Episode 174 – Matt Graeber using PowerShell in Infosec


A Podcast about Windows PowerShell.

In This Episode

Tonight on the PowerScripting Podcast, we talk to Matt Graeber about using PowerShell in the Infosec industry


This segment is brought to you by TrainSignal

Get online computer based training for you and your whole staff from TrainSignal. TrainSignal offers more than 80 IT training courses in the areas of Security, Network Administration, Virtualization, PowerShell and more. With 24/7 online access, TrainSignal’s training courses are accessible on almost any device including PC, Mac, iPhone, iPad, Android smartphones, and more.  For more info and a list of courses, visit TrainSignal.com.


This segment brought to you by Start-Automating

Start Scripting to Your Fullest Potential.  At Start-Automating, we can help you unleash the full Power of PowerShell V2.  You can use our deep PowerShell expertise to build rich PowerShell solutions, or we can train you to use PowerShell like a pro. Isn’t it time you Save-Time, Save-Money, and Start-Automating?  Find out more at Start-Automating.com.


Chatroom Banter

[21:51:04] <Vern_Anderson> ## How does he get around the execution policy remotely?

[21:51:32] <LeeHolmes> "Post Exploitation" - an important point is that PowerShell is a glorious language to do what he could have already done in other ways

[21:52:04] <LeeHolmes> Excel macros can also do all the stuff Syringe does

[21:54:47] <LeeHolmes> http://technet.microsoft.com/en-us/library/cc722487.aspx

[21:54:53] <LeeHolmes> "Ten immutable laws of security"

[21:55:04] <LeeHolmes> #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore

[22:00:28] <pcgeek86> halr9000: Did Matt discover any WMI vulns during pen testing?

[22:00:32] <LeeHolmes> VBA (excel) macro to do what he just did:

[22:00:33] <LeeHolmes> Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Long, lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, ByVal lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long

[22:01:51] <LeeHolmes> Does he consider PowerShell a vulnerability, or does it just make it easier to do what he could otherwise have done?

[22:03:22] <pcgeek86> ## Did Matt discover any WMI vulnerabilities during his testing?

The Question

Super Power: Omnipotence!



Comments are closed.