Marcos Oviedo is an infosec professional interested in Windows internals and reverse engineering.
This talk unveils groundbreaking research that harnesses the Windows Mobile Device Management (MDM) stack to create an agentless C2 system. I will provide a thorough analysis of the MDM client architecture, diving into MDM protocols, components, and workflows.
The talk will reveal previously undisclosed vulnerabilities and attacks, showcasing examples of abuse and exploitation. I’ll detail my journey in creating a custom agentless C2 server. This process involves implementing the MDM protocols, crafting malicious MDM commands, abusing the MDM Client stack, and extending it to support second-stage payloads. I will show how the MDM client architecture can be exploited to gain full control of a device remotely, escalate privileges, disable security features, and deploy arbitrary code, all without installing a traditional agent. By showcasing innovative techniques to exploit Windows features, I aim to inspire further research into defensive strategies against this emerging threat vector. This presentation offers extensive analysis, demos, detection opportunities, and the release of the underlying source code. Don’t miss this unique chance to get into the world of Windows MDM exploitation!