_ _ _ _ _____ _ | | | | | | (_) | __ \ (_) | |__| | __ _ ___| | __ _ _ __ | |__) |_ _ _ __ _ ___ | __ |/ _` |/ __| |/ / | | '_ \ | ___/ _` | '__| / __| | | | | (_| | (__| < | | | | | | | | (_| | | | \__ \ |_| |_|\__,_|\___|_|\_\ |_|_| |_| |_| \__,_|_| |_|___/ 2023 _______ ____ _ |__ __| | _ \ | | | | ___ __ _ _ __ ___ ___ | |_) | ___ | |_ | |/ _ \/ _` | '_ ` _ \/ __| | _ < / _ \| __| | | __/ (_| | | | | | \__ \ | |_) | (_) | |_ __ |_|\___|\__,_|_| |_| |_|___/_|____/ \___/ \__| \ \ / / | | | | \ \ /\ / /__ _ __| | _____| |__ ___ _ __ \ \/ \/ / _ \| '__| |/ / __| '_ \ / _ \| '_ \ \ /\ / (_) | | | <\__ \ | | | (_) | |_) | \/ \/ \___/|_| |_|\_\___/_| |_|\___/| .__/ | | |_| by @rpargman Before the conference, while you have fast WiFi: * Download all the binaries and source code for this workshop: -> https://deathcon.io/hip/maldev-re.zip -> You will get the password to unzip this file when the workshop starts. * Set up a Windows 10 or 11 Virtual Machine (if you don't have one already) -> If you need a free Win11 VM: https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/ -> If you are not using the Microsoft VM, install Visual Studio 2022 Community (free) -> Download and install IDA Free version: https://hex-rays.com/ida-free/ -> Download and unzip x64dbg (always free): https://x64dbg.com/ * Sign up for the free Microsoft 365 Developer Program: -> https://developer.microsoft.com/en-us/microsoft-365/dev-program -> Pick a really fun name for your tenant (mine is microsoftupdate.onmicrosoft.com) -> Create two user accounts in your tenant and assign the free E5 licenses to them: + One is your Operator account, from which you will send commands + The other account is your Bot account, that your Teams Bot will use ==== Optional steps below (not necessary to do before conf) ==== * Note: If you use the VMWare Virtual Machine from the USB drive in class, the steps below have already been done for you. * If you want to modify the Bot features and recompile the DLL stub, you need to install two packages with vcpkg. First, get vcpkg if you don't already have it: https://vcpkg.io/en/ -> Run bootstrap-vcpkg.bat, then vcpkg.exe integrate install -> Install curl library: vcpkg.exe install curl --triplet x64-windows-static -> Install cJSON library: vcpkg.exe install cjson --triplet x64-windows-static * You also need to install the C++ features for Visual Studio. Use the VS Installer to "modify" and check the box for "Desktop Development with C++" * If you want to change any of the XOR-encrypted strings in the code, you can of course just do it manually with CyberChef or something, but even easier, you can use Python 3.11 with the script MSGraphHelperObfuscator.py. You will need to install the "requests" python module using pip.