Download as PDF, PPTX
![Under the .NET Framework Hood
Gray Hat PowerShell
ShowMeCon 2015 - Ben Ten (@Ben0xA)
The Code
$ps = [powershell]::Create()
$ps.AddCommand("Get-ChildItem")
$ps.Invoke()
$ps.Commands.Clear()
$ps.AddScript("Write-Output `"Hey there ShowMeCon!`"; Get-
ChildItem;")
$ps.Invoke()](https://image.slidesharecdn.com/ghpsshowmecon-150609140810-lva1-app6891/75/Gray-Hat-PowerShell-ShowMeCon-2015-23-2048.jpg)
More Related Content
![[CB16] Invoke-Obfuscation: PowerShell obFUsk8tion Techniques & How To (Try To...](https://cdn.slidesharecdn.com/ss_thumbnails/cb16bohannonen-161109042710-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Gray Hat PowerShell - ShowMeCon 2015
Gray Hat PowerShell - ShowMeCon 2015
- 1. Gray Hat PowerShell BenTen (@Ben0xA) Slides: http://www.slideshare.net/BenTen0xA ShowMeCon 2015
- 2. About Me Ben Ten(0xA) @Ben0xA - twitter Chicago - #burbsec Security Consultant at Developer PoshSec Framework Creator Gamer Geek Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 3. Thank You! Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 4. Thank You! Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 5. About Me Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 6. About Me Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 7. About This Talk GrayHat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) DISCLAIMER!
- 8. About This Talk GrayHat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) DISCLAIMER! Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec a diam lectus. Sed sit amet ipsum mauris. Maecenas congue ligula ac quam viverra nec consectetur ante hendrerit. Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean ut gravida lorem. Ut turpis felis, pulvinar a semper sed, adipiscing id dolor. Pellentesque auctor nisi id magna consequat sagittis. Curabitur dapibus enim sit amet elit pharetra tincidunt feugiat nisl imperdiet. Ut convallis libero in urna ultrices accumsan. Donec sed odio eros. Donec viverra mi quis quam pulvinar at malesuada arcu rhoncus. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. In rutrum accumsan ultricies. Mauris vitae nisi at sem facilisis semper ac in est. Vivamus fermentum semper porta. Nunc diam velit, adipiscing ut tristique vitae, sagittis vel odio. Maecenas convallis ullamcorper ultricies. Curabitur ornare, ligula semper consectetur sagittis, nisi diam iaculis velit, id fringilla sem nunc vel mi. Nam dictum, odio nec pretium volutpat, arcu ante placerat erat, non tristique elit urna et turpis. Quisque mi metus, ornare sit amet fermentum et, tincidunt et orci. Fusce eget orci a orci congue vestibulum. Ut dolor diam, elementum et vestibulum eu, porttitor vel elit. Curabitur venenatis pulvinar tellus gravida ornare. Sed et erat faucibus nunc euismod ultricies ut id justo. Nullam cursus suscipit nisi, et ultrices justo sodales nec. Fusce venenatis facilisis lectus ac semper. Aliquam at massa ipsum. Quisque bibendum purus convallis nulla ultrices ultricies. Nullam aliquam, mi eu aliquam tincidunt, purus velit laoreet tortor, viverra pretium nisi quam vitae mi. Fusce vel volutpat elit. Nam sagittis nisi dui. Yes, I know it's Lorem Ipsum….
- 9. About This Talk GrayHat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) DISCLAIMER! ● Please do not use any of these tools, techniques, or code on any system that you do not own or otherwise have permission to use. ● Some of these things can damage systems!
- 10. About This Talk GrayHat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) This Talk is Not: ● An introduction to PowerShell ● Able to cover the wide array of techniques and code available in 45 minutes
- 11. About This Talk GrayHat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 12. About This Talk GrayHat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) Practical PowerShell Programming for Professional People http://ben0xa.com -or- https://youtube.com/watch?v=4X_uBL2YpmA
- 13. Overview Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA) ● Under the .NET Hood ● Offense Tools ● Defense Tools ● Resources ● Q&A ● Hugs – if you want them!
- 14. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 15. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) Before you create any tool, regardless of your intent, you need to understand what you are building your tool upon.
- 16. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) PowerShell sits directly on Microsoft .NET Framework
- 17. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) PowerShell is NOT powershell.exe
- 18. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) powershell.exe is just a host application. It hosts the assembly that contains PowerShell and handles I/O. System.Management.Automation.dll
- 19. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 20. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) Demo
- 21. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 22. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 23. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) The Code $ps = [powershell]::Create() $ps.AddCommand("Get-ChildItem") $ps.Invoke() $ps.Commands.Clear() $ps.AddScript("Write-Output `"Hey there ShowMeCon!`"; Get- ChildItem;") $ps.Invoke()
- 24. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) Demo #2
- 25. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 26. Under the .NETFramework Hood Gray Hat PowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) The Code The AwesomerShell code is available on ben0xa.com
- 27. Offense Tools Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) ● PowerSploit Matt Graeber (@mattifestation) Chris Campbell (@obscuresec) ● Veil-PowerView / PowerUp Will Shroeder (@harmj0y) ● Posh-SecMod Carlos Perez (@darkoperator)
- 28. Offense Tools Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) ● PowerSploit Matt Graeber (@mattifestation) Chris Campbell (@obscuresec) ● Veil-PowerView Will Shroeder (@harmj0y) ● Posh-SecMod Carlos Perez (@darkoperator)
- 29. PowerSploit Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA) Add-Persistence Find-4624Logons Find-4648Logons Find-AppLockerLogs Find-AVSignature Find-PSScriptsInPSAppLog Find-RDPClientConnections Get-ComputerDetails Get-GPPPassword Get-HttpStatus Get-Keystrokes Get-SecurityPackages Get-TimedScreenshot Get-VaultCredential Get-VolumeShadowCopy Install-SSP Invoke-CredentialInjection Invoke-DllInjection Invoke-Mimikatz Invoke-NinjaCopy Invoke-PortScan Invoke-ReflectivePEInjection Invoke-ReverseDNSLookup Invoke-Shellcode Invoke-ShellcodeMSIL Invoke-TokenManipulation Mount-VolumeShadowCopy New-ElevatedPersistenceOption New-UserPersistenceOption Out-CompressedDll Out-EncodedCommand Out-EncryptedScript Out-Minidump Remove-Comments Set-CriticalProcess Set-MasterBootRecord
- 30. PowerSploit Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA) STOP!
- 31. PowerSploit Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA)
- 32. PowerSploit Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA)
- 33. PowerSploit Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA) Invoke-Expression (iex) Loads Directly in Memory – No Disk I/O
- 34. PowerSploit Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA) Demo #3
- 35. Defense Tools Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) ● PoshSec Matt Johnson (@mwjcomputing) Ben Ten (@ben0xa) ● Kansa Dave Hull (@davehull) ● Invoke-IR / PowerForensics Jared Atkinson (@jaredcatkinson)
- 36. Defense Tools Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) ● PoshSec Matt Johnson (@mwjcomputing) Ben Ten (@ben0xa) ● Kansa Dave Hull (@davehull) ● Invoke-IR / PowerForensics Jared Atkinson (@jaredcatkinson)
- 37. Defense Tools Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA) Demo #4
- 38. Defense Tools Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 39. Defense Tools Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 40. Defense Tools Gray HatPowerShell ShowMeCon 2015 - Ben Ten (@Ben0xA)
- 41. Resources Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA) ● PowerSploit https://github.com/mattifestation/PowerSploit ● Veil-PowerView / PowerUp https://github.com/veil-framework/ ● Posh-SecMod https://github.com/darkoperator/
- 42. Resources Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA) ● PoshSec https://github.com/poshsec ● Kansa https://github.com/davehull ● Invoke-IR / PowerForensics https://github.com/invoke-ir
- 43. Q&A Gray Hat PowerShell ShowMeCon2015 - Ben Ten (@Ben0xA) Ben Ten (0xA) @Ben0xA - twitter http://ben0xa.com http://poshsec.com web@ben0xa.com Ben0xA – LinkedIn, Github, keybase, etc. irc.freenode.net #burbsec, #poshsec, #pssec http://www.slideshare.net/BenTen0xA