IronPython… OMFG
Introducing BYOI Payloads
(Bring Your Own Interpreter)
© Black Hills Information Security
@BHInfoSecurity
Whoami
• Marcello (@byt3bl33d3r)
• Work for BlackHills InfoSec
• I gots some sparkly pieces of paper (a.k.a Certs)
• https://www.github.com/byt3bl33d3r
Come see me at my booth/table for some BHIS swag!
Agenda
© Black Hills Information Security
@BHInfoSecurity
• Motivation
• Some Key .NET Framework Concepts
• Embedding Interpreters/Engines
• Some BYOI Payload Examples & Demos
• Weaponizing BYOI payloads in under 2 min
• SILENTTRINITY
• Detection
• Q&A
Motivation
© Black Hills Information Security
@BHInfoSecurity
1. Offensive PowerShell tradecraft == Zombie
2. C# tooling migrations has operational disadvantages
3. I really like scripting languages
4. I like developing ”weird” tools & tradecraft
5. I’m lazy
© Black Hills Information Security
@BHInfoSecurity
WTH is a .NET Assembly??
