IronPython... OMFG
summary
Claims that any PowerShell tradecraft can run via .NET scripting languages without touching disk, implemented by embedding engines in PowerShell and using assembly.Load(byte[]) to load assemblies entirely in memory. Demonstrations show IronPython loads but IronPython breaks on p/invoke (needs 4 DLLs), Boo compiles in memory and injects shellcode (pop calc working via three injection methods), ClearScript runs JScript with CLR access, and a working implant/C2 framework SILENTTRINITY ties it together.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:13Why IronPython matters
- 5:55Dotnet framework basics
- 9:06Dotnet scripting languages
- 12:15Interoperability and embedding
- 15:25PowerShell bypass techniques
- 17:34Embedding language challenges
- 19:43IronPython payload demo
- 24:51Boo Lang advantages
- 25:54Boo Lang payload demo
- 29:59Weaponizing Boo Lang
- 31:03ClearScript overview
- 32:29ClearScript payload demo
- 35:45Advantages of scripting
- 37:32Other dotnet languages
- 38:58Compiling Boo Lang scripts
- 40:14Memory dump demo
- 43:55Silent Trinity tool
- 45:17Detection and defenses
- 48:06Q&A
related talks
27mUsing PowerShell as a Reverse Engineering Tool
56mHacking .NET(C#) Applications: The Black Arts (ASM attacks)
50mWrite Once, Pwn Anywhere
01h 40mDefending against PowerShell attacks - in theory, and in practice
49mPowerShell for Security Incident Response
01h 06mHacking C# from the inside
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
53mInside Shell: Enhancing PowerShell Visibility Using .NET Hacking Techniques