Cracking the Perimeter with SharpShooter
summary
Open-source SharpShooter generates staged and stateless Windows payloads (HDA, JS, VBS, VBA, Excel4) using dotnet-to-JScript serialization, RC4/base64/zip obfuscation and web or DNS retrieval of C# payloads; it bypasses Cylance, Palo Alto TRAPS and FireEye in engagements and is publicly available since March 2018. Defensive evasion includes HTML smuggling, scriptlet execution via XML stylesheets and COM, Excel 4 macro delivery and AMSI workarounds (registry toggle, DLL hijack, patching), plus tradecraft like process injection and page-permission fixes that demonstrably regain execution on hardened hosts.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 3:33Introducing SharpShooter tool
- 8:10Reconnaissance for payload targeting
- 12:07Demo against Palo Alto Traps
- 13:19Defender signatures and tool updates
- 16:55Scriptlet-based payload execution
- 22:59AMSI bypass techniques
- 27:08Macro and Excel 4.0 support
- 30:26Tradecraft improvements for OPSEC
- 36:01Detection and prevention strategies
- 39:12Conclusions and ethical considerations
- 40:38Q&A session
related talks
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
48m"Sneaking Past Device Guard"
41m"Revenge of The Script Kiddies: Current Day Uses..."
51mSneaking Past Device Guard
41mSimulation Hacking, the Good, Bad and the Ugly
50mWrite Once, Pwn Anywhere
52mFlying Under the Radar - New Security Evasion Techniques
52mStart covering your bases & Stop chasing APT headlines