2018 Next Gen AV vs My Shitty Code by James Williams

### Overview In this talk, penetration tester James Williams shares an offensive post-exploitation technique for bypassing modern "next-gen" antivirus (NGAV) products without resorting to traditional payload encoding. Motivated by the need to execute shells on restricted red team engagements, Williams developed a custom tool (referenced in demos as "Inception") that uses C# and Microsoft Roslyn to fetch, compile, and execute code entirely in memory.

### Key Topics - **Next-Gen Antivirus Evasion**: Overcoming endpoint protection engines that actively flag or quarantine traditional payloads such as Metasploit Meterpreter. - **In-Memory Compilation with Roslyn**: Utilizing C# compiler services to build C# source code dynamically in memory without saving compiled payload binaries to disk. - **Staging and Reflection Execution**: Fetching AES-encrypted code over the network, decrypting it, compiling it into a memory stream, and invoking execution via .NET reflection. - **Sandbox and Environment Evasion**: Implementing baseline checks using logic derived from the "check please" project to ensure execution only takes place on legitimate target systems.

### Technical Details The attack pipeline functions via a standalone stager named `update_service.exe`: 1. **Sandbox Detection**: Prior to payload execution, the stager uses checks from the open-source tool "check please" (such as verifying minimum USB drive presence and ensuring multiple web browsers are installed beyond default Edge) or optionally enforcing domain join status. 2. **Payload Generation**: A Python script merges unencrypted template code containing placeholder tags with shellcode produced via `msfvenom` (configured with an HTTP payload). The script creates a unique random AES key, encrypts the template, and makes it available over a simple network server (such as Python's simple HTTP server). 3. **Network Staging & In-Memory Build**: The client stager pulls down the base64-encoded, AES-encrypted payload, decrypts it in memory, and passes the code string to Roslyn. Roslyn compiles the source into a .NET `MemoryStream`. 4. **Execution & Injection**: Using .NET reflection, the stager loads the assembly and calls its static entry point (`assembly type TCP met` / process program). The compiled payload utilizes `kernel32` APIs to inject the Meterpreter shellcode into memory and initiates the staging back to the Metasploit listener. 5. **Packaging Challenges**: To prevent dropping numerous required .NET DLL dependencies onto disk, the tool embeds all assemblies into a single executable using Fody. This produces a monolithic executable of roughly 10 MB.

Demonstration videos confirmed successful shell execution against Windows 10 targets running Windows Defender alongside McAfee Endpoint with Adaptive Threat Protection, as well as CylancePROTECT.

### Takeaways & Defenses Williams emphasizes that this approach is a post-exploitation method rather than an initial exploit or zero-day. Defensive recommendations include: - Enforcing endpoint monitoring and alerts on anomalous, unsigned large binaries (such as unexpected 10 MB executables) landing on endpoints. - Inspecting network connections for atypical staging traffic, even if encrypted via HTTPS. - Recognizing that antivirus should only be treated as one layer in a defense-in-depth architecture rather than an absolute barrier.