Powershell'in Karanlık Yüzü

•

1 j'aime•617 vues

Halil Dalabasmaz

ISTSEC 2017'de gerçekleştirdiğim "Powershell'in Karanlık Yüzü" isimli sunumum.

Technologie

Powershell’in Karanlık Yüzü
Sistemlere Sızma, Bırakılan İzler, Phant0m

whoami
• Halil DALABASMAZ
• Sr. Penetration Tester & Instructor @ BGA Security
• C|EH, OSCP, OSWP, OSCE
• artofpwn.com
• Twitter @hlldz
• Linkedin @hlldz
• Exploit-DB @Halil DALABASMAZ

>_ Powershell
• Microsoft tarafından Windows komut satırı cmd.exe ve Windows
Script Host'a alternatif olarak geliştirilen yeni nesil bir komut satırı
uygulamasıdır.

>_ Neden
• Signed, Legal
• Varsayılan Olarak Yüklü
• Şifreli Trafik İle Uzaktan Erişim
İmkanı
• Anti-Forensic Friendly
• Anti-Application Whitelisting
Friendly
• Script-Based Malware Bağışıklığı
• Obfuscation Kolaylığı

>_ Execution Policy
• Restricted
• RemoteSigned
• AllSigned
• Unrestricted
• Bypass

>_ Projeler
• Powershell Empire
• PowerSploit
• Nishang
• PowerOPS
• p0wnedShell
• Inveigh
• Unicorn

>_ Bırakılan İzler
• Kayıt Defteri
• Ağ Trafiği
• Memory
• Prefecth
• Event Log

>_ Kayıt Defteri
• Kalıcı Olmak (Persistent)

>_ Ağ Trafiği
• WinRM, Windows Remote
Management
• Powershell Remoting
• HTTP 5985, HTTPS 5986

>_ Memory
• Powershell Remoting?
• svchost.exe - DCOM Server
Process
• DCOMLaunch
• C:WindowsSystem32wsmpro
vhost.exe

>_ Windows Event Log
• Powershell 3.0 +
• Windows PowerShell.evtx
• Microsoft-Windows-
PowerShell%4Operational.evtx
• Microsoft-Windows-
PowerShell%4Analytic.etl
• Microsoft-Windows-
WinRM%4Operational.evtx
• • Microsoft-Windows-
WinRM%4Analytic.etl

>_ Phant0m
• İz bırakmamak!?
• Windows Event Log

>_ Demo
1. .DOC (Macro)
2. MS16-032 LPE
3. Phant0m
4. Meterpreter

Contenu connexe

Similaire à Powershell'in Karanlık Yüzü

Api crash

Api crash

Api crash

Api crash

Api crash

Api crash

Api crash

At National Instruments, we have developed an automation and provisioning framework called PIE (Programmable Infrastructure Environment) that we use daily on our devops team. Similar tools are available such as chef or puppet, but what makes PIE unique is its ability to work in multi-cloud deployments (Azure and AWS) along with multiple node OS types (linux and windows). It uses zookeeper to keep state and track dependencies across nodes and services. When building PIE we actively considered how to implement it in a Rugged way for a DevOps team. As noted in the deck on slide 68, we are Rugged by Design and Devops by Culture. We see these as intersecting domains that have the ability to impact each other. For more info see ruggeddevops.org

Coding Secure Infrastructure in the Cloud using the PIE framework

James Wickett

Malicious PowerShell scripts are on the rise, as attackers are using the framework’s flexibility to download their payloads, traverse through a compromised network, and carry out reconnaissance. Symantec analyzed PowerShell malware samples to find out how much of a danger they posed. Further reading: PowerShell threats surge: 95.4 percent of analyzed scripts were malicious (https://www.symantec.com/connect/blogs/powershell-threats-surge-954-percent-analyzed-scripts-were-malicious) The increased use of PowerShell in attacks (https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/increased-use-of-powershell-in-attacks-16-en.pdf)

PowerShell: The increased use of PowerShell in cyber attacks

Symantec Security Response

Openly Secure

Mohamed Sayed

Bsides tampa

Octavio Paguaga

Hillel Kobrovski - Remote Access Challenges - from VPN Client / SSL VPN to Zero Trust & SDP Modules וובינר : אתגרי אבטחת מידע והגנת סייבר בחיבור מאובטח לעבודה מרחוק של עובדים - ספקים הילל קוברובסקי , עתידן טכנולוגי , יועץ רב-תחומי להגנת סייבר וחדשנות כאסטרטגיה עסקית מצגת קצרה בנושא האתגרים הטכנולוגיים הקיימים , סקירה של הטכנולוגיות המובילות הקיימות כיום בתחום SSLVPN \ IPSEC VPN , הדגשים שחייבים לתת עליהם את הדעת , הדור הבא של פתרונות לחיבור מאובטח במימוש מודלים Zero Trust \ SDP הקלטה של הוובינר מתאריך 13/03/2020 ביחד עם ההרצאה של ערן אברג'ל מנהל מכירות ו איתן ברמלר CTO של חברת Safe-T בנושא של הטמעת פתרון Zero Trust במודל SDP - Software Defined Perimeter הלכה למעשה נמצאת בלינק הבא: https://youtu.be/Tm0seSvtD3E בכל שאלה אני תמיד לשירותכם הילל קוברובסקי עתידן טכנולוגי וחוקר טרנדים בתחום הסייבר , מרצה בכיר יועץ רב-תחומי להגנת סייבר וחדשנות כאסטרטגיה עסקית מנטור לפיתוח עסקי ואישי בתחומי הסייבר והחדשנות 054-7700919 | Hillel@Innovateordie.co.il Hillel Kobrovski Technology Futurist ✮ Cyber Trends Researcher ✮ Senior Lecturer Multidisciplinary Consultant for Cyber Security & Innovation as Business Strategy Business & Personal Mentor for Cyber & Innovation area 972-54-7700919 | Hillel@Innovateordie.co.il

הילל קוברובסקי - אתגרי אבטחת מידע והגנת סייבר בחיבור מאובטח לעבודה מרחוק של ע...

Hillel Kobrovski

Securing your web apps now

Stephan Steynfaardt

Hadoop Security

Timothy Spann

APIs have become the backbone of many services nowadays - from the weather forecast to delivery notifications and photo printing services. Not only can we consume data and services more readily through those APIs but we can also mash them up into greater services. To do so, we tackled API security through OAuth and OpenID Connect. They form a good basis to handle authentication and basic authorization delegation, but there is so much more to consider from an authorization perspective. This session will discuss how security concerns can be addressed through policy-driven authorization in a way that meets the needs and expectations of application developers, owners, and auditors alike. We will show how complex access policies can be handled through a dedicated authorization microservice. With this approach, you can automate security deployment changes within the same CI/CD pipelines used for application management. Furthermore, new deployment configurations are possible, such as implementing the authorization service as a sidecar, to meet advanced performance and scale requirements. All this without changing a single line of code.

Policy enabling your services - using elastic dynamic authorization to contro...

David Brossard

Mod security

Shruthi Kamath

Cyber ppt

karthik menon

Secure Search - Using Apache Sentry to Add Authentication and Authorization S...

Lucidworks

What is Apache Solr? Check Out Its Advantages

NextBrick Inc

Windows Azure PowerShell CmdLets

Pavel Revenkov

Similaire à Powershell'in Karanlık Yüzü (20)

Api crash

Coding Secure Infrastructure in the Cloud using the PIE framework

PowerShell: The increased use of PowerShell in cyber attacks

Openly Secure

Bsides tampa

הילל קוברובסקי - אתגרי אבטחת מידע והגנת סייבר בחיבור מאובטח לעבודה מרחוק של ע...

Securing your web apps now

Hadoop Security

Policy enabling your services - using elastic dynamic authorization to contro...

Mod security

Cyber ppt

Secure Search - Using Apache Sentry to Add Authentication and Authorization S...

What is Apache Solr? Check Out Its Advantages

Windows Azure PowerShell CmdLets

Dernier

Whatsapp Number Escorts Call girls 8617370543 Available 24x7 Mcleodganj Call Girls Service Offer Genuine VIP Model Escorts Call Girls in Your Budget. Mcleodganj Call Girls Service Provide Real Call Girls Number. Make Your Sexual Pleasure Memorable with Our Mcleodganj Call Girls at Affordable Price. Top VIP Escorts Call Girls, High Profile Independent Escorts Call Girls, Housewife Women Escorts Call Girl, College Girls Escorts Call Girls, Russian Escorts Call girls Service in Your Budget.

Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model

Deepika Singh

💥 You’re lucky! We’ve found two different (lead) developers that are willing to share their valuable lessons learned about using UiPath Document Understanding! Based on recent implementations in appealing use cases at Partou and SPIE. Don’t expect fancy videos or slide decks, but real and practical experiences that will help you with your own implementations. 📕 Topics that will be addressed: • Training the ML-model by humans: do or don't? • Rule-based versus AI extractors • Tips for finding use cases • How to start 👨‍🏫👨‍💻 Speakers: o Dion Morskieft, RPA Product Owner @Partou o Jack Klein-Schiphorst, Automation Developer @Tacstone Technology

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

UiPathCommunity

presentation ICT roal in 21st century education

jfdjdjcjdnsjd

Vector Search -An Introduction in Oracle Database 23ai.pptx

Remote DBA Services

ICT role in 21st century education and its challenges

rafiqahmad00786416

Tracing the root cause of a performance issue requires a lot of patience, experience, and focus. It’s so hard that we sometimes attempt to guess by trying out tentative fixes, but that usually results in frustration, messy code, and a considerable waste of time and money. This talk explains how to correctly zoom in on a performance bottleneck using three levels of profiling: distributed tracing, metrics, and method profiling. After we learn to read the JVM profiler output as a flame graph, we explore a series of bottlenecks typical for backend systems, like connection/thread pool starvation, invisible aspects, blocking code, hot CPU methods, lock contention, and Virtual Thread pinning, and we learn to trace them even if they occur in library code you are not familiar with. Attend this talk and prepare for the performance issues that will eventually hit any successful system. About authorWith two decades of experience, Victor is a Java Champion working as a trainer for top companies in Europe. Five thousands developers in 120 companies attended his workshops, so he gets to debate every week the challenges that various projects struggle with. In return, Victor summarizes key points from these workshops in conference talks and online meetups for the European Software Crafters, the world’s largest developer community around architecture, refactoring, and testing. Discover how Victor can help you on victorrentea.ro : company training catalog, consultancy and YouTube playlists.

Finding Java's Hidden Performance Traps @ DevoxxUK 2024

Victor Rentea

[BuildWithAI] Introduction to Gemini.pdf

Sandro Moreira

Angeliki Cooney has spent over twenty years at the forefront of the life sciences industry, working out of Wynantskill, NY. She is highly regarded for her dedication to advancing the development and accessibility of innovative treatments for chronic diseases, rare disorders, and cancer. Her professional journey has centered on strategic consulting for biopharmaceutical companies, facilitating digital transformation, enhancing omnichannel engagement, and refining strategic commercial practices. Angeliki's innovative contributions include pioneering several software-as-a-service (SaaS) products for the life sciences sector, earning her three patents. As the Senior Vice President of Life Sciences at Avenga, Angeliki orchestrated the firm's strategic entry into the U.S. market. Avenga, a renowned digital engineering and consulting firm, partners with significant entities in the pharmaceutical and biotechnology fields. Her leadership was instrumental in expanding Avenga's client base and establishing its presence in the competitive U.S. market.

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Angeliki Cooney

Webinar Recording: https://www.panagenda.com/webinars/why-teams-call-analytics-is-critical-to-your-entire-business Nothing is as frustrating and noticeable as being in an important call and being unable to see or hear the other person. Not surprising then, that issues with Teams calls are among the most common problems users call their helpdesk for. Having in depth insight into everything relevant going on at the user’s device, local network, ISP and Microsoft itself during the call is crucial for good Microsoft Teams Call quality support. To ensure a quick and adequate solution and to ensure your users get the most out of their Microsoft 365. But did you know that ‘bad calls’ are also an excellent indicator of other problems arising? Precisely because it is so noticeable!? Like the canary in the mine, bad calls can be early indicators of problems. Problems that might otherwise not have been noticed for a while but can have a big impact on productivity and satisfaction. Join this session by Christoph Adler to learn how true Microsoft Teams call quality analytics helped other organizations troubleshoot bad calls and identify and fix problems that impacted Teams calls or the use of Microsoft365 in general. See what it can do to keep your users happy and productive! In this session we will cover - Why CQD data alone is not enough to troubleshoot call problems - The importance of attributing call problems to the right call participant - What call quality analytics can do to help you quickly find, fix-, and prevent problems - Why having retrospective detailed insights matters - Real life examples of how others have used Microsoft Teams call quality monitoring to problem shoot problems with their ISP, network, device health and more.

Why Teams call analytics are critical to your entire business

panagenda

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

MadyBayot

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Juan lago vázquez

Following the popularity of “Cloud Revolution: Exploring the New Wave of Serverless Spatial Data,” we’re thrilled to announce this much-anticipated encore webinar. In this sequel, we’ll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you’re building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Safe Software

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

In this keynote, Asanka Abeysinghe, CTO,WSO2 will explore the shift towards platformless technology ecosystems and their importance in driving digital adaptability and innovation. We will discuss strategies for leveraging decentralized architectures and integrating diverse technologies, with a focus on building resilient, flexible, and future-ready IT infrastructures. We will also highlight WSO2's roadmap, emphasizing our commitment to supporting this transformative journey with our evolving product suite.

Platformless Horizons for Digital Adaptability

WSO2

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

Six Myths about Ontologies: The Basics of Formal Ontology

johnbeverley2021

FWD Group - Insurer Innovation Award 2024

The Digital Insurer

Dubai, often portrayed as a shimmering oasis in the desert, faces its own set of challenges, including the occasional threat of flooding. Despite its reputation for opulence and modernity, the emirate is not immune to the forces of nature. In recent years, Dubai has experienced sporadic but significant floods, testing the resilience of its infrastructure and communities. Among the critical lifelines in this bustling metropolis is the Dubai International Airport, a bustling hub that connects the city to the world. This article explores the intersection of Dubai flood events and the resilience demonstrated by the Dubai International Airport in the face of such challenges.

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Orbitshub

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Product Anonymous

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

Dernier (20)

Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

presentation ICT roal in 21st century education

Vector Search -An Introduction in Oracle Database 23ai.pptx

ICT role in 21st century education and its challenges

Finding Java's Hidden Performance Traps @ DevoxxUK 2024

[BuildWithAI] Introduction to Gemini.pdf

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Why Teams call analytics are critical to your entire business

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Boost Fertility New Invention Ups Success Rates.pdf

Platformless Horizons for Digital Adaptability

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Six Myths about Ontologies: The Basics of Formal Ontology

FWD Group - Insurer Innovation Award 2024

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Apidays New York 2024 - The value of a flexible API Management solution for O...

Powershell'in Karanlık Yüzü

1. Powershell’in Karanlık Yüzü Sistemlere Sızma, Bırakılan İzler, Phant0m

2. whoami • Halil DALABASMAZ • Sr. Penetration Tester & Instructor @ BGA Security • C|EH, OSCP, OSWP, OSCE • artofpwn.com • Twitter @hlldz • Linkedin @hlldz • Exploit-DB @Halil DALABASMAZ

3. >_ Powershell • Microsoft tarafından Windows komut satırı cmd.exe ve Windows Script Host'a alternatif olarak geliştirilen yeni nesil bir komut satırı uygulamasıdır.

4. >_ Powershell

5. >_ Karanlık Taraf

6. >_ Neden • Signed, Legal • Varsayılan Olarak Yüklü • Şifreli Trafik İle Uzaktan Erişim İmkanı • Anti-Forensic Friendly • Anti-Application Whitelisting Friendly • Script-Based Malware Bağışıklığı • Obfuscation Kolaylığı

7. >_ Execution Policy • Restricted • RemoteSigned • AllSigned • Unrestricted • Bypass

8. >_ Projeler • Powershell Empire • PowerSploit • Nishang • PowerOPS • p0wnedShell • Inveigh • Unicorn

9. >_ Powershell > Powershell.exe

10. >_ Bırakılan İzler • Kayıt Defteri • Ağ Trafiği • Memory • Prefecth • Event Log

11. >_ Kayıt Defteri • Kalıcı Olmak (Persistent)

12. >_ Ağ Trafiği • WinRM, Windows Remote Management • Powershell Remoting • HTTP 5985, HTTPS 5986

13. >_ Memory • Powershell Remoting? • svchost.exe - DCOM Server Process • DCOMLaunch • C:WindowsSystem32wsmpro vhost.exe

14. >_ Prefecth • C:WindowsPrefetch • *.pf

15. >_ Windows Event Log • Powershell 3.0 + • Windows PowerShell.evtx • Microsoft-Windows- PowerShell%4Operational.evtx • Microsoft-Windows- PowerShell%4Analytic.etl • Microsoft-Windows- WinRM%4Operational.evtx • • Microsoft-Windows- WinRM%4Analytic.etl

16. >_ Phant0m • İz bırakmamak!? • Windows Event Log

17. >_ svchost.exe

18. >_ Windows Event Log

19. >_ Demo 1. .DOC (Macro) 2. MS16-032 LPE 3. Phant0m 4. Meterpreter

Powershell'in Karanlık Yüzü

Recommandé

Recommandé

Contenu connexe

Similaire à Powershell'in Karanlık Yüzü

Similaire à Powershell'in Karanlık Yüzü (20)

Dernier

Dernier (20)

Powershell'in Karanlık Yüzü