Tactical Exploitation: Attacking Windows

Attack Research (AR) is a boutique security firm located in Northern New Mexico which specializes in advanced information security, especially concerning targeted and sophisticated attacks. Rather than offering security-only focused solutions, AR works to understand the client’s business needs in order to tailor the best solution possible.AR brings extensive experience, operating in a broad variety of complex environments that include sensitive government networks and Fortune 500 companies ranging from embedded systems, finance, government, and avionics to oil & gas. AR is well known in the information security research community, having presented numerous times at Blackhat, Defcon, SANS and other similar security conferences.

Attack Research, LLC

Tactical Exploitation: Attacking Windows is Attack Research's unique approach to compromising Windows environments without relying on traditional exploits.  In this 2-day course students will become proficient in the skills necessary to compromise Windows environments using the same methods as real world attackers rather than compliance based penetration testing techniques. Skills to be covered include: host recon, network recon and credential hijacking as well as tricks for taking advantage of configuration and design flaws.
This course focuses primarily on Windows and windows internals and how to leverage them.  Host and network recon, privilege escalation, credential stealing and passing, persistence, and lateral movement techniques will be covered in depth.  Once finished with the course, students will have a foundation on how Windows attacks actually happen and how to secure against them from the post exploitation stage.
Like all classes offered by Attack Research, Tactical Exploitation: Attacking Windows is very hands on with a virtual enterprise network environment for students to practice the techniques they learn from the course lecture.  Exercises are then demonstrated so each student gets a deep understanding.  For more advanced students, there are additional challenges within the environment for them to discover.
<H2 CLASS="MediumHeading">Target Audience</H2>
<UL>
<LI>
Penetration Testers
</LI>
<LI>
Detection and Response Staff
</LI>
<LI>
System Administrators
</LI>
<LI>
Developers
</LI>
</UL>
 
<H2 CLASS="MediumHeading">Course Outline</H2>
<UL>
<LI>
Introductory Concepts and Thinking Like an Attacker
</LI>
<LI>
Host Recon
</LI>
<LI>
Privilege Escalation
</LI>
<LI>
Credential Stealing and Passing
</LI>
<LI>
Persistence
</LI>
<LI>
Network Recon
</LI>
<LI>
Lateral Movement
</LI>
</UL>
<H2 CLASS="MediumHeading">Course Instructor Bio</H2>
This course is taught by a highly experienced member of Attack Research staff.   Instructors have over 10 years of experience implementing, supporting, securing, and compromising large and complex multi-platform environments.  Instructors are currently engaged in senior level penetration testing of highly secured Windows and UNIX networks and frequently research, develop and deploy custom tools and techniques during engagements.
Tactical Exploitation: Attacking Windows instructors also bring a wealth of knowledge gained from performing incident response on compromised systems in the field including analysis of attacker tools and techniques.  Many of the topics covered in the course are taken directly from instructors case studies and represent real world events.
<H2 CLASS="MediumHeading">Student Requirements</H2>
Students must bring their own machines.  Attack Research, LLC provides a windows based virtual machine for each student to connect to via the Remote Desktop Protocol (RDP). All exercises are then based from there.
<UL>
<LI>
Laptops must meet the minimum specifications to run:
</LI>
<UL>
<LI>
Windows 7 or higher
</LI>
<LI>
Mac OS X Lion 10.7 or higher
</LI>
<LI>
Linux with a windowing system for RDP support
</LI>
</UL>
<LI>
Must have an RDP client
</LI>
<LI>
Gigabit Ethernet preferred. Limited wireless access is available.
</LI>
<UL>
<LI>
Recommend a USB/Thunderbolt Ethernet adaptor for laptops that don’t have Ethernet
</LI>
</UL>
<LI>
Student must have appropriate access and knowledge to change their network configuration to support DHCP or static IP Addresses.
</LI>
</UL>
<H2 CLASS="MediumHeading">Course Background</H2>
Tactical Exploitation: Attacking Windows focuses on the Windows portion of our most popular multi-platform class, Tactical Exploitation.  However it has been requested to go a little more in depth and separate the UNIX and Windows platforms.  It has been taught at our local headquarters and been well received.   The parent class Tactical Exploitation has been taught and well received multiple years at Blackhat, BruCON, Countermeasure, etc.
<H2 CLASS="MediumHeading">Students Provided With</H2>
Students leave the class with full documentation and the entire custom and non-custom toolsets. Students will also take away the custom tools that they design and build in the class. Students walk away from AR training sessions not only with the “usual” training materials, but with a wealth of knowledge for both attacking and defending networks.
AR utilizes a very hands on approach to teaching by having the students spend approximately 50% of class time performing practical exercises in a lab environment designed to simulate real world enterprise networks. This type of class structure has been a proven success in retention of skills learned and student engagement. Our unique lab environments are replicas of the types of production networks that students will encounter in the real world.

Attack Research

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}