Episode 174 - Matt Graeber using PowerShell in Infosec

A Podcast about Windows PowerShell.
Listen:

In This Episode

Tonight on the PowerScripting Podcast, we talk to Matt Graeber about using PowerShell in the Infosec industry

News

This segment is brought to you by TrainSignal

Get online computer based training for you and your whole staff from TrainSignal. TrainSignal offers more than 80 IT training courses in the areas of Security, Network Administration, Virtualization, PowerShell and more. With 24/7 online access, TrainSignal’s training courses are accessible on almost any device including PC, Mac, iPhone, iPad, Android smartphones, and more.  For more info and a list of courses, visit TrainSignal.com.

Interview

This segment brought to you by Start-Automating

Start Scripting to Your Fullest Potential.  At Start-Automating, we can help you unleash the full Power of PowerShell V2.  You can use our deep PowerShell expertise to build rich PowerShell solutions, or we can train you to use PowerShell like a pro. Isn’t it time you Save-Time, Save-Money, and Start-Automating?  Find out more at Start-Automating.com.

Links

Chatroom Banter


[21:51:04] <Vern_Anderson> ## How does he get around the execution policy remotely?

[21:51:32] <LeeHolmes> "Post Exploitation" - an important point is that PowerShell is a glorious language to do what he could have already done in other ways

[21:52:04] <LeeHolmes> Excel macros can also do all the stuff Syringe does

[21:54:47] <LeeHolmes> http://technet.microsoft.com/en-us/library/cc722487.aspx

[21:54:53] <LeeHolmes> "Ten immutable laws of security"

[21:55:04] <LeeHolmes> #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore

[22:00:28] <pcgeek86> halr9000: Did Matt discover any WMI vulns during pen testing?

[22:00:32] <LeeHolmes> VBA (excel) macro to do what he just did:

[22:00:33] <LeeHolmes> Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Long, lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, ByVal lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long

[22:01:51] <LeeHolmes> Does he consider PowerShell a vulnerability, or does it just make it easier to do what he could otherwise have done?

[22:03:22] <pcgeek86> ## Did Matt discover any WMI vulnerabilities during his testing?


The Question


Super Power: Omnipotence!

Resources

Tips

About the Author

Jonathan Walz

Since March 2007, Jonathan Walz has been the co-host and technical brains for the PowerScripting Podcast. Conceived as a radio show for the PowerShell community, the podcast is the longest-lived PowerShell show in existence, and has featured dozens of weekly guests.