Some Powershell Discovery Things

 Find older OS on a domain

2000,XP, 2003,Vista, 2008, Win 7, etc.

Get-ADComputer -Filter * -Properties OperatingSystem,LastLogonDate | where {$_.OperatingSystem -like "*2000*"} | select Name, OperatingSystem, Created, whenCreated, LastLogonDate, ipv4address  | sort LastLogonDate -unique | Export-CSV

I switch around "{$_.OperatingSystem -like "*2000*"}" for the various flavors of Windows I might be looking for.  "*Vista*", "*2003*", etc.

Some Kerberos Things

Get-ADComputer -Filter {TrustedForDelegation -eq $true -and primarygroupid -eq 515} -Properties trustedfordelegation,serviceprincipalname,description

Get-ADComputer -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=524288)"

WMI Commands

• Get-WmiObject -class Win32_Product
  • Gets a listing of all the installed software on a machine.
• Get-WmiObject - class Win32_Account
  • Gets a listing of all the user accounts
• Get-WmiObject - class Win32_BIOS
  
  • Many times used by malware to determine if the host is a virtual machine or not.
• Set up a remote windows command
  • $command =  "ipconfig /all >> c:\users\all users\desktop\results.txt"
  • $cmd = "cmd.exe /c $command"
  • Invoke-Method -class Win32_Process -name Create -ArgumentList $cmd -ComputerName \\Desktopname\
• wmic /node:172.16.27.38 process call create "cmd.exe /c /net user dude /add"
• uses WMIC to add a user on a remote machine

Powershell Fun

•  Link Ref
  
• Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList cmd.exe 
• Invoke-CimMethod -ClassName Win32_Process -MethodName create -Arguments @{commandline="notepad.exe"}
  

 

One Attack Example

1. From a powershell command prompt, attacker launches WMIC with the intent of creating a process on the remote machine and adding a user to that remote machine.
   1. wmic /node:172.16.27.38 process call create "cmd.exe /c /net user dude /add"
2. On the remote machine wmiprvse.exe gets the call and will run the commands. To find this attack in Carbon Black, check out this search:
   1. process_name:cmd.exe AND parent_name:wmiprvse.exe AND childproc_name:net.exe cmdline:user
   2. Event IDs on the remote machine are:
      1. 4720; 4722; 4738; 4732
       
      

Authenticated WMI Exec Via Powershell

https://packetstormsecurity.com/files/139762/Authenticated-WMI-Exec-Via-Powershell.html

This Metasploit module uses WMI execution to launch a payload instance on a remote machine. In order to avoid AV detection, all execution is performed in memory via psh-net encoded payload. Persistence option can be set to keep the payload looping while a handler is present to receive it. By default the module runs as the current process owner. The module can be configured with credentials for the remote host with which to launch the process.

Iran has its turn in limelight

A Mystery Agent Is Doxing Iran's Hackers and Dumping Their Code
https://www.wired.com/story/iran-hackers-oilrig-read-my-lips

Pentesting whiteboards

https://pen-testing.sans.org/blog/2017/03/08/pen-test-poster-white-board-powershell-one-line-web-client

https://pen-testing.sans.org/blog/2017/03/08/pen-test-poster-white-board-powershell-get-firewall-rules

https://pen-testing.sans.org/blog/2017/03/08/pen-test-poster-white-board-powershell-built-in-port-scanner

https://pen-testing.sans.org/blog/2017/03/08/pen-test-poster-white-board-powershell-add-a-firewall-rule

https://pen-testing.sans.org/blog/2017/03/08/pen-test-poster-white-board-bash-find-juicy-stuff-in-the-file-system

https://pen-testing.sans.org/blog/2017/03/08/pen-test-poster-white-board-bash-sudo-make-me-a-sandwich

https://pen-testing.sans.org/blog/2017/03/08/pen-test-poster-white-board-cmd-exe-c-wmic-process

https://pen-testing.sans.org/blog/2017/03/08/pen-test-poster-white-board-cmd-exe-c-netsh-interface

https://pen-testing.sans.org/blog/2017/03/06/pen-test-poster-white-board-powershell-ping-sweeper

https://pen-testing.sans.org/blog/2017/03/03/got-meterpreter-pivotpowpy

https://pen-testing.sans.org/blog/2017/02/28/pen-test-poster-white-board-bash-make-output-easier-to-read

https://pen-testing.sans.org/blog/2017/02/21/pen-test-poster-white-board-bash-check-service-every-second