RTO: Malware Development Advanced

RED TEAM Operator: Malware Development Advanced Vol.2

$499

RTO: Malware Development Advanced - Vol.2

43 Lessons
365-day access

Advanced offensive security tool (OST) development for Windows kernel, including: kernel object manipulations, silencing EtW telemetry, obtaining and preserving READ+WRITE primitives in Windows kernel, and more.

Buy now

Welcome to Malware Development Advanced (Vol.2) course!

In the previous Volume 1 course we discussed some advanced user land techniques of malware development.

It's time to focus on Windows kernel land and its inner workings to see how one can leverage READ/WRITE access to kernel objects from user space on his/her advantage:

That includes:

discussing a difference between User vs Kernel Modes, how to communicate with kernel drivers and Direct Kernel Object Manipulations (DKOMs)
coding with 3rd-party Driver Interface
accessing kernel objects from user space
finding and abusing handles to bypass security measures
manipulating tokens for gaining higher privileges (changing users, integrity levels and unrestricting tokens)
becoming a fully protected process
using various strategies to locate ETW providers in Windows kernel
removing kernel callbacks for process, thread, image, handle and registry related events
preserving R+W primitives without kernel driver
reading and bypassing vulnerable driver blocklists
finding vulnerable drivers and kernel offsets

You will receive a virtual machine with complete environment for developing and testing your software, and a set of source code templates which will allow you to focus on understanding the essential mechanisms instead of less important technical aspects of implementation.

COURSE IN A NUTSHELL

You Will Learn How To

Talk to kernel drivers using 3rd-party Driver Interface
Access and manipulate kernel objects (including processes, handles and tokens) to your advantage
Find and modify kernel-level ETW providers to change telemetry flows
Make any process protected
Change kernel callbacks for various system objects
Preserve user-to-kernel R+W primitives without using a driver
Deal with driver blocklists
Find kernel offsets and vulnerable drivers

What Will You Get?

Full-blown videos explaining all techniques in detail
Transcription with English subtitles
Text supplements with additional information (code snipets, structure definitions, technology description and context, etc.)
Source code with code templates for rapid development
VM image with ready-to-use development environment

Requirements

Recommended: taking Malware Development Advanced Vol.1 course
Solid understanding of operating system architecture
Good experience with Windows OS
Programming skills in C/C++
Computer with Intel-compatible CPU, min. 4 GB of RAM + 30 GB of free disk space
VirtualBox 7.0+ installed
Strong will to learn and having fun

Target Audience

Ethical Hackers
Penetration Testers
Blue Teamers
Threat Hunters
All security engineers/professionals wanting to learn advanced offensive tactics

Intro and Setup

Course Introduction

2 mins
5.13 MB

Development VM Setup

3 mins
9 MB

Setting up VM's Debug Mode

3 mins
12.7 MB

Problems with VM's Debug Mode

6 mins
29.1 MB

Adding Services in course VM

RTO-MalDev4.ova

MDA2.zip

620 KB

Entering Kernel

User vs Kernel Mode vs DKOM

7 mins
16.4 MB

3rd-party Driver Interface - Wrapper Layer

5 mins
17.5 MB

3rd-party Driver Interface - Driver Layer

4 mins
17.4 MB

EPROCESS Object - Introduction

3 mins
7.13 MB

EPROCESS Object - Windbg Experiments

12 mins
51.5 MB

EPROCESS Object - Implementation

12 mins
51.8 MB

Kernel Objects

Handles - Introduction

3 mins
7.43 MB

Handles - Handle Table

10 mins
35.3 MB

Handles - Multi-layer Handle Tables

12 mins
46 MB

Handles - Weaponization

6 mins
32.1 MB

Tokens - "Borrowing"

6 mins
24.9 MB

Tokens - Privileges

4 mins
18.2 MB

Tokens - Integrity Levels

10 mins
43.8 MB

Tokens - Unrestricted Object

5 mins
21.9 MB

Processes - Protection

9 mins
41.5 MB

Kernel Telemetry

ETW - Locating providers with DbgData

18 mins
82.4 MB

ETW - Locating providers with Threat-Intel

9 mins
36.8 MB

Driver Callbacks - Introduction

6 mins
23.5 MB

Driver Callbacks - Implementation

13 mins
57.9 MB

Object Callbacks - Introduction

10 mins
40.5 MB

Object Callbacks - Implementation

5 mins
24.9 MB

Registry Callbacks

8 mins
33 MB

Physical Memory

Virtual-to-Physical Address Translation

6 mins
14.1 MB

V2P Experiments with Windbg

12 mins
36.7 MB

Physical Memory - GDriver

13 mins
46.5 MB

Physical Memory - Intel Driver

9 mins
36.2 MB

Operationalization

"Preserve Mode"

16 mins
64 MB

Driver Blacklists

6 mins
32 MB

Finding Vulnerable Drivers

4 mins
16.8 MB

Extracting Kernel Offsets

7 mins
31 MB

Assignments

Assignment #1 - Driver Services

Assignment #2 - "Extending" Intel Driver (V2P)

Assignment #3 - Physical-to-Virtual Translation

Assignment #4 - Minifilter Callbacks

Summary

Your Feedback

Closing words

2 mins
3.73 MB

Instructor: reenz0h

Chief Research Officer at SEKTOR7. In the industry for over 20 years. Worked in global Red Team for almost a decade. Simulated threat actors targeting IT infrastructure across various industries (financial, technology, industrial, energy, aviation) around the world. Speaker at HackCon, PWNing, WTH@ck, Sec-T, T2, DeepSec. Gave guest lectures at several military and civil academies and universities.

Founder of x33fcon security conference
and SEKTOR7 offensive research company

X Youtube Website

FAQs

Why malware development?

So-called malware development in the context of legal security testing is also known as offensive security tool (OST) development or Offensive Coding. The goal is to teach all cybersecurity professionals, both red and blue teams, to use this knowledge to better understand how real threat actors operate and use different techniques (TTP). This approach should significantly improve the skillset of offensive and defensive teams in testing and securing the production environments of their customers and employers in the long run.

How long is the course?

All videos are about 5h long.

What language is used in the course?

All videos, text and materials are in English.

Is it on-line course only?

The course is composed of 2 types of materials. Videos, which are available on-line only, and virtual machine with source code templates, which can be downloaded and stored on your computer, so you can access it later off-line.
In case of video download attempts, access to the content will be revoked.

How long is the course available after purchase?

After you purchase the course, you have access to all the videos and materials for 365 days. You can learn whenever you want, the content will always await for you within that time frame.
Moreover, any updates to the course materials (ie. new modules, new videos, new files, etc.) will also be available for anyone who purchased the course without any extra charge.

Do I have to be an expert in C language or Intel assembly?

No. Although some level of experience in C programming and Intel assembly reading is required, you don't have to be an expert in this field. Basic knowledge about the syntax, data structures and function calling convention is enough during the course.
For refresher check these resources:

How can I get an invoice?

You can get an invoice after you purchase the course.

After logging into your account, first go to Settings and edit Address (including business details like company name and tax ID). Then save and go to Billing and just download the invoice.

How to change VAT rate?

When you are registering in the course, you can choose VAT rate appropriate for your country (if you are from EU). After you supply your email, the system will present you a price with suggested VAT rate, and, if a tax rate is inappropriate or you do not qualify for VAT because of your tax residence, adjust the rate by clicking on update and chose your country of residence.

Can I get a Certificate of Completion?

When the course is finished, Certificate of Completion will be generated automatically. The notification email will be send with CoC access details.
To include your name on the certificate, please provide your first and last name in your profile Settings.

Can I share my account with others?

Unfortunately, we consider this unfair and therefore it is prohibited. We try to keep our prices affordable so that the course can reach as many students as possible.

Legal Disclaimer

All the materials are for educational and research purposes only.

Do not attempt to violate the law with anything contained in materials produced by SEKTOR7. Neither administration of this server, the authors of this material, or anyone else affiliated in any way, is going to accept responsibility for your actions.

By using institute.sektor7.net and its contents, you accept that you will only lawfully use it in a test lab – with devices that you own or are allowed to conduct penetration tests for your customers and clients.

Do not abuse this material. Be responsible.