Listen:
In This Episode
Tonight on the PowerScripting Podcast, we talk to Matt Graeber about using PowerShell in the Infosec industry
News
This segment is brought to you by TrainSignal
Get online computer based training for you and your whole staff from TrainSignal. TrainSignal offers more than 80 IT training courses in the areas of Security, Network Administration, Virtualization, PowerShell and more. With 24/7 online access, TrainSignal’s training courses are accessible on almost any device including PC, Mac, iPhone, iPad, Android smartphones, and more.  For more info and a list of courses, visit TrainSignal.com.
-
Columbus, OH gets the world’s first PowerShell Saturday event! Block out March 10th on your calendar. Details will be announced here soon!
-
Version 2.7 of PowerWF and PowerSE are now available
-
Version 1.1 of the iLO PowerShell Library is out
Interview
This segment brought to you by Start-Automating
Start Scripting to Your Fullest Potential.  At Start-Automating, we can help you unleash the full Power of PowerShell V2.  You can use our deep PowerShell expertise to build rich PowerShell solutions, or we can train you to use PowerShell like a pro. Isn’t it time you Save-Time, Save-Money, and Start-Automating?  Find out more at Start-Automating.com.
Links
-
Matt’s blog: http://www.exploit-monday.com/
Chatroom Banter
[21:51:04] <Vern_Anderson> ## How does he get around the execution policy remotely?
[21:51:32] <LeeHolmes> "Post Exploitation" - an important point is that PowerShell is a glorious language to do what he could have already done in other ways
[21:52:04] <LeeHolmes> Excel macros can also do all the stuff Syringe does
[21:54:47] <LeeHolmes> http://technet.microsoft.com/en-us/library/cc722487.aspx
[21:54:53] <LeeHolmes> "Ten immutable laws of security"
[21:55:04] <LeeHolmes> #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore
[22:00:28] <pcgeek86> halr9000: Did Matt discover any WMI vulns during pen testing?
[22:00:32] <LeeHolmes> VBA (excel) macro to do what he just did:
[22:00:33] <LeeHolmes> Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Long, lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, ByVal lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long
[22:01:51] <LeeHolmes> Does he consider PowerShell a vulnerability, or does it just make it easier to do what he could otherwise have done?
[22:03:22] <pcgeek86> ## Did Matt discover any WMI vulnerabilities during his testing?
The Question
Super Power: Omnipotence!
Resources
-
Jeff Hicks presents PowerShell in Nutshell
-
Josh Atwell has a function to make cloning VMware VMs easier
-
Boe Prox wrote about managing remote services
-
Don Jones teaches many ways to create custom objects
Tips
-
Sean Kearney shows us how to explore cmdlet parameters
-
Monitor Memory usage from your PowerShell prompt
-
Use the range operator to build consecutive computer names
