Working as a PenTester for a living. While 8 out of 10 projects are about testing mobile applications. Enjoying it anyway! Pythonista with a chance of C programming. Loves to develop stuff. In IT Security the last 4 years, worked as a SOC analyst in the past. Tried to enjoy that too, failed to do so and quitted because life is not only finite, but also short. Still an Undergraduate Student, for the same reason.

Main research topic is backdoors and covert/alternative Communication Channels. Proud owner of the securosophy.com blog, that projects human behaviours in IT Security situations – the whole “people are hackable” hype exaggerated to the point of nonsensical deductions!

Unexpected Shells with “covertutils”

The presentation is about using covert channels to maintain access in compromised hosts. All that with sole purpose I[D|P]S/Firewall evasion and censoring/DLP bypassing. Under this context the covertutils Python Package will be introduced and a brief “what is a backdoor anyway” topic will arise for modelling purposes.

There also will be code slides with covertutils usage examples, to create functional backdoors. The final step will be to create a network steganography backdoor as presented in:

• https://www.exploit-db.com/docs/40891.pdf
• https://www.exploit-db.com/docs/40897.pdf

Be prepared for 45’ of a noir presentation full of nostalgical references to things like Godfather and South Park that could very well be omitted without affecting the content at all.

Disclaimer:

No philosophical arguments will be placed during the presentation. It is a promise. We are technical – be prepared.

Reference:

• https://github.com/operatorequals/covertutils