How Hackers Use netsh.exe For Persistence & Code Execution (Sliver C2)

This video demonstrates using netsh, a Windows utility, as a "living off the land" binary for code execution and persistence by embedding Sliver C2 shellcode into a custom netsh helper DLL 0:00-0:36.

Key Takeaways:
• Netsh is a well-known living off the land technique documented in the MITRE ATT&CK framework that can be leveraged for persistence 0:16-0:25
• Sliver C2 framework, a free alternative to Cobalt Strike, is used to generate shellcode for Windows implants despite large file sizes due to its Golang implementation 0:42-2:49
• The video compiles a custom netsh helper DLL in Visual Studio using C++ code from Outflank, embedding Sliver shellcode for execution 8:04-11:17
• The technique requires administrator privileges as it modifies the registry at HKLM\SOFTWARE\Microsoft\netsh to add the helper DLL 12:47-14:30
• When successful, running netsh executes the embedded shellcode, establishing a Sliver C2 session allowing full system control 15:49-16:38

This demonstration shows how attackers can blend legitimate Windows utilities with custom malicious code to establish persistence while potentially evading detection.

Sources:

• 0:00-0:36 Introduction to netsh as a living off the land binary
• 0:16-0:25 Mention of MITRE ATT&CK framework documentation
• 0:42-2:49 Setting up and explaining Sliver C2 framework
• 8:04-11:17 Creating and compiling the netsh helper DLL
• 12:47-14:30 Registry