Content From Vic .Net Presentation
Last week I had the wonderful pleasure of presenting to the Victorian .Net User Group. I want to thank Mahesh, the other organizers and SportsBet for the wonderful facilities.
I have been extremely lucky to present to a wide range of audiences on the security challenges that PowerShell brings to our organisations. From security groups to architecture to infrastructure and now development focused groups.
As promised, here is the content, code and links to more information.
You can download the PowerPoint slides here, or find them on SlideShare here.
If you want to take a look at the "malware" script that I created, you can find that up GitHub here. The repository includes two files, an example of the Excel spreadsheet which contains a macro that would infect a system, and then the SystemInformation.ps1, which is the actual "malware" that is the basis for all of my demonstrations.
I mentioned Matt Graeber's write up on PowerWorm, and this can be found here at his site, www.exploit-monday.com. Matt has rewritten the code to be more safe, as well as provide some tools to detect and remove PowerWorm infections and this can be found on his GitHub.
Another important set of resources are the 5 part series from the Microsoft's Hey Scripting Guy.
- Use PowerShell for Network Host and Port Discovery Sweeps
- Use PowerShell to Security Test SQL Server and SharePoint
- Use PowerShell to Discover Network Information from Shares
- Use PowerShell to Duplicate Process Tokens via P/Invoke
- Use PowerShell to Decrypt LSA Secrets from the Registry
I recommend reading the final two parts, I have made use of the code from these within SystemInformation.ps1.
Kieran
Upcoming Presentation at Victorian .Net User Group
I am excited to announce that I will be presenting PowerShell Shenanigans – Lateral Movement with PowerShell, to the Victorian .Net User Group.
This presentation will be an updated version of the one from CrikeyCon 2014, BIG and OWASP Brisbane.
Information about the session is listed below, and you can register here at Eventbrite.
PowerShell Shenanigans (Lateral Movement with PowerShell)
PowerShell, the must have tool and the long overlooked security challenge. Learn how PowerShell’s deep integration with the Microsoft platform can be utilized as a powerful attack platform within the enterprise space. Watch as a malicious actor moves from a compromised end user PC to the domain controllers and learn how we can begin to defend these types of attacks
About the Speaker
Specialising the automation of Windows Server environments, and with 10 years’ experience in the managed services and financial services sectors, Kieran Jacobson recently moved from sunny Brisbane to Melbourne to pursue a role as a Technical Lead with Readify. Kieran has always been a passionate member of the technical community, beginning as a Microsoft Student Ambassador and then as a presenter at a number of conferences including Infrastructure Saturday, CrikeyCon and Risky Business. Kieran maintains the Posh Security website, http://poshsecurity.com, with content ranging from automation, architecture, troubleshooting and software development.
Event Details
- When: 5:30 PM, Tuesday, 7th April 2015
- Where: Sportsbet, Level 15, 367 Collins Street, Melbourne
- RSVP: Register attendance at http://vicdotnet-apr2015.eventbrite.com.au
PowerWorm Analysis and Weaponized PowerWorm
So Matt Graber posted a few weeks ago three items of significant importance for PowerShell security folks.
The first, is he has performed an extremely detailed analysis of PowerWorm, the PowerShell malware that TendMicro found about a month ago and I wrote about as well. Matt has gone one better though, and rewritten the code, make it safe, and cleaned up the abstraction and obfuscation and put all of the code up on GitHub.
I recommend everyone, both those who are interested in PowerShell and those who are interested in malware to take a look.
Matt talks about why the PowerShell execution policy doesn’t help, the code uses the –endcodedcommand parameter when calling powershell.exe. I didn’t know about this till recently, and I was shocked at its effectiveness. If you haven’t looked into this one, I so thoroughly recommend you do, it is amazing.
There is plenty of other interesting things though, considering how this malware users PowerShell and WMI to persist. As I mentioned earlier, the use of the Net.WebClient explained why Polipo was needed as well as Tor.
I also was highly interested in the use of freegeoip.com, I have already started writing some code to make use of this site. I recommend you take a look.
Please go and look at the Matt’s post, and at his GitHub code.
But wait, there is much more! PowerWorm has picked up the functionality of CryptoLocker!!!!
Matt also tweeted a link to this post at Bleeping Computer, which describes a new variant of PowerWorm, dubbed PoshCoder or PoshKoder. This variant is encrypting files and folders in a manner similar to CryptoLocker, and then demanding the victim pays a fee of a couple of bitcoin.
The posts on Bleeping Computer do reference more volatile code, so I do warn you that it isn’t safe to play with unlike Matt’s deactivated code, so be careful. If you want to play, look at Matt’s code.
One interesting thing, is amongst these posts, it appears the malware writer makes an appearance. Whilst I and those on the forum could be wrong, there are some cryptic comments by one of the posters who makes even me wonder.
What is interesting, is that what Matt, TendMicro, myself and most others thought was harmless, has been successfully weaponized, and done so entirely in PowerShell. This malware, PoshCoder, is just as dangerous as CryptoLocker, but nowhere near as detectable. Right now, the low infection rates have prevented this from becoming a massive problem.
Last thing, paying the ransom doesn’t seem to be effective. There is a glitch somewhere and decryption isn’t working correctly. So bad news for anyone infected, you probably can’t get your files back.
Good news, some people have reported that Microsoft Security Essentials is detecting the malware.