Hijacking Arbitrary .NET Application Control Flow
Topher Timzen and Ryan Allen demonstrate runtime hooking and control flow redirection inside compiled .NET assemblies using CLR profiling APIs.
Summary
Architecture and Background
This speech will demonstrate attacking .NET applications at runtime. I will show how to modify running applications with advanced .NET and assembly level attacks that alter the control flow of any .NET application.
Vulnerability Analysis
New attack techniques and tools will be released to allow penetration testers and attackers to carry out advanced post exploitation attacks. This presentation gives an overview of how to use these tools in a real attack sequence and gives a view into the .NET hacker space.
Exploitation and Demonstrations
Topher Timzen has had a research emphasis on reverse engineering malware, incident response and exploit development. He has instructed college courses in malware analysis and memory forensics while managing a cybersecurity research lab.
Remediation and Defensive Strategies
Focusing on .NET memory hijacking, he has produced tools that allow for new post exploitation attack sequences. Topher is currently a Security Researcher at Intel.
Related talks
Main Stage·48 min
Alexandre Borges
Deep-dives into .NET CLR internals to equip analysts with techniques for reversing obfuscated .NET malware families.
Main Stage·39 min
Helvio Carvalho Junior
HookChain technique for dynamically altering API call sequences and hooking mechanics to bypass EDR telemetry in memory.
Black Hat·37 min
Industry experts analyze emerging threats surrounding Back To The Epilogue: How to Evade Windows' Control Flow Guard with Less than 16 Bytes.