Powershell

Powershell

All files can be found here

Get Powershell

  • What is powershell?: Microsoft’s answer to the Linux terminal, but more Object-Oriented (OOP)
  • Method 1:
    • Windows VM or Host OS
    • Method 2:
      • Ubuntu VM or Mac with Powershell installed??? (aka PFM)
      • Uses Powershell core (and doesn’t need docker, just homebrew)

Powershell Basics:

Variables:

1
2
$var1 = 5
$var2 = “55”

Operations:

Addition:

1
2
$var1 + $var2
$var2 + $var1
  • Why are they different?
1
2
var ++
var += 5

Equality:

1
2
3
4
5
6
7
-eq: equals
-ne: not equal to
-ceq: case sensitive comparison
-gt: greater than
-gte: greater than or equal to
-lt: less than 
-lte: less than or equal to

Booleans:

1
2
-and 
-or

Conditionals:

1
2
3
4
5
6
If (<condition>){
    <code/commands>
}
Else{
    <code/commands>
}

Loops:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
$question = "Are we there yet?"
$answer = "Noooooo!"
for ($i = 3; $i -gt 0; $i--){
    $question
    sleep 2
}
Write-Output "`n$answer"
**(`n) = new line, not \n like python/java/c

$services = get-service
ForEach ($thing in $services){
    $thing.name + " : " + $thing.status
}
Write-Output "`nThe last service is $($thing.name)" 
1
2
3
4
5
6
7
$food = 'Beans', 'Greens', 'Potatoes', 'Lamb', 'Rams', 'Hogs', 'Dogs'
for ($i = 5; $i -gt 0; $i--){
    foreach($item in $food){
        Write-Output "I got $item "
    }
}
Write-Output "`nYou name it!"
1
2
3
while ($true){
    test-connection 127.0.0.1
}
1
2
3
4
5
6
$rabbits = 2
Do{
    Write-output "We now have $rabbits rabbits!"
    $rabbits *= 2
}
While ($rabbits -lt 10000)
1
2
3
4
5
6
$i = 0
while($i -lt 999){
    $i++
    $i
}
Write-Host "`nCount complete - We have counted up to $i" -ForegroundColor Cyan
  • AKA the original for-loop or you can call the for-loop a wannabe while loop, either one works with me

Functions:

1
2
3
4
5
6
7
Function <name>{
    Function ($parameter){
    <Insert code here>
    }
    <Insert code here>
}
<name> -parameter 1

The Cool Stuff

TCP Listener

  • Idea: we monitor someone’s computer and we get a notification when they open an application
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
function WMI_Subscription{

function server($port){
    $Tcplistener = New-object System.Net.Sockets.TcpListener $port
    $Tcplistener.Start()
    Write-host "[-] " -ForegroundColor green -NoNewline; Write-Host "Listening: 0.0.0.0:$port" -ForegroundColor cyan
    $TcpClient = $Tcplistener.AcceptTcpClient()
    $remoteclient = $TcpClient.Client.RemoteEndPoint.Address.IPAddressToString
    Write-Host "[-] " -ForegroundColor green -NoNewline; Write-Host "New connection: $remoteclient" -ForegroundColor Cyan

    $TcpNetworkstream = $TCPClient.GetStream()
    $Receivebuffer = New-Object Byte[] $TcpClient.ReceiveBufferSize
    $encodingtype = New-Object System.Text.ASCIIEncoding
    while ($TCPClient.Connected){
        $Read = $TcpNetworkstream.Read($Receivebuffer, 0, $Receivebuffer.Length)          
            [Array]$Bytesreceived += $Receivebuffer[0..($Read -1)]
            [Array]::Clear($Receivebuffer, 0, $Read)

            $ScriptBlock = [ScriptBlock]::Create($EncodingType.GetString($Bytesreceived))
            $ScriptBlock
            $TcpNetworkstream.Dispose(); $Tcpclient.Dispose(), $Tcplistener.Stop()
    }
}
server -port 6602

# Temp WMI... dies when the process terminates

Get-Process -Name notepad  -ErrorAction SilentlyContinue | Stop-Process

Register-CimIndicationEvent -Query "Select * from __InstanceCreationEvent within 15 where targetInstance isa 'win32_process' and (targetinstance.name = 'notepad.exe' OR targetinstance.name = 'wordpad.exe')" `
    -SourceIdentifier "trigger" -Action{Write-Output "$(get-date) - Temp WMI Register Executed Successfully" | Out-File $env:USERPROFILE\Desktop\logger.txt -Append}

Start-Process notepad
Get-Content "$env:USERPROFILE\Desktop\logger.txt"
Get-EventSubscriber
Unregister-Event -SourceIdentifier "trigger"

Register-CimIndicationEvent -Query "Select * from __instanceModificationEvent within 15 where targetInstance isa 'win32_Service'" `
    -SourceIdentifier "trigger2" -Action{Write-Output "$(get-date) - Temp WMI Register Executed Successfully" | Out-File $env:USERPROFILE\Desktop\logger2.txt -Append}

Restart-Service -Name BITS
Get-Content "$env:USERPROFILE\Desktop\logger2.txt"
Unregister-Event -SourceIdentifier "trigger2"

Register-WmiEvent -Query "Select * from __InstanceoperationEvent within 20 where targetinstance ISA 'win32_process' AND targetinstance.name='lsass.exe'" -SourceIdentifier "beacon" `
    -Action{
        $socket = new-object System.Net.Sockets.TcpClient("127.0.0.1", "6602")
        $data = [System.Text.Encoding]::ASCII.GetBytes("This is a test")
        $stream = $socket.GetStream()
        $stream.Write($data, 0, $data.Length)
    }

Unregister-Event -SourceIdentifier "beacon"


Get-WmiObject -Namespace root/cimv2 -Class win32_localtime

Register-WmiEvent -Query "Select * from __InstanceModificationEvent within 30 WHERE TargetInstance ISA 'Win32_LocalTime' AND targetinstance.hour = 20 AND targetinstance.minute = 42 group within 30" -SourceIdentifier "beacon2" `
    -Action{
        $socket = new-object System.Net.Sockets.TcpClient("127.0.0.1", "6602")
        $data = [System.Text.Encoding]::ASCII.GetBytes("This is a test")
        $stream = $socket.GetStream()
        $stream.Write($data, 0, $data.Length)
    }

Unregister-Event -SourceIdentifier "beacon2"

Get-Job

Port Scanning

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
$ports = 1..100
$IP = "192.168.0.185"
$scan = foreach($port in $ports){
    try{
        $portStatus = new-object Net.Sockets.TcpClient($IP, $port)
        [pscustomobject]@{
            RemoteAddress = $IP
            RemotePort = $port
            TcpTestSucceeded =  $portStatus.connected
        }
       
        $portStatus.Close()
    }

    catch{
        [pscustomobject]@{
            RemoteAddress = $IP
            RemotePort = $port
            TcpTestSucceeded = 'False'
        }
    }
}

$scan

Downgrading Powershell:

  • Why would we do this??
  • How to downgrade: 
1
2
3
if ($PSVersionTable.PSVersion -gt [Version]"2.0") { 
powershell -Version 2 -File $MyInvocation.MyCommand.Definition exit } 
'run some code' Read-Host -Prompt "Scripts Completed : Press any key to exit"

Time Stomping:

  • What is it?
  • Why is it important?
  • Why you shouldn’t do it to your professors :)
1
2
3
4
5
file = "$env:USERPROFILE\desktop\myfile.txt"
Get-Item $file | format-list *time
(Get-Item -path $file).LastWriteTimeutc = Get-Date
(Get-Item -path $file).LastWriteTime = (Get-Date).AddDays(-270)
(Get-Item -path $file).CreationTime = "8/8/2018 09:00:00 PM"

The Duck…

General:

  • What is it?
  • Why should you know about it?

Use Cases:

  • Script parameters:
    1. Computer information
    2. USB Information
    3. Installed Updates
    4. Network Information
    5. Network Scan
    6. Port Scan
    7. Saved in C:\Users
  • Can be used to get a reverse shell

How to get your hands on one:

Practice

@pmccabe5