Session

Exploitation with Shell Reverse and Infection with PowerShell using VBS file

The purpose of this presentation, it was to execute several efficiency and detection tests in our lab environment protected with an endpoint solution, provided by CrowdStrike, this presentation brings the result of the defensive security analysis with an offensive mindset using reverse shell techniques to gain access inside the victim’s machine and after that performing a Malware in VBS to infected the victim machine through use some scripts in PowerShell to call this malware, in our environment. Regarding the test performed, the first objective it’s to simulate targeted attacks using a python script to obtain a panoramic view of the resilience presented by the solution, with regard to the efficiency in its detection by Signatures, NGAV, and Machine Learning, running this script, the idea is to use the reverse shell technique to gain access on the victim’s machine. After the execute this attack, the second objective consists in performing the PowerShell Script to run this script, to download a VBS Malicious file on the victim’s machine and execute itself, calling this malware provided through Malwares Bazaar by API request.

Filipi Pires

Threat Researcher and Cybersecurity Advocate

Espinho, Portugal

Actions

Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.

Jump to top