Weaponizing the Windows API
David Maloney explores weaponizing the windows api at DEF CON 20, examining metasploit and practical defenses.
Summary
Architecture and Background
Copy of the slides for this talk are here: Weaponizing the Windows API with Metasploit's Railgun David "thelightcosine" Maloney Software Engineer, Metasploit Rapid7 No part of the Metasploit Framework has been shrouded in more mystery and confusion than the Railgun extension. Railgun is one of the most powerful tools in the Metasploit arsenal when it comes to Post Exploitation.
Vulnerability Analysis
In this talk we will examine what Railgun is, and how we can use it to turn Windows completely against itself by weaponizing the Windows API libraries. We will demystify Railgun by explaining exactly how it works under the covers and how you can use it to create powerful post modules.
Exploitation and Demonstrations
David "thelightcosine" Maloney is a Software Engineer on the Metasploit Team at Rapid7. Before joining the team, he was a frequent contributor to the open source side of the project.
Remediation and Defensive Strategies
As a contributor he specialized in Post Exploitation. Before Rapid7 he was a Penetration Tester, most recently for Time Warner Cable. David is also one of the founders of Hackerspace Charlotte in Charlotte, North Carolina. Twitter: @thelightcosine
Related talks
Main Stage·39 min
Matthew Toussain · Christopher Shields
Matthew Toussain and Christopher Shields details copy of the slides for this talk are here:.
Main Stage·28 min
Nadeem Douba
Nadeem Douba explores sploitego - maltego's (local) partner in crime at DEF CON 20, examining metasploit and practical defenses.
Main Stage·31 min
Paul Haas
Paul Haas explores advanced format string attacks at DEF CON 18, examining metasploit and practical defenses.