Dark Side Ops I
https://silentbreaksecurity.com/training/dark-side-ops/
https://www.blackhat.com/us-17/training/dark-side-ops-custom-penetration-testing.html
A really good overview of the class is here https://www.ethicalhacker.net/features/root/course-review-dark-side-ops-custom-penetration-testing
I enjoyed the class. This was actually my second time taking the class and it wasn't nearly as overwhelming the 2nd time :-)
https://silentbreaksecurity.com/training/dark-side-ops/
https://www.blackhat.com/us-17/training/dark-side-ops-custom-penetration-testing.html
A really good overview of the class is here https://www.ethicalhacker.net/features/root/course-review-dark-side-ops-custom-penetration-testing
I enjoyed the class. This was actually my second time taking the class and it wasn't nearly as overwhelming the 2nd time :-)
I’ll try not to cover what is in Raphael’s article as it is still applicable and I am assuming you read it before continuing on.
I really enjoyed the VisualStudio time and building Slingshot and Throwback myself along with getting a taste for extending the implant by adding the keylogger, mimikatz, and hashdump modules.
Windows API developers may be able to greatly extend slingshot but I don't think I have enough WinAPI kung fu to do it and there wasn’t enough setup around the “how” to consistently do it either unless you have a strong windows API background. However, one of the labs consisted of adding load and run powershell functionality which allows you to make use of the plethora of powershell code out there.
There was also a great lab where we learned how to pivot through a compromised SOHO router and the technique could also be extended for VPS or cloud providers.
Cons of the class.
The visual studio piece can get overwhelming but it definitely gives you a big taste of (Windows) implant development. The class material are getting slightly dated in some cases. A refresh might be helpful. More Throwback usage & development would be fun (even as optional labs).
DSO II
https://silentbreaksecurity.com/training/dark-side-ops-2-adversary-simulation/
https://www.blackhat.com/us-17/training/dark-side-ops-ii-adversary-simulation.html
Lab one was getting a fresh copy of slingshot back up and running and then setting up some additional code to do a powershell web cradle to get our slingshot implant up and running on a remote host. Similar to how metasploit web delivery does things.
Lab 2 was doing some devops to set up servers, OpenVPN to tunnel traffic, and adding HTTPS to our slingshot codebase.
Lab 3 was some Initial activity labs (HTA and chrome plugin exploitation)
Lab 4 was tweaking our HTA to defeat some common detections and protections. We also worked on code to do sandbox evasions as it’s becoming more common for automated sandbox solutions to be tied to mail gateways or just for people doing response.
Lab 5 whitelist bypassing
Lab 6 was doing some profiling via powershell and using slingshot to be able to do checks on the host
Labs 7-9 building a kernel rootkit
Lab 10 persistence via COM Hijacking and hiding our custom DLL in the registry and Lab 11 was privilege escalation via custom service.
Final Thoughts
I enjoyed the four days and felt like I learned a lot. So the TLDR is that I recommend taking the class(es).
Criticisms:
I think the set of courses are having a bit of an identity crisis mostly due to the 2 day
format and would be a much better class as a 5 day. It is heavy development focused meaning you
spend a lot of time in Visual Studio tweaking C code. The “operations” piece of the course definitely
suffers a bit due to all the dev time. There was minimal talk around lateral movement and the whole
thing is entirely Windows focused so no Linux and no OSX. A suggestion to fix the “ops” piece
would be to have a Dark Side Ops - Dev and Dark Side Ops - Operator courses where the dev one
is solely deving your implant and the Operator course would be solely using the implant you dev’d
(or was provided to you). The Silent Break team definitely knows their stuff and a longer class
format or switch up would allow them to showcase that more efficiently.
Lab 3 was some Initial activity labs (HTA and chrome plugin exploitation)
Lab 4 was tweaking our HTA to defeat some common detections and protections. We also worked on code to do sandbox evasions as it’s becoming more common for automated sandbox solutions to be tied to mail gateways or just for people doing response.
Lab 5 whitelist bypassing
Lab 6 was doing some profiling via powershell and using slingshot to be able to do checks on the host
Labs 7-9 building a kernel rootkit
Lab 10 persistence via COM Hijacking and hiding our custom DLL in the registry and Lab 11 was privilege escalation via custom service.
Final Thoughts
I enjoyed the four days and felt like I learned a lot. So the TLDR is that I recommend taking the class(es).
Criticisms:
I think the set of courses are having a bit of an identity crisis mostly due to the 2 day
format and would be a much better class as a 5 day. It is heavy development focused meaning you
spend a lot of time in Visual Studio tweaking C code. The “operations” piece of the course definitely
suffers a bit due to all the dev time. There was minimal talk around lateral movement and the whole
thing is entirely Windows focused so no Linux and no OSX. A suggestion to fix the “ops” piece
would be to have a Dark Side Ops - Dev and Dark Side Ops - Operator courses where the dev one
is solely deving your implant and the Operator course would be solely using the implant you dev’d
(or was provided to you). The Silent Break team definitely knows their stuff and a longer class
format or switch up would allow them to showcase that more efficiently.