#İstSec'17 Powershell’in Karanlık Yüzü
•
12 gostaram•4,520 visualizações
Powershell can be used for both legitimate and malicious purposes. It leaves various artifacts that can be used for forensic analysis, including entries in the registry, network traffic, memory artifacts, prefetch files, and Windows event logs. The document discusses how Powershell can be used by attackers to remain undetected by avoiding leaving traces in the Windows event log, and provides examples of how it has been used in malware like embedding in macros, exploiting vulnerabilities like MS16-032, and getting a Meterpreter shell.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a #İstSec'17 Powershell’in Karanlık Yüzü
Semelhante a #İstSec'17 Powershell’in Karanlık Yüzü (20)
Mais de BGA Cyber Security
Mais de BGA Cyber Security (20)
Último
Último (20)
#İstSec'17 Powershell’in Karanlık Yüzü
- 1. Powershell’in Karanlık Yüzü Sistemlere Sızma, Bırakılan İzler, Phant0m
- 2. whoami • Halil DALABASMAZ • Sr. Penetration Tester & Instructor @ BGA Security • C|EH, OSCP, OSWP, OSCE • artofpwn.com • Twitter @hlldz • Linkedin @hlldz • Exploit-DB @Halil DALABASMAZ
- 3. >_ Powershell • Microsoft tarafından Windows komut satırı cmd.exe ve Windows Script Host'a alternatif olarak geliştirilen yeni nesil bir komut satırı uygulamasıdır.
- 6. >_ Neden • Signed, Legal • Varsayılan Olarak Yüklü • Şifreli Trafik İle Uzaktan Erişim İmkanı • Anti-Forensic Friendly • Anti-Application Whitelisting Friendly • Script-Based Malware Bağışıklığı • Obfuscation Kolaylığı
- 7. >_ Execution Policy • Restricted • RemoteSigned • AllSigned • Unrestricted • Bypass
- 8. >_ Projeler • Powershell Empire • PowerSploit • Nishang • PowerOPS • p0wnedShell • Inveigh • Unicorn
- 9. >_ Powershell > Powershell.exe
- 10. >_ Bırakılan İzler • Kayıt Defteri • Ağ Trafiği • Memory • Prefecth • Event Log
- 11. >_ Kayıt Defteri • Kalıcı Olmak (Persistent)
- 12. >_ Ağ Trafiği • WinRM, Windows Remote Management • Powershell Remoting • HTTP 5985, HTTPS 5986
- 13. >_ Memory • Powershell Remoting? • svchost.exe - DCOM Server Process • DCOMLaunch • C:WindowsSystem32wsmpro vhost.exe
- 14. >_ Prefecth • C:WindowsPrefetch • *.pf
- 15. >_ Windows Event Log • Powershell 3.0 + • Windows PowerShell.evtx • Microsoft-Windows- PowerShell%4Operational.evtx • Microsoft-Windows- PowerShell%4Analytic.etl • Microsoft-Windows- WinRM%4Operational.evtx • • Microsoft-Windows- WinRM%4Analytic.etl
- 16. >_ Phant0m • İz bırakmamak!? • Windows Event Log
- 17. >_ svchost.exe
- 18. >_ Windows Event Log
- 19. >_ Demo 1. .DOC (Macro) 2. MS16-032 LPE 3. Phant0m 4. Meterpreter