Windows Agentless C2: (Ab)using the MDM Client Stack

Abusing the Windows MDM Client to Establish Agentless C2 Communications and Bypass Detectability.

Key takeaways

The Windows MDM client can be exploited to achieve agentless C2 communications, bypassing traditional detection methods.
The MDM client’s enrollment process involves XML payload manipulation, which can be used to execute arbitrary commands on the device.
The MDM client’s management flow can be controlled through the management protocol, allowing attackers to execute arbitrary commands and access the device’s file system.
The MDM client’s client-server architecture can be used to send commands to the device and receive responses, enabling attackers to execute commands and access the device’s file system.
The MDM client’s enrollment process can be triggered through a variety of methods, including email, USB drives, and network connections.
The MDM client’s management flow can be started through a scheduled task, which can be triggered by a variety of events, including system reboots.
The MDM client’s client-server architecture allows attackers to send commands to the device and receive responses, enabling them to execute commands and access the device’s file system.
The MDM client’s management flow can be controlled through the management protocol, allowing attackers to execute arbitrary commands and access the device’s file system.
The MDM client’s client-server architecture can be used to send commands to the device and receive responses, enabling attackers to execute commands and access the device’s file system.
The MDM client’s enrollment process can be triggered through a variety of methods, including email, USB drives, and network connections.
The MDM client’s management flow can be started through a scheduled task, which can be triggered by a variety of events, including system reboots.
The MDM client’s client-server architecture allows attackers to send commands to the device and receive responses, enabling them to execute commands and access the device’s file system.
The MDM client’s management flow can be controlled through the management protocol, allowing attackers to execute arbitrary commands and access the device’s file system.
The MDM client’s client-server architecture can be used to send commands to the device and receive responses, enabling attackers to execute commands and access the device’s file system.

Windows Agentless C2: (Ab)using the MDM Client Stack

More talks