# Hack Microsoft Using Microsoft Signed Binaries | Full Document

**URL:** <https://onehack.st/t/hack-microsoft-using-microsoft-signed-binaries-full-document/100720>\
**Category:** Tutorials & Methods\
**Tags:** hacking, windows\
**Created:** [August 14, 2020, 9:58am UTC](https://onehack.st/t/hack-microsoft-using-microsoft-signed-binaries-full-document/100720 "2020-08-14T09:58:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [August 14, 2020, 9:58am UTC](https://onehack.st/t/hack-microsoft-using-microsoft-signed-binaries-full-document/100720/1 "2020-08-14T09:58:54Z")

</div>

Hack microsoft using microsoft signed binaries - Pierre-alexandre braeken

> This document is the supporting white paper for the presentation hack microsoft using microsoft Signed binaries at black hat asia 2017 in singapore.

* * *

## Abstract

In Windows, the user-land and kernel-land memory can be accessed and modified using  
Windows APIs. Our proof-of-concept will show how to access Windows memory without using  
complex programming language and without calling Windows APIs.

The signed debugging tools for Windows provided by Microsoft will help us abuse the Windows  
operating system due to them being trusted by default because they are signed with  
sha1/sha256 Microsoft certificates.

We chose PowerShell for its prevalence in corporate environment instead of using a basic script  
language (e.g.: Windows batch). In addition, the method we will show doesn’t use Windows API  
reflection thus hindering substantially its detection and mitigation.

Presently, WCE and Mimikatz already reveal passwords from Windows memory. Nevertheless,  
there is no other tool using the approach of PowerShell piloting a Microsoft Windows debugger  
to achieve this goal.

Furthermore, we will show different techniques to manipulate the memory in user-land and  
kernel-land contexts using this concept.

How “deep” can we dig into the Windows memory just by using a debugger?  
KEYWORDS: debugger attack, offensive PowerShell automation, kernel security, process  
injection, DKOM

 ![image](https://onehack.st/uploads/default/original/3X/f/e/fe114e1a499730b666f2560a260bb424bda0b142.png)

> **[asia-17-Braeken-Hack-Microsoft-Using-Microsoft-Signed-Binaries-wp.pdf](https://blackhat.com/docs/asia-17/materials/asia-17-Braeken-Hack-Microsoft-Using-Microsoft-Signed-Binaries-wp.pdf)**
>
> 1265.64 KB