All language subtitles for [English (auto-generated)] EXECUTE MALICIOUS CODE in WINDOWS Using AMSI BYPASS Techniques! [DownSub.com]

hey greetings everyone welcome back

today we're going to take a look at

something really cool to

bypass windows defender called

mc bypass it's going to be really cool

but before we get started

please do make sure that you hit the old

subscribe button

and follow me on instagram i'm out there

so check me out

just got that started uh hit like as

well and as always i love having

conversations with you good folks out

there

in the comments section so make sure you

comment for me as well

that said let's jump into this idea

that is emcee bypass i know it sounds

kind of like uh it sounds cool

i gotta be honest like for me it just

sounds kind of cool like i hear amc

bypass

almost like i'm getting away with

watching movies that i should you know

amc but it's not amc it's amsi

or this is the anti-malware scan

interface that's found

inside of the windows operating systems

as it were right and this will

actually this is this is kind of a

really neat thing i just looked at it

very preliminarily i don't want to

i don't want to pre-game too hard for

you for you out there i want us to kind

of like go down this road together i

want to learn about this

this kind of came up uh as i was hanging

out with the one mr john hammond

and he was doing some uh uh malware

analysis analysis i guess is the right

way right malware analysis

um he was analyzing malware and he

talked about amc bypass and he just kind

of fleeingly went by and he was

explaining that the

the malware that he was looking at was

doing that i thought oh that's

interesting

i'm not 100 i understand about the idea

of uh

malware and antivirus evasion techniques

but i'm not familiar

really with this so i need to get

schooled up on that so that's what i'm

going to take a look at today let's get

into the computer here

i can find my mouse there we go i just

googled it really quickly

i i've nothing more than that and that's

what i was looking at when i was like

microsoft has developed the amc or

anti-malware scan interface

as a method defend against common

malware execution

cool i mean that's that's pretty sweet

actually that's that's neat that they

put that in their operating system

and they thought about it probably

because

they've been known to have an issue or

two in the past in the past right

and they are definitely a targeted

operating system

so it just makes sense that they would

be doing that and the people at

microsoft have been working

uh toward more robust security i'm not

saying that they're successful in that

uh they can be and they cannot be it's

all up to us as the hackers to um

to be schooled and skilled in the

necessary tradecraft

to get around this stuff we're red

teaming it up so i'm going to click on

this first one and just see where that

takes this is the number one with the

bullet

and this is found at pentest

laboratories dot com forward slash 2021

forward slash o five four slash one

seven four slash amc

bypass dash methods that's right there

you go

all right microsoft has developed this

as a method defend against common

malware execution and protect the end

user

uh the default windows defender

interacts with the amc api

to scan powershell scripts vba macros

javascript uh and scripts using the

windows script host technology

during execution to prevent arbitrary

execution of code

that does sound like uh well for us if

we're doing some red teaming or hacking

ethically of course

uh that would be a good time but it's

not a good time for people that are

actually running windows they don't

we don't want people to be able to

bypass that stuff or run uh

arbitrary execution of code

so it says however other antivirus

products might contain support for amc

so organizations are not restricted to

the use of windows defender

so i guess that's why they built this so

that they can

oh okay you don't want to run windows

defender that's fine

i guess you know how microsoft is they

like you to just use everything

microsoft then i get that right they're

they're a company they want to make that

money um and why go anywhere else when

they offer a very valid

the winner's defenders not bad i'm not

i'm not going to tell you

any otherwise so but if you're running

something else and you want to interface

with this system

that's fine that's what amc is all about

so really cool let's see here how mc

works

quick and dirty here when a user

executes a script or initiates

powershell

the ampsi.dll is injected into the

process

memory space oh i always love this

technical jargon that gets in here just

twirls my beanie right i have a good

time

when we talk about this stuff it just

makes me happy to hear it

i know i'm like uh me and my friend

justin used to talk about uh doing a

show called tech next

where we would be like too very

technical because we're both very

technical

and we're both from very rural parts of

um i guess we are considered a redneck

you know or we know rednecks we grew up

with rednecks

um it's just funny play on words we

don't take it too seriously right

uh let's see here prior to the execution

of the following two apis

are you that's why you see the voice hey

there man because i grew up when people

talk just like this

that's how a lot of people talk and it'd

be just funny is if one of them good old

boys out there knows how to change the

tire and he knows about dll injections

and amc bypass

right so i'm sorry i digress prior to

execution the following two apis are

used by the antivirus to scan the buffer

and strings for sign of mount signs of

malware

so we've got this amc scan buffer let's

make sure you guys can see that

an amc scan string if a known signature

is identified

execution doesn't initiate and mess a

message appears that the script has been

blocked

by the antivirus software the following

diagram illustrates the

amc scanning so that's cool here's a

nice little hey you've got this

powershell process and

into the mcdll it goes it runs these two

amc scan string

ansi mcscan buffer if

a windows defender detects a signature

you get a lovely little piece of red

text that tells you

how horrible you are and you should not

run that

so i wanted to test this and i know that

this can be

extremely sensitive like anything will

move the needle

on this stuff because i've played around

with it a little bit before so i'm gonna

run

powershell power shell yes bring it

all right so here's powershell can i

just like control plus that no i can't

i can shift control oh i don't know how

to power shell increase

font so i'll go to was its edits

no properties there we go cursor size

font that's what we're looking for

let's go to 20. okay then there we go

now we got some action

now we can see i'm just going to do that

so it full screens

all right so in my i think i put in my

documents directory vr

yeah so i was playing around was like i

was gonna get me me cats and i was like

can't you just

run something and you'll notice this has

zero length in it there's there's no

data in there if i

type if i can type

uh invoke me cats you'll notice i'm

still i'm still getting blocked there's

nothing in that file

it's just a file named invoke dash

minicats.ps1

but you'll see right here it's saying

this script contains malicious content

and has been blocked by your antivirus

software

that is the amc

business chucking it over to windows

defender windows defender goes

if i'm not mistaken correct me if i'm

wrong good sir

but i do believe that invoke me me cats

is bad

and you shouldn't run it and i'm like

well there's nothing really there but

like i said this thing can be pretty

sensitive

so there it is uh in effect we've seen

it work

just minimize this we'll be back to here

now let's take a look at evasions

what can we do to get around that so

let's take a look uh

microsoft emblem amc yeah yeah yeah

offensive tooling also supports amc

bypasses that could be used in red team

engagements

prior to any script execution but manual

methods could also be deployed

number one powershell downgrade

i mean it sounds cool like you know it

sounds big but it's just oh we're just

downgrading

and you look you it says that even

though powershell 2.0 has been

deprecated

uh microsoft hasn't removed it from the

operating system well there you go

like i said they're trying you know

they're they're trying hard don't

don't don't come down on them too hard

but here they are

saying this is dangerous and it doesn't

look at this older versions of

powershell doesn't contain security

controls such

as amc protection and could be used as a

form of evasion downgrading the

powershell version to an older version

is trivial and requires the execution of

the following command which is

powershell version 2. so let's give that

a shot

i don't know if this will work but we'll

see i think it will

uh oh it's cls here right yeah okay so

it is

you know i'm still gonna bump that font

for you good folks i still find that to

be

it seemed to make the window bigger and

not necessary oh that's the size because

i'm a fool even though i'm in fonts

very strange isn't there like a terminal

i thought there was like an option to

actually change the size of the font

i thought that was it 24

let's try that it's full screen yeah

it's a little better a little better

all right so we've got powershell dash

version 2 if i'm not mistaken

bing oh it is not installed

oh oh because i don't have the net

framework okay

that's interesting so i need version

2.05727 okay

so well you know what that tells me is

my machine if someone tried to do this

bypass

it would not work because i don't have

the dot

net framework install um

and that is that version 2.0 now that's

just because this is a fairly new pc for

me

i haven't needed to have net framework

installed at least not for

anything i can remember but it doesn't

say it's that version 2 isn't installed

but it is required to run it

so for any reason i install something

that requires the

net framework of v2o and maybe other

versions would

suffice i'm actually oh you know what

stop me just see if we can get some i

want to check the

let me go to you're like what are you

doing you're talking crazy man

i know i'm like my thoughts are jumping

all over the place i'm going to open the

control panel

uh i'm going to do that by clicking the

right thing

and control panel and i'm going to go to

the programs and features

and then go to look and see if i have

any

net framework installed it does not look

like it

let's go to windows features on or off

does that and maybe in there

net framework 4.8

but not like net framework 3 or

net framework 2. let's see if we can

install that i'll see here

download.net 2.0

let's see here there it is download

that's

let's get it going i can always

uninstall it right you're like you're

making your system less secure yes i

know

it's all for the cause right it's all

for learning and understanding and

trying to be better at this stuff right

so i want to download yes

english is rights that all looks good

hit the download

come on give it to me yeah save it

give it yeah you can see where i was

trying to download uh

uh powersport and brave was like no you

don't

you don't play with that stuff i mean

you crazy

you out of your mind i'm like yeah kinda

a little bit

i'm scared i'll do what i want open

let's see your show and folder

fire that off get that installed

yes such a pretty chime there you go all

right so this is telling me

oh it includes 2.0 so if you if you

install the

net framework 3.5 it includes 2.0 and

3.0

yes go install and honestly.net 35 is

probably something i would have

installed eventually anyway

just for all the random shenanigans i do

i probably should be doing this all in a

vm but

what are you gonna do right now like i

said i'll uninstall it when i'm done

uh or i'll uninstall version 2.0 of

powershell

which is probably the more the like the

better option

just get rid of the 2.0 powershell you

gotta worry about it then i can have

net whatever i want as long as there's

no known vulnerabilities which i don't

know any of

but uh yeah this is fun we're just

waiting for this to

download almost there

we're almost at the station but

hopefully once we get this installed

this little downgrade attack

right might bring us to the to the

mountaintop

as it were come on download the files

you can do this thing

man i should have brought a cup of water

in here i'm a little a little parched

today

a little i've been speaking i had a

webinar today then i

filmed a youtube asset for uh work

uh but it was really cool because it's

gonna be a ctf walkthrough so it's gonna

be fun

it's gonna be good stuff trying to bring

you good folks out there all the goods

that's that's my that's my way that's

how i do things right

all right come on that i hate when it

gets to that little

tiny bar you just gotta go

just just i feel like office space right

when he's trying to get out of work

and he's like i want to come on you know

and then the bar fills in and then

another bar shows up he's like

you got to be kidding me all right we've

got to be close

we've got to be almost there

please simon says go i never would have

thought this would have been like

this difficult to do

you know what though i'm just being

impatient when you got the camera

running

and you're trying to show people stuff

the last thing in the world you want is

to wait

for a file to download which is exactly

what's happening now

um yeah

yeah there's that so what i'm going to

do is oh

oh it's installing hey i think all you

have to do is

threaten to pause the video

and then it will go yeah i'm gonna pause

that video

good and hard and man be paused all day

long

i'm just trying to coax it into into

installing

anyway a couple of you asked about my

guitars while we're waiting

uh i've got quite a few always try to

rotate something different up there

i don't have a ton of stuff but i have a

few up there right now

paul reed smith sc that i bought way

back in the day love that guitar

i use it for playing like alternate

tunings that one specifically

i've got others as well but maybe i'll

throw a shout out to the old guitars in

the back and you can't see them over

here with

there's amps that way

can you see that amps are that way oh

you can't see the guitar because i've

got the computer screen up

close up me yeah there it is there's the

guitar

that's the prsse that i bought

two thousand like

six somewhere in there yeah something

like that

but there we go we got this installed

we'll get back to the computer no more

guitar stuff

all right so that is installed let's see

if that

what is this what is this oh i i express

setup install using compatibility

settings whatever you need man just get

it done

yes do the thing

this thing always acts like is uh did

the program work collectively

i don't know sure worked fine

scared i don't need the download thing

anymore and let's bring up powershell

let's try it one more time hey hey

well look at there now that we're in

here

right we got the invoke mimi cats i can

do the same thing type

invoke mimikatz oh and it ran oh that

was too stupid easy

okay that was an easy one so here's the

thing

if uh yeah you can downgrade into

powershell version 2 that you can run

dangerous things because it's not doing

an amsi check

fyi and that was kind of stupid easy to

do

uh wow that was kind of cool actually

all right let's move on we got one in

the back not that i'm gonna demo every

one of these things

uh i know there's a few of them in this

list because i saw how

big the scroll bar is and the fact that

it's being numbered

seems to indicate the fact that there

would be more than one um

let's go to the let's go to the next one

because that was ridiculous

uh let's see here base64 encoding

okay oh blah blah blah to prove that if

base64 is used on strings

the amc utils and amsi init

yeah amc init failed that trigger ampsi

and decoded at runtime could be used as

an evasion defeating these signatures of

microsoft

this technique prevents mc

prevents mcscanning capability for the

current process

by setting the amc failed flag or

mcinnet fail flag

okay so i'm taking that to mean

that if

you set this or you use basin

64 all right so here's the original amc

bypass rough.assembly to get type

system dot management automatic amc

utils get field

and there it is so basically you're

saying

that amp c didn't start

right amc in it failed so you're

flagging

that amc just didn't work so just go

ahead and run this so don't worry about

amc checking because it didn't work

anyway

so i guess you go on to the next step

which is run this code

and then here's a base64

version of that which i guess is the the

bypass

you base64 encode this stuff so you can

see this text.encoding

right and then oops a little too far

unicode.getstring was that back here at

all

no so we got to see

what it's doing here from base64 string

so you just start popping the base64

equivalence

of c all this stuff right here

is actually like base64c dot get field

and then text encoding unicorn string

get blah blah blah blah

is going to be right there's the base

64.

and that's going to be all this stuff

which is normally like hey don't do that

i might give you a problem but here

because it's basic c4 encoded we don't

get that problem we get a bypass

um i wonder if that'll work

oh is it is it actually running anything

or is it just like how do you run this

all right invoke mimikatz so i'm looking

at there

i don't have a sorry you can't really

increase

the the size of the picture i'll read it

to you though

it looks like it's throwing that stuff

at it i'm looking for where you actually

oh you just run that string okay i'm

gonna double click that

copy and then here

fire off oh it didn't like that did it

no it did not

oh antivirus found threats what does it

find

what does it hate what is it not a fan

of

all right maybe it's in like the

pc could be at risk i don't want to scan

so it just didn't like that okay

so it's not that it found like the

invoke memecats.ps1 thing that i made

it just did not like that code even

though

that was base64 encoded that was the

that was the bypass this one

didn't seem to have worked at least not

on my system that doesn't mean it won't

work

it just means it didn't work here could

work somewhere else

all right uh let's see here let's get a

move on here

get out of my face all right hooking

number three

hooking um that's an interesting choice

of words

uh tom carver created a proof a concept

in the form of a dll file which evades

amc by hooking into the ampsi scan

buffer function

the amc scan buffer will then be

executed with dummy parameters

the dll needs to be injected into the

powershell process

which the amc bypass will be performed

okay

so you got the simpleinjector.exe which

i don't have

and then you invoke powershell ue and

then mchook.dll

right that's what it looks like yeah

it's like a one big one-liner

kind of thing and then off it goes

i guess you would have to go get that

and download it i assume that's what's

going on

that texas number well that was a quick

one um i don't see where that

is though

i know that's not this this is just the

the commands to execute

and then here is like a picture of it

working

try the new cross-platform powershell

what is all this okay

yeah got process safety for powershell

so yeah this is a

this looks like a compiled program that

does this you give it all the necessary

items

and you got your bypass all right

memory patching number four daniel

duggan

really is it dugan or duggan i think

it's duggan with

two g's i would assume it's still good

he released an amc bypass which patches

the ampsi scan buffer function in order

to return

always amc result clean which indicates

that no detection has been found

the patch is displayed in the following

line so

you run this and then the bypass has

been released in c sharp and powershell

the dll can be loaded

and executed with the following commands

okay okay so you need to get

the bypass downloaded for this to work

and then it will run and here it is like

showing you how invoke mimics doesn't

work

and then they do system reflection that

assembly load file

and then there's this amc bypass dll

which i don't have a copy up

either i might be able to go here let's

check that oh rasta mouse

is this it no this is not cs

but maybe you have to compile that

yeah maybe so that's a little too much

work i'm not getting that deep in the

weeds i just want to be aware of it

maybe that would be a way it would go

down a little bit further

in the future but i'm not going to worry

about it right now all right what else

do we got here

uh that was number four oh there's a

little more here by default powershell

version is getting flagged

the amc trigger could be used to

discover strings that are flagged by the

amc making calls to mcscan buffer

following lines have been identified and

will need to be obfuscated

so there you go don't forget to

obfuscate that goodness

how did they do it they just kind of

concatenated things together

a standard trick of the trade

for those of you who are i don't mean to

talk past you

sorry concatenation is just the taking

of

things and smashing them together so

instead of having uh what was the word

here so like

amc trigger is probably gonna get picked

up and go hey that's wrong you can't do

that you get the red text and you you

know die inside a little

uh what i can do is i can

concatenate or smash the or kind of

break apart and then

as it runs it'll put it all back

together so i take

their example is to take

amsi plus scan plus buffer

yeah yeah i guess that's not in the

uh not in the actual name or the

commands i'm sorry

having trouble today my brain just ain't

working

um but then there's maybe that's inside

of the actual uh asb bypass

all right then there's obfuscated code

look at this

the code contained within the powershell

script will evade amc and perform memory

patching is this

it is this the whole thing

um it could be

is this amc bypass or asb bypass dot ps1

i don't know guess what i'm gonna try it

i guess it's already done what am i

doing this is not how you do this daniel

go to

here grab that

copy and then

go to my folder go to here and then say

new

text documents and call this

what was it called a i hate when i can't

remember

what they call this thing i just can't

remember this

okay be that way get out of my way

because i can't see

what is going on

asb bypass sheesh

i'm horrible at this a s b

bypass and then change that to ps1

yes i'm sure i want to change it and

then we will edit it

and add all that why am i going to ise

that's not what i wanted

just want to do the i guess that's the

i'm gonna open with notepad okay there

we go

now we're talking here get this out of

the way get out of the way

let's see here go over here

grab this code copy

plop a property plop based

hopefully you didn't pick up those yes

it did

that's okay you can delete all that

bam all right file

save bam all right so now let's give it

a shot

see if this works

where did my powershell go did i close

it

sorry oh you know what it did probably

it probably closed on me

it was like no sir i'm done with this

all right

cd into documents dir

there we go dot slash asb bypass one

oh it didn't like that because running

scripts is disabled

for more information aha

that is true there is ways to get around

this though

uh yeah well you know what we're going

to add this to our little fun time here

and

it's been a while since i've done this

um

just because i've been doing other

things but let's see here

so run powershell

scripts or bypass

that's what i want bypass power shell

script restriction

it's like you can do an iex and no

profile this that and the other

15 ways to back there we go there we go

hey we're getting a two for one sale

today

not only are we learning how to bypass

amc but we're also learning how to

bypass

uh script restrictions so hey

execution policy i guess they call on it

yeah yeah yeah just give me give me the

goods so yeah i bet if we do a get

execution policy

get dash execution policy

it doesn't even let me run that has not

recognized oh

oh that's weird why did it do that get

execution policy oh there we go

restricted i i added an extra character

that was the problem

so yeah it's restricted and

we are going to yeah lab setup

you fun fun fun just show me the

bypasses

i know the one that i normally use is

probably in here because it's a pretty

standard

i just don't maybe just

powershell no profile pipe it into

powershell

no profile let's see if that works

all right so we want to run hey

come on man type there you go pipe that

into

power shell.exe

dash no profile didn't like that

okay it's not really the one i was

looking for oh yeah i forgot you gotta

throw like a

dash on the end of that still didn't

like it though all right

we we persevere

oh yeah you could totally make it a

web so this is like reaching out to a

web

assets uh download a powershell script

from the internet and execute it without

having to write it to disk

uh oh yeah maybe i think that's no p nop

is that

and then dash c i e x

maybe that would work powershell dash

knob dash c

i e well i don't know if iex will work

but

use the command switch

let's see here okay we'll try this

pretty simple looking one

um sorry uh how do we do that again

powershell.exe dash command

and then whatever you want to do

powershell exe dash command

all right powershell

dot exe dash command

and then is it a sp

okay oh no it's still saying running

scripts is disabled okay

man well maybe we've got 15 of them so

one of these have got to work

uh short command that's okay

use the encode command command

equals

right host blah blah blah blah blah

that's where your command goes

and then

so this is all getting put into like

variables

and then oh and then you encode it

into base 64.

that's fun okay

i guess i can just

i can just copy this copy

go here pop it in you'll notice it

freaked out

because it got me unexpected token bytes

and expression i don't know what's going

on there

i'm okay it didn't like that

like that at all well this is a learning

process ladies and gentlemen that's how

things go when you're learning the

computer security anybody tells you hey

you know it's easy just jump on

in water's fine it is the water is fine

we're glad to have you

but it can take a hot minute to like

figure stuff out

this ladies and gentlemen is the real

world you're seeing it live and in color

right in front of you um i don't know

why that didn't work it seems like it

would have worked

but maybe we need to do these things one

at a time because that's how they did it

so here's what we're going to do i'm

just going to back this up a bit

i persevere i don't give up

command equals uh

dot slash asb

by pass dot ps1

one and then bing do that

okay didn't mind that i'm just going to

read from the top up there

which is going to be dollar sign bytes

equals i guess i can just

copy this

um where do i need to end this at

yeah right there

copy that bing

back this up just paste it in ding

there we go then i will

do this

paste that in almost at the station

copy the last part copy and paste

oh cannot be loaded because running

scripts is disabled on this system

man i really thought that was gonna work

we persevere

moving on uh what else do we have invoke

command right yes the invoke expression

so git content i'm going to say forward

slash input expression

okay let's see if that works git content

and then the ps1 file and then pipe that

into invoke

all right get dash content i feel like

i've done this one before actually

a speed bypass pipe that into

um yeah invoke no not maybe cats

it's in right go back

i can never remember the invoke dash

expression

so bad at this expression

oh oh so we didn't get red text on that

and it came back as true that makes me

think that makes me feel like it

actually ran that

right because

that ran let's try that let's just give

it

what it did so we will uh what was it

doing

it was like oh it had like a run me dot

ps1

which i guess was uh just a printing of

yeah right host

bing bing okay

i think that ran uh

i'm just saying i'm gonna go with that

how do we verify that how do we i mean

the true value that comes back

makes me think this ran because there

was no output

it just said true i'm gonna go with that

i think that the invoke expression

worked

there it is again use invoke expression

get content bang invoke expression

did i see that twice or did i scroll up

the wrong way

bypass anyway looks like we got some

looks like that one ran

so if that one ran that means i got

execution

on my script

and there we go okay

back to amsi bypasses all right so

that's cool

oh right yeah because it ran that code

that was that whole

like crazy powershell

oh now that that's wrong oh yes it's

supposed to i'm looking at the picture i

don't know if you can see this

but when it ran mc bypass the return

value was true

now i can just run invoke mimi cats

um invoke mimikatz

dang cannot be loaded because running

scripts is disabled

but it didn't say it was like the devil

you know um what if we do the same thing

just get

content dot

dot slash sorry asb bypass

like invoke no expression

and i love their their autofill leaves a

lot to be desired

low dash x i know you could probably do

iex

just says true because i did the wrong

one

i'm a crazy person i want mimi cats

i want invoke mimikats

there we go yeah it ran

losing my mind hey i'm learning right

i've never done this before

this is my first time give myself a

break

right uh but that's cool so there we got

another bypass to work

nice a slightly different approach the

memory patching technique is to use

different machine language instructions

yeah yeah yeah that's cool alternative

by passwords by paul so there's like a

lot of this we're on

uh just to remind ourselves memory

patching

number four so there's a different

couple of different ways in which

we could do memory patching uh we

finally got one to work and that that

seemed to be great they gave us the

codes that helped

uh and now we're on to number five right

with a bullet

number five golden rings no forcing an

error forcing the amc initialization to

fail amc and it failed we've seen that

before

uh will result that no scan will be

initiated for the for current process

originally this was disclosed by mac

raber

and microsoft has developed signature to

prevent wider usage

avoiding to use thing avoiding

to use directly the strings

with the usage of variables that was a

weird sentence um

can evade amstee with the same method so

again

fire these off and it might work

sure um

can i just do this copy

slap that into here actually let me exit

out

and restart it so all that stuff goes

away

there we go come on come on come on

we tried to do things cd to documents

it is fun for us ctrl v

and then bam didn't like

something in there oh man it doesn't

like this like one liner business

that's okay that's all right we can do

it anyway

well i guess we'll have to do the old

copy pastes

bing thing and then no no

no no no no there we go hit that

and then this

and then that and then this

and then guess what yep yeah

hit disassembly one

copy paste hit it

hit this one with the field

copy paste hit it

and last but not least copy

paste edit now now what do we do

okay we've got all that stuff in there

once that's done

invoke mimikatz we will see

dot slash invoked demimi cats no you

don't

because running script is disabled on

this system

which is funny oh you know what we can

try to do

uh type do it like i did before

haha see it didn't it didn't give me a

problem

and he gave me a problem right so i'm

gonna just prove that that

worked by closing powershell helping

this back up

and cd into documents and then

type invoke beamy cats and you see now

it is blocked

because we didn't do the thing right

which was number five

remind me what number five was it again

forcing an

error interesting so

yeah great because we are initialized

we're forcing ampsy initialization to

fail so it can't run

therefore once that happens nah you know

working

that was a good one worked pretty well

since there is a signature for the ampsi

and it failed flag adam chester

discovered an alternate method which is

attempt to force an error in order

flag to be set in a legitimate way and

not in the console

this bypass allocates a memory region

for the amc context

and since the amc session is set to null

will result in an error okay this

discovery has been

described in the article using this

evasion without any obfuscation will

fail as microsoft has created signatures

is there obfuscation here no

is there obfuscation here obviously

versus yeah

yeah looks like we just grabbed this

copy and off we go we already know that

it didn't work here

so paste that in oh i got a feeling this

ain't gonna work but

whoa yeah i didn't like that so

i always love it when that thing happens

it's like hey what are you

doing you need to calm the hell down

like right now before i get upset

it's like yo hey i'm just i'm just a guy

learning here man don't get upset with

me

i'm gonna have some fun that's all it's

gonna be a good time

uh i didn't think so right so that was

fun okay so i

definitely saw that one and did not like

it

at all uh so number six this brings us

to number six man there are a lot of

these how many

are there registry key modification amc

providers are responsible for the

scanning process of the antivirus

just checking uh uh i'm sorry scanning

processed by the antibody of products

and are registered in the local in the

location registry to do it for the

windows defender display below

okay removing the register key of the

amps provider will disable the ability

of the windows defender to perform amps

inspection

and evade the control however deleting

the registry is not considered a

stealthy approach

if there's sufficient monitoring placed

i'm not going to delete that

because no right because uh but it's

good to know that it's there

you could probably i would almost

guarantee that one works

i don't know why i think that just my

gut feeling that if it's out of the

registry this just doesn't work anymore

and then you can just do whatever you

feel like doing

so but like they said that's kind of a

noisy way to go about it

so use with caution

if you are red teaming engagements

let's see here dll hijacking dll

hijacking this is like an oldie but a

goodie just for

you know it's been around a while dll

hijacking can we use debate amc from

userland oh that's cool

right uh it has been described by

sensepost

uh the only requirements is to re create

a non-legitimate amc.dll file and plant

it on the same folder as powershell

64-bit

which could be copied to a user-writable

directory the proof-of-concept code has

been released by sensepost and it's

demonstrated below

there's proof of code concept right and

then

you execute powershell

executing powershell outside of the

standard directory will load the amcdl

file which contains all necessary

functions to operate

however amc will not be initiated so

you're just basically going

yeah do everything except that ansi

thing don't like that so

let's just let them sleep they're tired

you know we don't need to get them

involved in this

we're just going to have a little fun

between friends and no one it's a

victimless crime right you want it you

won't be upset

uh so yeah that's cool

and then minor attack talking about this

and youtube don't worthy and alright so

there were six

i'm wondering if this is possible

i see that they've got

they have their own powershell scripts

is that what's going on here

so yeah that's what they're doing okay

so i'm going to try this

all right am i or is this like is this

powershell oh no this is

i'm sorry i'm not going to be able to do

this i don't have a c compiler

this is a compiled a dog because it's a

dll what was i thinking

um i would have to compile that and then

see if it will work but that's a cool

way to go about it

if you got a compiler compile the code

copy

the powershell.exe executable put it in

a user controlled area with the dll

make sure they're together run it and

you should be good to go

on the amc bypass so there we go i feel

good

right i feel like i've i've learned a

thing or two

hopefully you have as well today on

bypassing windows defender specifically

the ampsi

dll that tries to check and pass things

off to windows defender for that check

we had quite a few of these bypass

methods actually work for us

so hey there's that there were there

were six of them to go from i think we

probably executed four of them

um and they worked really well right

maybe we got three

it was three or four so fifty percent if

i

targeted you know 200 500 machines

i and let's say 500 and i got 250 that's

a lot

right that's a pretty good day at the at

the office right there

so really cool stuff i enjoyed that now

i've got a little extra

i know a little more right i'm feeling

i'm feeling frisky i'm feeling good

so hopefully it is well if you like what

you saw don't forget hit the subscribe

button

smash smash smash and then of course

like notification bell and like i said

in the beginning i now have an instagram

page

i've got somebody running that for me

but don't worry they're taking cool

content

putting it on there starting to build

that up so look for

that to become a more of a thing as we

continue on down the road having a good

time learning about cyber security

thanks for watching everyone and i will

see you next time