Abusing native Shims for Post Exploitation

Presented at DEF CON 23 (2015), Aug. 9, 2015, 10 a.m. (60 minutes)

Shims offer a powerful rootkit-like framework that is natively implemented in most all modern Windows Operating Systems. This talk will focus on the wide array of post-exploitation options that a novice attacker could utilize to subvert the integrity of virtually any Windows application. I will demonstrate how Shim Database Files (sdb files / shims) are simple to create, easy to install, flexible, and stealthy. I will also show that there are other far more advanced applications such as in-memory patching, malware obfuscation, evasion, and system integrity subversion. For defenders, I am releasing 6 open source tools to prevent, detect, and block malicious shims.

Presenters:

• Sean Pierce - Technical Intelligence Analyst for iSIGHT Partners
  Sean Pierce is a Technical Intelligence Analyst for iSIGHT Partners. Sean currently specializes in reverse engineering malware & threat emulation and in the past has worked on incident response, botnet tracking, security research, automation, and quality control. Prior working at iSIGHT Partners, he was an academic researcher and part time lecturer at the University of Texas at Arlington where he earned a Bachelors of Computer Engineering with a minor in Math. Sean also does freelance consulting, penetration testing, forensics, and computer security education. He is an Eagle Scout and enjoys learning how things work. Twitter: @secure_sean

Links:

• https://defcon.org/html/defcon-23/dc-23-speakers.html#Pierce
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Sean Pierce - Abusing native Shims for Post Exploitation - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Sean Pierce - Abusing native Shims for Post Exploitation - Video.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Sean Pierce - Abusing native Shims for Post Exploitation - Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Sean Pierce - Abusing native Shims for Post Exploitation - Video and Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Sean Pierce - Abusing native Shims for Post Exploitation - Video.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Sean Pierce - Abusing native Shims for Post Exploitation - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=LOsesi3QkXY

Similar Presentations:

• Black Hat Europe 2015 / Defending Against Malicious Application Compatibility Shims