Conference recordings are now online!

We've highlighted a few talks worth checking out:

• Deep Dive Into Livewire, From Weak Typing to Pre-Authenticated RCE. The talk examines CVE-2025-54068 in Livewire, a web framework for Laravel. Unsafe PHP object reconstruction allows command execution on the server without authentication or knowledge of the application's APP_KEY.

• BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive. The author introduces BTR_CLI, a tool for disabling antivirus and EDR through Windows Defender’s BTR.sys driver. It requires administrator privileges and modifies files and registry entries during Windows startup, before security services start.

• ESC17: Using ADCS to Attack HTTPS-Enabled WSUS Clients. The researcher demonstrates how to impersonate a WSUS update server using a certificate issued through a misconfigured Active Directory Certificate Services template. Intercepting HTTPS traffic then allows an attacker to execute commands with administrator privileges on WSUS clients.

• Kernel Primitives to Code Execution on Windows 11 VBS/HVCI/kCET (SSDT/SSDT Shadow Hooks). The talk examines privilege escalation to SYSTEM on Windows 11 with memory isolation and kernel protection features (VBS, HVCI, and kCET) enabled. A vulnerable driver is used to modify the SSDT and Shadow SSDT tables in kernel memory and intercept system calls.

• Cloak and Filter: Weaponizing the GPU and Windows Cloud Filter for File-less Execution and Privilege Escalation. The presentation demonstrates EDR evasion using a GPU and Windows Cloud Filter, a mechanism for loading cloud files on demand. Malicious code is decrypted in GPU memory. One of the attack chains loads an attacker-controlled DLL file to gain SYSTEM privileges.