#İstSec'17 Powershell’in Karanlık Yüzü
•
12 gefällt mir•4,522 views
Powershell can be used for both legitimate and malicious purposes. It leaves various artifacts that can be used for forensic analysis, including entries in the registry, network traffic, memory artifacts, prefetch files, and Windows event logs. The document discusses how Powershell can be used by attackers to remain undetected by avoiding leaving traces in the Windows event log, and provides examples of how it has been used in malware like embedding in macros, exploiting vulnerabilities like MS16-032, and getting a Meterpreter shell.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie #İstSec'17 Powershell’in Karanlık Yüzü
Ähnlich wie #İstSec'17 Powershell’in Karanlık Yüzü (20)
Mehr von BGA Cyber Security
Mehr von BGA Cyber Security (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
#İstSec'17 Powershell’in Karanlık Yüzü
- 1. Powershell’in Karanlık Yüzü Sistemlere Sızma, Bırakılan İzler, Phant0m
- 2. whoami • Halil DALABASMAZ • Sr. Penetration Tester & Instructor @ BGA Security • C|EH, OSCP, OSWP, OSCE • artofpwn.com • Twitter @hlldz • Linkedin @hlldz • Exploit-DB @Halil DALABASMAZ
- 3. >_ Powershell • Microsoft tarafından Windows komut satırı cmd.exe ve Windows Script Host'a alternatif olarak geliştirilen yeni nesil bir komut satırı uygulamasıdır.
- 6. >_ Neden • Signed, Legal • Varsayılan Olarak Yüklü • Şifreli Trafik İle Uzaktan Erişim İmkanı • Anti-Forensic Friendly • Anti-Application Whitelisting Friendly • Script-Based Malware Bağışıklığı • Obfuscation Kolaylığı
- 7. >_ Execution Policy • Restricted • RemoteSigned • AllSigned • Unrestricted • Bypass
- 8. >_ Projeler • Powershell Empire • PowerSploit • Nishang • PowerOPS • p0wnedShell • Inveigh • Unicorn
- 9. >_ Powershell > Powershell.exe
- 10. >_ Bırakılan İzler • Kayıt Defteri • Ağ Trafiği • Memory • Prefecth • Event Log
- 11. >_ Kayıt Defteri • Kalıcı Olmak (Persistent)
- 12. >_ Ağ Trafiği • WinRM, Windows Remote Management • Powershell Remoting • HTTP 5985, HTTPS 5986
- 13. >_ Memory • Powershell Remoting? • svchost.exe - DCOM Server Process • DCOMLaunch • C:WindowsSystem32wsmpro vhost.exe
- 14. >_ Prefecth • C:WindowsPrefetch • *.pf
- 15. >_ Windows Event Log • Powershell 3.0 + • Windows PowerShell.evtx • Microsoft-Windows- PowerShell%4Operational.evtx • Microsoft-Windows- PowerShell%4Analytic.etl • Microsoft-Windows- WinRM%4Operational.evtx • • Microsoft-Windows- WinRM%4Analytic.etl
- 16. >_ Phant0m • İz bırakmamak!? • Windows Event Log
- 17. >_ svchost.exe
- 18. >_ Windows Event Log
- 19. >_ Demo 1. .DOC (Macro) 2. MS16-032 LPE 3. Phant0m 4. Meterpreter