Teaching Old Shellcode New Tricks
Bypassing EMET and exploit mitigations to create improved Metasploit shellcode payloads.
Summary
Shellcode Evolution
Metasploit x86 shellcode has been defeated by EMET and other techniques. These mitigations apply not only to exploit payloads but also to non-exploit situations like binary payload generation and PowerShell deployment.
Mitigation Techniques
The presentation describes taking Metasploit payloads and incorporating techniques to bypass Caller/EAF[+] checks that defend against post-ASLR/DEP bypass attempts.
Automation
These techniques are merged together with automation to improve overall effectiveness. The result is improved payload generation that overcomes modern exploit mitigations.
Practical Application
The approach allows using improved shellcode in various scenarios beyond traditional exploit development, making modern payloads effective despite layered mitigations.
Related talks
Black Hat·1 hr 6 min
Security researchers examine technical aspects of PDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 2/2).
Black Hat·49 min
Security researchers examine technical aspects of PDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 1/2).
Black Hat·53 min
Jose Miguel Esparza
Analysts investigate attack surfaces and defenses concerning PDF Attack: A Journey From the Exploit Kit to the Shellcode Part 1 by Jose Miguel Esparza.