Offensive Debugging: .NET Poops of Gold

The talk treats offensive forensics as using memory forensics to locate credentials and other valuable data that open up further attack paths during red team and penetration tests. The speaker argues that debugging work sits behind many offensive tools, and he lays out an attacker's mindset: inventory what is available, define the end goal, and connect the two.

The middle of the talk focuses on analyzing .NET memory dumps with WinDbg and its managed-code extension, alongside decompilers for reading the target application's source. Using a sample Azure Key Vault client, the speaker lists heap statistics, filters object types, and follows object references to reach secret values. The encryption key was not visible as readable text, so he traces the AES-GCM implementation in the framework source to its internal key blob structure, searches memory for that header, and recovers the raw key. He applies the same approach to a PowerShell session dump, where command history objects expose previously run commands.

The closing section demonstrates Turd Shovel, a Python command-line tool that loads a dump through ClrMD, filters object types, dumps objects as JSON, and extracts raw memory bytes without manual clicking. The main takeaway is that plain string searches miss structured binary secrets such as keys, and that workstation and server dumps can still yield valuable credentials. Large dumps are costly to query, so selective searches work best.