More Related Content
![[Defcon Russia #29] Борис Савков - Bare-metal programming на примере Raspber...](https://cdn.slidesharecdn.com/ss_thumbnails/preza-170328124723-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
![[Defcon Russia #29] Михаил Клементьев - Обнаружение руткитов в GNU/Linux](https://cdn.slidesharecdn.com/ss_thumbnails/revealingrootkitsv5-170328122611-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Similar to Automating Post Exploitation with PowerShell
Automating Post Exploitation with PowerShell
- 1. Automating Post-Exploitation with PowerShell APractical Approach Presented by James Tarala Principal Consultant Enclave Security© 2015
- 2. 2 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Problem Statement • A pen-tester has broken into a system, now what? • Wouldn’t it be nice if could save time by automating our post- exploitation recipes for stealing loot from systems? • For example: – Identify locally available accounts on all nearby computers – Dump password hashes for all nearby computers (or memory!) – Perform port scans of nearly computers to identify running services – Transfer files back to our own system, using native binaries – Clear event logs on all compromised computers
- 3. 3 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Problem Statement (cont) • During a security assessment, bringing tools to a system can be problematic • Potential issues include: – Network transfers – Anti-malware software – Whitelisting software – Business owner nerves
- 4. 4 Automating Post-Exploitation withPowerShell © Enclave Security 2015 “Living off the Land” • Ideally a penetration tester or auditor would be able to “live off the land” • In other words: Only use native operating system tools to perform a security assessment • Removes the need to download or transfer software • Lowers the likelihood of being blocked by AV or whitelisting software
- 5. 5 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Potential Solution: Native PowerShell Cmdlets • Potential solution = Microsoft Windows PowerShell • Available for Microsoft Windows XP / Server 2003 and later Microsoft Windows operating systems • Security assessors will still need the rights & permissions to do their assessment • However some common pitfalls can be avoided using PowerShell
- 6. 6 Automating Post-Exploitation withPowerShell © Enclave Security 2015 CMDLET Specific Switches • Many PowerShell cmdlets have native syntax to allow for remote execution of the cmdlet on another system • Typically through the use of the COMPUTERNAME switch
- 7. 7 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Windows Remote Management (WinRM) • Available by default in Windows 7 / 2008 R2 and later • Distributed Management Task Force (DMTF) standard for remotely managing systems via web • Most recent release WinRM 2.0 in PowerShell 2.0 & later • To automatically install, run: Enable-PSRemoting • “-SkipNetworkProfileCheck” switch might be necessary if current firewall profile is “Public”
- 8. 8 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Enable-PSRemoting • Built in script for enabling PSRemoting on a computer • Automates the steps that could be set manually or via a Group Policy Object
- 9. 9 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PSSession - Like Native SSH for Windows • Creates an interactive session with a remote machine using the WS- Management protocol • To start a session: Enter-PSSession –Computername Name • To end a session: Exit-PSSession • Supports mutual authentication (via domain, SSL, or TrustedHosts)
- 10. 10 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PSSession - PowerShell v3.0 • New feature in PowerShell v3.0 & later • Allows users to disconnect / reconnect to running PSSession • Analogy: Similar to Metasploit sessions • Administrators can commandeer other users’ sessions
- 11. 11 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Invoke-Command • Creates a temporary PSSession with a remote machine • Session lasts for only as long as necessary for a command to execute • Can be used to execute a CMDLET, such as: Invoke-Command -ComputerName ENV-DC-01 -ScriptBlock {Get-Process} • Can be used to execute a PowerShell script, such as: Invoke-Command -ComputerName ENV-DC-01 -FilePath c:process.ps1 • Version 3.0 & later allows modules to be remotely imported
- 12. 12 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Automating Post-Exploitation • If Invoke-Command allows us to pass a script, then we can write our recipes in advance and run them automatically • Step #1: Identify your post-exploitation objectives. • Step #2: Identify PS code (recipes) to meet those objectives. • Step #3: Write a script based on your recipes. • Step #4: Add to the script the more you learn. • Step #5: Share your script with your team / the community.
- 13. 13 Automating Post-Exploitation withPowerShell © Enclave Security 2015 But What About the ExecutionPolicy? • By default Windows does not allow PowerShell scripts to be executed on a local machine • Normally the execution policy needs to be edited by an administrator with a command such as: Set-ExecutionPolicy Unrestricted • It turns out there are ways around this issue, many are simple • For more information check out: https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/
- 14. 14 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Use Pre-Existing PowerShell Scripts • You are not the first to walk this path… • There are many pre-existing scripts you can use to accomplish your pen-testing goals, without uploading binaries • Some PowerShell scripts to consider are: – PowerCat – PSNmap – PowerUp – PowerSploit – Nishang
- 15. 15 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerCat – A Native Netcat Replacement • An example of a traditional pentest binary ported to PS • Acts as a standards netcat listener or client – Supports remote chat / data transfers – Supports file transfer capabilities – Supports remote shells – Supports relaying between systems for lateral movement • Supports additional features too, such as: – SSL / TLS support for encrypted channels – “Listen Harder” / listener persistence after disconnect – Can utilize TCP / UDP or impersonate SMB Github page at: https://github.com/secabstraction/PowerCat
- 16. 16 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerCat in Action
- 17. 17 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerCat in Action (cont)
- 18. 18 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerCat Syntax / Usage From github syntax at: https://github.com/secabstraction/PowerCat
- 19. 19 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PSNmap – Native PowerShell Port Scanning • Written by Joakim Svendsen as a PS native scanner • Hobby project, with a lot of great functionality • Replicates many, but not all, the functions of Fyodor’s Nmap – Ping sweep / device discovery – Port scans – TCP/UDP – DNS lookup capability • Not a full nmap replacement (no NSE, version scanning, etc) • But capable of processing output with PS
- 20. 20 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PSNmap in Action – Ping Sweep & Port Scan
- 21. 21 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerUp – Privilege Escalation with PowerShell • Service Enumeration: • Get-ServiceUnquoted - returns services with unquoted paths that also have a space in the name • Get-ServiceFilePermission - returns services where the current user can write to the service binary path or its config • Get-ServicePermission - returns services the current user can modify • Get-ServiceDetail - returns detailed information about a specified service • ServiceAbuse: • Invoke-ServiceAbuse - modifies a vulnerable service to create a local admin or execute a custom command • Write-ServiceBinary - writes out a patched C# service binary that adds a local admin or executes a custom command • Install-ServiceBinary - replaces a service binary with one that adds a local admin or executes a custom command • Restore-ServiceBinary - restores a replaced service binary with the original executable
- 22. 22 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerUp – Privilege Escalation with PowerShell • DLL Hijacking: • Find-DLLHijack - finds .dll hijacking opportunities for currently running processes • Find-PathHijack - finds service %PATH% .dll hijacking opportunities • Write-HijackDll - writes out a hijackable .dll • Misc: • Get-VulnSchTask - find schtasks with modifiable target files • Get-UnattendedInstallFile - finds remaining unattended installation files • Get-Webconfig - checks for any encrypted web.config strings • Get-ApplicationHost - checks for encrypted application pool and virtual directory passwords • Write-UserAddMSI - write out a MSI installer that prompts for a user to be added • Invoke-AllChecks - runs all current escalation checks and returns a report
- 23. 23 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerSploit & PowerShellArsenal • Powershell frameworks for pen-testing & reverse engineering • Modules included for: – Antivirus Bypass – Code Execution – Exfiltration – Mayhem – Persistence – Recon – Script Modification – Reverse Engineering Malware
- 24. 24 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerSploit: Invoke-Mimikatz
- 25. 25 Automating Post-Exploitation withPowerShell © Enclave Security 2015 PowerSploit: Invoke-Portscan
- 26. 26 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Nishang – Another PenTesting Toolkit • “Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming.” • Written by Nikhil Mittal (@nikhil_mitt) • Includes dozens of cmdlets for each of the phases of the pen- testing process • One of the most mature PS native toolkits • Basically Metasploit for PS
- 27. 27 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Nishang Cmdlets Escalation Enable-DuplicateToken Remove-Update Invoke-PsUACme Execution Download-Execute-PS Download_Execute Execute-Command-MSSQL Execute-DNSTXT-Code Antak - the Webshell Backdoors HTTP-Backdoor DNS_TXT_Pwnage Execute-OnTime Gupt-Backdoor Add-ScrnSaveBackdoor Invoke-ADSBackdoor Client Side Exploits Out-CHM Out-Word Out-Excel Out-HTA Out-Java Out-Shortcut Out-WebQuery
- 28. 28 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Nishang Cmdlets (cont) Keylogger Invoke- MimikatzWdigestDowngrade Get-PassHints Pivot Create-MultipleSessions Run-EXEonRemote Invoke-Network Prasadhak (VirusTotal) Gather Check-VM Copy-VSS Invoke-CredentialsPhish FireBuster FireListener Get-Information Get-LSASecret Get-PassHashes Get-WLAN-Keys Scan Brute-Force Port-Scan Powerpreter
- 29. 29 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Nishang Cmdlets (cont) Shells Invoke-PsGcat Invoke-PsGcatAgent Invoke-PowerShellTcp Invoke-PowerShellTcpOneLine Invoke-PowerShellUdp Invoke-PowerShellUdpOneLine Invoke-PoshRatHttps Invoke-PoshRatHttp Remove-PoshRat Invoke-PowerShellWmi Invoke-PowerShellIcmp Utility Add-Exfiltration Add-Persistence Remove-Persistence Do-Exfiltration Download Parse_Keys Invoke-Encode Invoke-Decode Start-CaptureServer
- 30. 30 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Additional Benefits to Invoke-Command Scripts 1. All scripts are encrypted across the network by default using serialized XML over an HTTP channel (Organizations may also choose to pass the traffic over TLS tunnels) 2. All recipes will be automated and consistent 3. Limited penetration tester involvement is necessary (Great for getting junior penetration testers experience) 4. Gives penetration testers time to focus on more interesting or obscure discoveries
- 31. 31 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Additional Resources to Investigate 1. Integrating PowerShell scripts into Metasploit post modules (post/windows/manage/exec_powershell) 2. Client-side attacks with PowerShell 3. Using some of the publically available incident handling scripts and tools (Such as Invoke-IR, Kansa, or PSRecon) 4. Performing memory forensics with native PowerShell scripts (Dump-Memory, Dump-Strings)
- 32. 32 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Next Steps • If you find yourself regularly assessing Microsoft Windows based systems – learn PowerShell 1. Learn the foundations of PowerShell scripting 2. Learn the basic built-in cmdlets Windows provides 3. Learn about additional modules that can be added to a standard Windows environment 4. Write scripts to automate common assessment tasks 5. Experiment with output & reporting in PowerShell 6. Share your scripts with the community
- 33. 33 Automating Post-Exploitation withPowerShell © Enclave Security 2015 Further Questions • James Tarala – Principal Consultant & Founder, Enclave Security – E-mail: james.tarala@enclavesecurity.com – Twitter: @isaudit – Website: http://www.auditscripts.com/ • Resources for further study: – AuditScripts.com Audit Resources – SANS SEC 505: Securing Windows & Resisting Malware – Nikhil "SamratAshok" Mittal’s Blog “Lab of a Penetration Tester” – Windows PowerShell in Action by Bruce Payette
- 34. 34 Automating Post-Exploitation withPowerShell © Enclave Security 2015 References • PowerCat - https://github.com/secabstraction/PowerCat • PSNmap - http://www.powershelladmin.com/wiki/Port_scan_subnets_wit h_PSnmap_for_PowerShell • PowerUp - http://www.harmj0y.net/blog/powershell/powerup/ • PowerSploit - https://github.com/mattifestation/PowerSploit • Nishang - https://github.com/samratashok/nishang
Editor's Notes
- #2 Automating Post-Exploitation with PowerShell As organizations assess the security of their information systems, the need for automation has become more and more apparent. Not only are organizations attempting to automate their assessments, the need is becoming more pressing to perform assessments centrally against large numbers of enterprise systems. Penetration testers can use this automation to make their post-exploitation efforts more thorough, repeatable, and efficient. Defenders need to understand the techniques attackers are using once an initial compromise has occurred so they can build defenses to stop the attacks. Microsoft's PowerShell scripting language has become the defacto standard for many organizations looking to perform this level of distributed automation. In this presentation James Tarala, of Enclave Security, will describe to students the enterprise capabilities PowerShell offers and show practical examples of how PowerShell can be used to perform large scale penetration tests of Microsoft Windows systems.