Covert Red Team PowerShell Attacks: How to PS without powershell.exe

No ratings

Presented at BsidesOttawa 2016 by

Tiago Jesus

Powershell is quickly becoming red teamers and penetration testers favourite post-exploitation language for Windows. It provides a full fledge object oriented language along with a powerful shell pipeline that can manage multiple remote sessions simultaneously. Microsoft’s new de facto system administration scripting language also provides attackers direct access to the Win32 API and the full .NET framework. These capabilities can be used to dynamically load and execute directly in memory PE files - without touching disk - to evade AV detection. Security researchers have developed a wealth of post-exploitation modules, such as PowerSploit, to perform a variety of tasks such as stealing the SAM database for the DC. APT groups, such as “Deep Panda,” are have started using powershell in their espionage operations. In response to the growing use of PowerShell (PS) as an offensive attack tool some system administrators are locking down users access. The mitigation measures to stop PS attacks ranges from changing execution policy to the complete removal of powershell.exe. Administrators might (naively) believe that if they deleted the powershell executable from disk attackers can no longer run PS commands… this is not the case. In this presentation we will demo our findings for performing covert PS attacks without powershell.exe. First, we will show how to create “on-the-fly” a PS pipe to execute PowerShell commands using the .NET framework. Next, we will build a small executable backdoor written in C# that will enable an attacker to execute arbitrary PowerShell commands without powershell.exe. Building on this code we will modify the source of the PE file to create a .dll that will act as our attackers “PS backdoor”. To avoid being caught by AV or blocked by whitelisting security solutions we will next setup our backdoor directly in memory through legitimately whitelisted execution vectors. This will involve loading, compiling and executing C# code directly in memory using wscript.exe or cscript.exe as vectors of execution for VBS scripts. Finally, we will work through the complete cyber attack life-cycle process, from initial breach to privilege escalation to lateral movement, and show how to set up covert persistence for our PS backdoor.