PS C:> Live Off the .NET Gadgets: Defeating Super Hat’s VM Caching Attack via Symbolic Solver

No ratings

Presented at No Hat 2025 by

Jr-Wei Huang

Hey… You know that [ENTER] is all you need to bypass all AMSI detection ;) PowerShell is the most powerful terminal chosen by the wild attackers, because of its flexible .NET features. Even after a decade, Microsoft has enhanced it with Antimalware Scan Interface (AMSI), which allows third-party AV/EDR to scan the malicious payloads… But we know the end of the story - obfuscation always works, and AMSI.fail. Hackers live-off the characters, dance on your AMSI rules: Encode, Concat, Dynamic Resolve, nice wordplay to defeat AV/EDR, and Ransom! Time to change the game! To better understand why this [ENTER] weird thing happens, we reverse and open Pandora's box of PS Internals. In this talk, we will share how Microsoft designed PowerShell as an interpreter (.NET code translator) with a Turing-complete virtual machine to serve various commands. Upon command received, it will be translated into the statement ASTs, then the compiler (yeah, compile in terminal?) will interpret them into bytecodes for the VM to run. But AMSI is placed in an embarrassing place to scan, the above-mentioned execution is coming without ANY DETECTION. Can we reproduce them in exciting ways? Yes! We rewrite all of the gadgets of the execution in C#. We introduce the first PowerShell symbolic solver for the concrete constants of obfuscated payloads. By symbolic approach, it represents commands into VM bytecodes, and uncover all the hidden We introduce the first PowerShell symbolic solver for the concrete constants of obfuscated payloads. artifacts with NO CODE to de-obfuscate them. In the end, we will release an online symbolic solver, web solver APIs, and PoC codes for the red team to better understand the internals of the PowerShell compiler. For blue-teams, this solver will be a out-of-box weapon to de-obfuscate exploit scripts, suspicious ETW logs, and process forensic for SOC use.