Enterprise Attacker Emulation and C2 Implant Development with Joff Thyer
Overview
- Course Length: 16 hours
- Support from expert instructors
- Includes certificate of completion
- 12 months access to Cyber Range
This class focuses on the demonstration of an Open Command Channel framework called “OpenC2RAT”, and then developing, enhancing, and deploying the “OpenC2RAT” command channel software into a target environment.
As penetration testers, we all have a need to establish command and control channels in our customer environments. This can be done under the guise of an “assumed compromise” context or in a more adversarial Red Team context. The age of endpoint detection and response (EDR) solutions and application whitelisting has created significant barriers to commodity/well known malware deployment for adversarial exercises.
This class focuses on the demonstration of an Open Command Channel framework called “OpenC2RAT”, and then developing, enhancing, and deploying the “OpenC2RAT” command channel software into a target environment. Students will learn about the internal details of a command channel architecture and methods to deploy in an application-whitelisted context. The class will introduce students to blocks of code written in C#, GoLang, and Python to achieve these goals. In addition, the class will introduce some ideas to deploy existing shellcode such as Cobalt Strike Beacon or Meterpreter within a programmed wrapper to enhance success in the age of modern endpoint defense. Many of the techniques introduced in this class can be used to evade modern defensive technologies.
Key Takeaways
- Insight into command channel architecture
- The ability to leverage different programming languages to execute custom malware
- A diversity of solutions for establishing command channels
Who Should Take This Course
- Penetration testers
- Any security professionals who want to know the inner workings on malware
- This class will help any organization that wants to start emulating advanced malware to test their defenses and detective capabilities
Audience Skill Level
Basic scripting skills in a language such as Python and a willingness to use Visual Studio IDE for code modification will be advantageous. Students should have a familiarity with penetration testing tools, techniques, and procedures as well as a conceptual understanding of HTTP RESTful/JSON technology.
Suggested Prerequisite Reading List
- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
- https://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All-wp.pdf
- https://docs.microsoft.com/en-us/dotnet/csharp/tutorials/intro-to-csharp/
- https://www.python.org/about/gettingstarted/
- https://golang.org/doc/tutorial/getting-started
What Each Student Will Be Provided With
- Access to a GitHub code repository with source code samples
- Access to a PDF copy of all slideware
- High-speed Internet connectivity
- Ability to connect to remote Azure deployed desktops
- A laptop that supports Windows Remote Desktop protocol
There are no scheduled live dates for this course at this time. Private training may be available.
On Demand Training
-
Train at your own pace with no set course schedule
-
Access to all course resources, including slides and VMs
-
Subject Matter Expert support through Discord
- Tips, tools, and techniques that can be applied immediately upon returning to work
- Strengthen your skills by solving challenges within the Antisyphon Cyber Range
- Become part of a community driven to educate and share knowledge