can don't know the source code from get
hub and modified it as most of you want.
Also, this too is developed to obfuscate power show script.
So your payload should be in power shell.
The framework contained five obfuscation methods and a total
20 different amplification techniques.
And these two is neighborly quoted for Windows environments.
However, as we've seen this course,
we can't sell Persian Lennox and run the two in the Carolinas environment.
And this is really important because it can have this
doing my normal writing laptop.
I don't have to have a Windows virtual machine for it.
And on everything that I love about this too,
is that is released to use and has a really good documentation.
So if you're familiar with the red team coaching,
we can use this to anywhere between exploitation face and the action face.
Davey here is that in every single movement, we want to be undetectable.
So if you're compromised your first several or extra
trading data out of the company,
it is important to obfuscate your code and not be detected.
If the map,
the techniques that were laying this course to the minor attack from work,
you see that here we focus on a warming area which is defensive Asian.
Inside of the famous evasion recover too many techniques.
The main one is a teeth 10 27 which is obfuscating files and
information and also during execution.
We sometimes need to deal for Escape the files,
which is covering the technique t 11 40.
As you can see, we combine two techniques into one attack before we go to a demo.
I want you to understand how defensive Asian works in
the real world writing project.
So imagine you're working the Red Team engagement.
You just found out a really important server,
but it hasn't entered virus and solid as you don't have
too much time to write your own tools, you decide to use it some normal issues,
too.
So what do you do first issued creative birch machine with
the exact same softer as your targets ever,
And this means the same window version.
This seems softer version and the same anti virus version they d here is
They can use these virtual machine to task your obfuscation techniques
before sending the pillow to the Rio Server,
and these may take several attempts and you get something once
in front of the station taking that it works,
and there's not to get any inter virus you can then
send you to your target server.
In this way, you minimize the chance of getting called.
And the thing to note here is that there is no single
solution for bypassing anti virus.
Each detection to has their own ways of the taking, malicious behavior.
So you may have to play a little bit with the obfuscation techniques and
to find something that works in that specific scenario.
And remember, just because you bypassed one type of 20 verse,
it doesn't mean that it will work in every other interview a solution.
So you should always create a clone,
a foreign targets ever and has the payload in there.
When we talk about obfuscation techniques, you should.
There are several ways off opens, get and skirt.
To be honest,
we could spend hours or even days in discussing details off those techniques,
and actually,
there's some cyber secure specialists that only focus the
researching ways to bypass detection mechanism.
But let me show you a quick overview on how that's done.
For example, let's say you have deal basis,
create that you want to obfuscate first you can do a simple
obfuscation by replacing the variable names in this crypt.
Some anti virus solutions look for key words on the quote,
so this may work in some cases.
Or it can change the order of actions in your scripts as
long as it doesn't affect the outcome.
Another technique is creating sub functions to
break the linearity off the court.
As you can see, the court looks totally different now.
Anyways, you got the idea there several ways off getting a cold,
and those ones are the most simple ones there.
Several more complex ways off skating _______.
And that's exactly where invoke obfuscation will help you with this, too.
We can apply one or more advanced presentation techniques
in just few seconds to follow her demos.
A Drew come in, you creating a small of environment to play with this, too.
For this course, you need to virtual machines.
Want to be the attack mission and want to be the target mission.
Remember, in the real road scenario,
they should be a clone of her target as their attacker machine.
I will be using color Lennox's version 2020 even though the in
vocal provocation is a two development power show.
I do like to use my regular collects so I can have all my tools in one place.
In our first demo,
you see how to stall portion Lennox and I hoped to run this do in college.
If you don't want to use Carolyn's, it started.
Okay,
you can use the Windows First Machine or any other
linens distribution as a target machine.
I create a Windows Server 2016.
This machine has the Windows Defender enabled and house install a very famous
enter via a solution in a real project of the greater server.
That is exactly like my target server.
So I can properly test the detection off my malicious script in your lab.
It can use any Windows machine that you want,
as long as you have power shown it.
So enough talking,
let's go to our calendar next and see how things told the two
and how to bypass and diverse attractions