{"id":10803,"date":"2023-03-07T09:40:18","date_gmt":"2023-03-07T09:40:18","guid":{"rendered":"https:\/\/conference.hitb.org\/hitbsecconf2023ams\/?post_type=session&p=10803"},"modified":"2023-05-19T10:36:31","modified_gmt":"2023-05-19T10:36:31","slug":"commsec-lab-developing-malicious-kernel-drivers","status":"publish","type":"session","link":"https:\/\/conference.hitb.org\/hitbsecconf2023ams\/session\/commsec-lab-developing-malicious-kernel-drivers\/","title":{"rendered":"COMMSEC LAB: Developing Malicious Kernel Drivers"},"content":{"rendered":"

LAB SLIDES \/ MATERIALS (PDF)<\/a><\/p>\n

\n

You know what really grinds my gears? Having everything thought out for a red team action, and then be detected by modern EDR. Especially when simulating APTs and staying unobtrusive in the network for extended periods of time. Over the years we\u2019ve moved from PowerShell one-liners to LOLBINS, from LOLBINS to C#-malware, and finally we’ve utilised direct syscalls. Somehow it still feels like modern EDR is chewing the scenery.<\/p>\n

Kernel driver abuse is an existing but less known technique that offers opportunity to remain undetected, while infiltrating organisations for extended periods of time. For example, InvisiMole actively abuses BYOVD in the war in Ukraine. If you manage to load or exploit a kernel driver, nothing but relaxation awaits you, with a beer in your left hand and your C2 in your right. But loading or exploiting one poses several technical challenges, apart from all the knowledge required to work with kernel drivers. Obtaining that knowledge seems difficult. However, the road to kernel driver exploitation is not that long.<\/p>\n

This lan is for those we\u2019ve heard about the Windows Kernel and want to learn more about it. We\u2019ll dive into the concepts of computer architecture, drivers, user and kernel mode, and kernel exploits. The best part is that you\u2019ll learn to exploit and develop your first malicious kernel driver. <\/strong><\/p>\n

For this lab, you will need:<\/p>\n