Malware On Steroids

----------------------------------------
> DAY I
----------------------------------------
Day 1
▪ Workshop Overview
▪ Development Environment Setup
  - Introduction to compilers and Mingw GCC
  - Introduction to NASM (Netwide Assembler)
  - GCC flag optimization, makefiles and automation
  - Visual Code configuration
▪ Windows Internals
  - Process and thread internals
    ◦ Thread environment block
    ◦ Process environment block
    ◦ Windows loader structure
      - EPROCESS and KPROCESS blocks
      - LDR Table and doubly linked lists
    ◦ Debugging process internals with windbg
      - Introduction to windbg commands
      - Configuring symbols with windbg
      - Debugging windows internals structure
    ◦ Windows memory analysis
  - System programming
    ◦ An overview of windows PE structure
    ◦ Introduction to winapi
    ◦ Windows access tokens
    ◦ System enumeration, user and token enumeration with winapi
    ◦ Enumerating processes and process information
  - Debugging with x64dbg
    ◦ x64dbg symbols for system dlls
    ◦ Introduction to x64 intel assembly
    ◦ Volatile v/s non-volatile registers
    ◦ Understanding the stack frame
    ◦ Fastcalls in x64 assembly
    ◦ Tracing and reversing WinAPI calls
  - Command and control architecture
    ◦ Malware lifecycle
    ◦ Staging architecture
    ◦ Windows socket programming
      - TCP reverse shell pivoting
      - TCP bind shell pivoting
    ◦ SMB reverse shell pivoting
      - Buffer redirection with anonymous pipes
      - Named pipe lateral movement
    ◦ Custom fully working Opsec PsExec

----------------------------------------
> DAY II
----------------------------------------
▪ Process Injection Techniques
  - Local and remote shellcode injection
  - Asynchronous procedure calls
  - Callback and fiber injections
  - Thread address spoofing
  - ROP Injection
▪ Intricacies Of PE & DLL Structures
  - Static v/s dynamic DLL linking
  - Analyzing PE structures
    ◦ PE/COFF header
    ◦ Exploring PE internals with various tools
    ◦ Analyzing EAT and IAT
    ◦ Analyzing other PE sections
    ◦ Stephen Fewer's reflective DLL limitations
    ◦ Evading userland and PEB hooks
  - PE injection techniques
    ◦ Reflective PE (exe) injection
    ◦ Hooking command-line arguments for PE injection
    ◦ Reflective DLL injection
    ◦ String hashing algorithms
    ◦ Reflective DLL limitations
    ◦ Exploring VA, RVA and File Offsets
    ◦ Static v/s Dynamic Addresses
  - Building an evasive reflective loader
    ◦ Section remapping
    ◦ DLL spoofing
    ◦ Hiding threads for evasion
    ◦ Thread spoofing techniques

----------------------------------------
> DAY III
----------------------------------------
▪ NTAPI v/s Syscalls
▪ Windows System Calls
  - Direct system calls (syscalls)
  - Finding syscalls dynamically
  - Indirect syscalls
  - Stack detection and evasion for syscalls
  - Syscall detection and evasions
    ◦ Rop gadgets and clean stack
    ◦ Dealing with CFG/Control Flow Guard
    ◦ Function callbacks and clean stack
▪ Windows API Hooks For Detection and Evasion
  - Userland DLL callbacks
  - Syscall hooks
  - IAT hooks
  - Trampoline hooks
  - Vectored exception handling hooks
  - Hardware breakpoints hooks
  - Reversing and weaponizing edr userland hooks
  - Other evasive techniques for evading userland hooks
▪ Upadting Reflective Loader For Evasion

----------------------------------------
> DAY IV
----------------------------------------
▪ Writing X64 Position Independent Shellcodes
  - Walking the PEB structure
  - Writing position independent code
  - Dynamic resolutions for shellcode
  - Accessing global variables in shellcode
  - Shellcode stack analysis
  - Fastcalling your shellcode
▪ Building Stage Zero
  - Writing a position independent stage zero shellcode loader
  - Writing staging server in python3
  - Environmental keying, evasion and malleability
▪ Return Address Spoofing
▪ Manual Thread Stack Frame Building
▪ OpSec Considerations