PART 3: EVOLUTION OF POST-EXPLOITATION FRAMEWORKS
The Historical Arc
Understanding how we got here helps you understand where we’re going:
┌──────────────────────────────────────────────────────────────┐
│ EVOLUTION OF POST-EXPLOITATION FRAMEWORKS (1999-2025) │
├──────────────────────────────────────────────────────────────┤
│ │
│ PHASE 1: THE BEGINNING (1999-2007) │
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ │
│ 1999: L0pht releases L0phtCrack (password auditing) │
│ 2003: Metasploit 1.0 released by HD Moore │
│ • Perl-based, focused on exploit development │
│ • Revolutionary: modular, extensible architecture │
│ 2007: Metasploit 3.0 (Ruby rewrite) │
│ • Meterpreter introduced (in-memory DLL injection) │
│ • Set standard for post-exploitation payloads │
│ │
│ Key Lesson: Modularity and extensibility win │
│ │
│ PHASE 2: COMMERCIALIZATION (2008-2012) │
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ │
│ 2008: Immunity CANVAS gains prominence │
│ 2009: Core Impact becomes enterprise standard │
│ 2012: Cobalt Strike 1.0 released by Raphael Mudge │
│ • Built on Metasploit initially │
│ • Focus: Red team operations, not pentesting │
│ • Introduced: Malleable C2, team servers │
│ │
│ Key Lesson: Red teaming ≠ pentesting = different tools │
│ │
│ PHASE 3: LIVING OFF THE LAND (2013-2017) │
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ │
│ 2013: PowerShell Empire emerges │
│ • Pure PowerShell, no binaries on disk │
│ • Leverages native Windows capabilities │
│ 2015: BloodHound released (Active Directory mapping) │
│ 2017: Covenant (C#/.NET focus) │
│ │
│ Key Lesson: Native tools evade detection better │
│ │
│ PHASE 4: MODERN ERA (2018-Present) │
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ │
│ 2019: Sliver C2 (Go-based, cross-platform) │
│ 2020: Mythic (multi-language, agent-agnostic) │
│ 2021: BruteRatel (EDR evasion focus) │
│ 2022-2025: Rise of: │
│ • Rust-based tools (memory safety + performance) │
│ • Go tools (rapid development cycles). │
│ • BYOVD (Bring Your Own Vulnerable Driver) │
│ • Advanced EDR evasion techniques │
│ • AI-assisted tool development │
│ │
│ Key Lesson: Evasion is the new battleground │
│ │
└──────────────────────────────────────────────────────────────┘
Technology Shifts That Changed Everything
Several technological shifts fundamentally changed offensive tooling:
1. Shift to In-Memory Execution (2007)
BEFORE: Disk-based payloads
• Write executable to disk → Run it → Get caught by AV
AFTER: In-memory injection
• Metasploit's Meterpreter: DLL injected into memory
• No disk artifacts, harder to detect
• Spawned entire category of "fileless" malware
Impact on Tool Development:
→ Process injection became core skill
→ Shellcode loaders essential
→ Reflective DLL injection standard technique
2. PowerShell Revolution (2013-2017)
INSIGHT: Windows includes a powerful scripting engine
Advantages:
• Pre-installed on all modern Windows
• Can access .NET framework
• Runs in memory natively
• Signed by Microsoft (trusted)
Tools Enabled:
• Empire, Nishang, PowerSploit, Invoke-Mimikatz
Impact on Tool Development:
→ "Living off the land" became viable strategy
→ Defenders responded with AMSI, CLR ETW
→ Led to obfuscation arms race
3. Defender Technology Arms Race (2018-Present)
DEFENSIVE IMPROVEMENTS:
• Windows Defender ATP → Microsoft Defender for Endpoint
• EDR solutions everywhere (CrowdStrike, SentinelOne, etc.)
• AMSI (Anti-Malware Scan Interface)
• ETW (Event Tracing for Windows)
• Kernel callbacks and telemetry
OFFENSIVE RESPONSES:
• Direct syscalls (bypass userland hooks)
• Unhooking techniques
• AMSI bypasses
• PPL (Protected Process Light) abuse
• BYOVD (vulnerable driver exploitation)
Current State:
→ Cat-and-mouse game continues
→ Evasion techniques get more sophisticated
→ Custom tooling more valuable than ever
What We’ve Learned from 25 Years
The evolution teaches us principles that guide modern tool development:
- Modularity Wins: Metasploit’s architecture still influences design today
- Evasion is Paramount: Detection = mission failure for red teams
- Native is Better: LOLBins (Living Off the Land Binaries) evade better
- Memory Over Disk: Fileless techniques are standard now
- Encrypted C2: Unencrypted command and control is unacceptable
- Operational Security: Tool design must consider OpSec from day one
- Customization Required: Off-the-shelf tools get caught
These principles inform every module of this course.