Abusing Windows with PowerShell and Microsoft debuggers in user-land and kernel-land

We will cover the following subjects: Â<8a>Â<97>¢ User-land proof-of-concept: attacking the digest Security Support Provider byte per byte with PowerShell and Microsoft debugger to retrieve passwords from memory Â<8a>Â<97>¢ Kernel-land proof-of-concept: Direct Kernel Object Manipulation with PowerShell and Microsoft debugger o Hiding/Unhiding a process o Protecting a process o Injecting all privileges in a process with SYSTEM identity o Pass-The-Token attack

Â<8a>Â<97>¢ User-land proof-of-concept: Injecting and executing a shellcode in a remote process with PowerShell and a Microsoft debugger

Presented by