POWERSHELL SHENANIGANS LATERAL MOVEMENT WITH POWERSHELL KIERAN JACOBSEN

POWERSHELL SHENANIGANS LATERAL MOVEMENT WITH POWERSHELL KIERAN JACOBSEN READIFY

WHO AM I • Kieran Jacobsen • Technical Lead @ Readify • Blog: poshsecurity. com

OUTLINE • Power. Shell as an attack platform • Power. Shell malware • Power. Shell Remoting • Power. Shell security features • Defence

CHALLENGE • Within a “corporate like” environment • Start with an infected workstation and move to a domain controller • Where possible use only Power. Shell code

POWERSHELL AS AN ATTACK PLATFORM • Obvious development, integration and execution options • Installed by default since Windows Vista • Power. Shell still considered harmless by the majority of AV vendors

POWERSHELL MALWARE • Power. Worm • Posh. Koder/Posh. Coder

MY POWERSHELL MALWARE • Single Script – System. Information. ps 1 • Runs as a schedule task – “Windows. Update” • Collects system information • Reports back to C 2 infrastructure • Collects list of tasks to run

DEMO: THE ENTRY

POWERSHELL REMOTING • Power. Shell Remoting is based upon Win. RM, Microsoft’s WS-Management implementation • Supports execution in 3 ways: • • Remote enabled commands Remotely executed script blocks Remote sessions Simple security model Required for the Windows Server Manager Enabled by default Allowed through Windows Firewall

DEMO: THE DC

POWERSHELL SECURITY FEATURES • Administrative rights • UAC • Code Signing • File source identification (zone. identifier) • Power. Shell Execution Policy

EXECUTION POLICY There are 6 states for the execution policy • Unrestricted • Remote Signed • All Signed • Restricted • Undefined (Default) • Bypass

BYPASSING EXECUTION POLICY • Simply ask Power. Shell • Switch the files zone. idenfier back to local • Read the script in and then execute it • Encode the script and use

DEMO: THE HASHES

DEFENCE • Restricted/Constrained Endpoints • Control/limit access to Win. RM

LINKS • Code on Git. Hub: http: //j. mp/1 i 33 Zrk • Microsoft Power. Shell/Security Series: • Quarks. PWDump: http: //j. mp/1 k. F 30 e 9 • Power. Worm Analysis: http: //j. mp/Rzgs. Hb • • • http: //j. mp/OOyftt http: //j. mp/1 e. DYv. A 4 http: //j. mp/1 k. F 3 z 7 T http: //j. mp/Nh. SC 0 X http: //j. mp/Nh. SEpy

Q AND A @kjacobsen Poshsecurity. com