BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: A Provider for the MOFia - Distributed Post-Ex Capab
 ilities\n   Tags: DEF CON Official Talk | Demo 💻 | Tool 🛠\n   When: 
 Friday\, Aug 7\, 11:30 - 12:30 PDT\n   Where: LVCCW Level 1 Hall 3 904 (Ma
 in Track 4) and DCTV-4 - [1]Map\n\n   Description:\n\n   From time to time
  I take another pass at WMI to see if there's\n   anything left in it that
  hasn't been picked over. For most of the last\n   decade\, offensive WMI 
 has meant Win32_Process Create and event\n   subscription persistence. Def
 enders built their detections around\n   those two primitives\, EDR vendor
 s optimized for them\, and the rest of\n   WMI mostly got ignored.\n\n   T
 he provider architecture is one of the parts that got ignored. This\n   ta
 lk is about turning it into a distributed post-exploitation\n   framework.
 \n\n   The core technique is remote installation of custom WMI providers\n
    without dropping anything over SMB or WinRM. To get there\, I had to\n 
   reimplement the parts of mofcomp.exe that handle MOF parsing and\n   pro
 vider registration\, and push the resulting object instances over\n   the 
 wire using the MS-WMIO binary protocol.\n\n   Getting the DLL onto the tar
 get needed its own primitive\, so along the\n   way I found that there are
  existing WMI classes on every supported\n   Windows version that can be a
 bused for arbitrary file upload and\n   download. As far as I can tell tha
 t hasn't been published before. Once\n   a provider is installed\, it runs
  inside WMIPrvSE.exe\, which is a very\n   different execution context fro
 m spawning cmd.exe through\n   Win32_Process. The provider library I'm rel
 easing covers a series of\n   post exploitation primitives.\n\n   SpeakerB
 io:  Steven Flores\n\n   Steven enjoys offensive research\, tool and capab
 ility development and\n   is currently employed at SpecterOps doing his fa
 vorite things.\n\n   '\n\n   1. #LVCCW_Level1_Hall3\n\n\n
DTEND:20260807T193000Z
DTSTART:20260807T183000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 904 (Main Track 4) and DCTV-4
SUMMARY:A Provider for the MOFia - Distributed Post-Ex Capabilities
END:VEVENT
END:VCALENDAR