Windows Agentless C2: (Ab)using the MDM Client Stack
summary
Claims an unprivileged logical flaw lets an attacker programmatically enroll Windows devices into a rogue MDM server and then push commands. The team builds a working exploit called Deep exploit that bypasses admin requirements, a PoC C2 named Matador C2 that uses MS-SMDM/MS-OMADM to deploy MSIs, create privileged accounts, disable Defender/firewall, and remotely start ETW tracing via DiagnosticLog CSP. Microsoft issues a patch after disclosure; detections include MDM certs, registry enroll entries, scheduled tasks and custom CSP DLLs (osquery examples provided).
AI-written summary · about
chapters (8)
- 0:00Introduction to Windows MDM
- 1:30Agent-based vs Agentless C2
- 4:17Selecting MDM for C2
- 8:55How MDM Works
- 16:28Abusing MDM Features
- 20:26Exploiting MDM Enrollment
- 26:38Matador PoC Demonstration
- 31:28Detection and Mitigation
related talks
48mMobile Device Mismanagement
48m"Sneaking Past Device Guard"
58mRed Team Techniques for Evading, Bypassing & Disabling MS
37mThreat Hunting in Active Directory Environment
45mD2T1 - Expanding Your WMI Lateral Movement Arsenal
49mThe Remote Malicious Butler Did It!
37mEnterprise Apps: Bypassing the IOS Gatekeeper
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures