Upcoming Presentation at Victorian .Net User Group
I am excited to announce that I will be presenting PowerShell Shenanigans – Lateral Movement with PowerShell, to the Victorian .Net User Group.
This presentation will be an updated version of the one from CrikeyCon 2014, BIG and OWASP Brisbane.
Information about the session is listed below, and you can register here at Eventbrite.
PowerShell Shenanigans (Lateral Movement with PowerShell)
PowerShell, the must have tool and the long overlooked security challenge. Learn how PowerShell’s deep integration with the Microsoft platform can be utilized as a powerful attack platform within the enterprise space. Watch as a malicious actor moves from a compromised end user PC to the domain controllers and learn how we can begin to defend these types of attacks
About the Speaker
Specialising the automation of Windows Server environments, and with 10 years’ experience in the managed services and financial services sectors, Kieran Jacobson recently moved from sunny Brisbane to Melbourne to pursue a role as a Technical Lead with Readify. Kieran has always been a passionate member of the technical community, beginning as a Microsoft Student Ambassador and then as a presenter at a number of conferences including Infrastructure Saturday, CrikeyCon and Risky Business. Kieran maintains the Posh Security website, http://poshsecurity.com, with content ranging from automation, architecture, troubleshooting and software development.
Event Details
- When: 5:30 PM, Tuesday, 7th April 2015
- Where: Sportsbet, Level 15, 367 Collins Street, Melbourne
- RSVP: Register attendance at http://vicdotnet-apr2015.eventbrite.com.au
Hacking with a rubber duck
On the weekend I had the pleasure to present at CrikeyCon 2015. I want to thank everyone involved including the organizers; the other speakers; our wonderful MC, Patrick Gray from Risky Business; and of course the attendees!
This year I chose something a bit different to present on, the Hak5 Rubber Ducky. I started with two (and one failed,) demonstrations in the morning before setting up in the events area to show off some more advanced demonstrations.
As promised, I am posting up my content for everyone to make use of it.
Firstly, the PowerPoint slides can be downloaded here, or viewed on SlideShare here (and below).
I have setup a separate page on this side, Rubber Ducky, where you can find the scripts/payloads and a description with each.
There are a number of links which I found to be extremely useful.
If you have any questions, comments, or feedback please feel free to leave a comment, contact me via this site or send a message to me on Twitter.
Kieran
Presenting at CrikeyCon 2015
I wanted to quickly let everyone know that I will be presenting at CrikeyCon again this year. Once again I am excited to be presenting, as well as nervous.
This year I will be doing something a little different from my usual presentations. This year I will be talking about the Hak5 USB Rubber Ducky. This is something I have wanted to show off and get more people interested in for a number of years, and am extremely excited by this opportunity.
My presentation this year will be shorter than usual, with only 15 minutes to perform a quick overview and some warm up demonstrations. I will then move to the events area along side my good friend Ash, and the always exciting Robert Winkel, where I will be showing off some more advanced demonstrations.
There is an amazing list of speakers again this year, and once again Patrick Gray will be the MC.
Last year, tickets sold out quickly, if you want to attend, then visit the Eventbrite page today to secure yours.
Links for PowerShell Shenanigans
I thought it might be easier for those wanting the links from my resent presentation if I provided a list of them here, so you didn't have to go through the presentation to find them.
My code on GitHub: http://j.mp/1i33Zrk
QuarksPWDump: http://j.mp/1kF30e9
PowerSploit: http://j.mp/1gJORtF
PowerWorm Analysis: http://j.mp/RzgsHb
PowerBleed: http://j.mp/1jfyILK
Microsoft PowerShell/Security Series:
Practical Persistence in PowerShell: http://j.mp/1mU6fQq
Bruteforcing WinRM with PowerShell: http://j.mp/1nBlwX2
I hope you all enjoy!
Brisbane Infrastructure Group Presentation
On Tuesday I presented to the Brisbane Infrastructure Group a similar presentation to the one at CrikeyCon. This presentation contains updated information, some defence measures and just better information overall.
You can download the slide deck here, and the SlideShare can be found here (and embedded below).
Risky Business: Featuring ME! Kieran Jacobsen
Patrick Gray interviewed me for Risky Business on Wednesday, and on Friday, the whole world got to hear the result. You can find the interview here.
Here is a brief description from the site:
On this week's show we have a look at PowerShell, the Microsoft sorta scripting language admin thingy. As it turns out, PowerShell can be an attacker's best friend when it comes to lateral movement through a network. We'll chat with Kieran Jacobson about that in this week's feature interview. He did a cracker presentation at CrikeyCon where he demo'd owning a domain controller and dumping all its creds with something like five lines of PowerShell. I mean, there are caveats there, but wow... the demotime was food for thought.
I am still working on Video/Paper, and have also been side tracked on another super awesome use of PowerShell + WinRM.
Thank you all for all of your feedback over the past week!
Crikey, was CrikeyCon FUN!
I am still overwhelmed by the amazing and super positive response from my presentation at this year’s inaugural CrikeyCon. I really didn’t expect anywhere near the reaction from those who attended, it has taken the last few days for everything to really sink in. I never expected people to be so amazed by the lateral movement capabilities of PowerShell combined with WinRM, I expected some to be shocked but not as many as I did.
As requested, you can find the slide deck here, and the GitHub code is available here. If you take a look through my GitHub repositories, you will notice how much PowerShell code I normally write, and you can also see the previous version of the same code.
I have to admit, there are two minor inaccuracies in my presentation. One makes things better, the other makes things much, much worse.
1. In the slides I stated that “WinRM is enabled by DEFAULT on domain 2012(R1/R2) joined servers”. I gathered this from Microsoft, but upon further investigation, this link from Microsoft actually states the situation is much worse: “In Windows Server 2012 R2 and Windows Server 2012, remote management is enabled by default.”
2. During question time, I said that installing the Windows Remote Management 4.0 bundle onto Windows 2008 (R1/2) servers, will enable WinRM for domain joined systems. I currently don’t believe this to be true, there doesn’t seem to be any confirmation from Microsoft, I am still testing in my lab and will let you all know.
I am currently working on an extended video of my presentation, in which I will go into more detail around each of the issues and will show the code in detail as well. I am also planning on writing a paper which will discuss using PowerShell and WinRM for lateral movement, possible attack vectors as well as strategies to protect your environment. Once these have been completed, I will let you all know.
I would really like to thank Ash and Wade for convincing me to speak and for organising CrikeyCon as well as Patrick over at Risky.biz for being an excellent MC.
Lastly, sorry for the lame title for this post.
Once again:
DirectAccess Resources
So I have been spending quite a significant amount of time working on DirectAccess and generally talking to people about DirectAccess, remote access and working remotely in generally over the past few months.
DirectAccess was a technology that I had wanted to work with for a significantly long period of time, the concept of an always on VPN like it has always interested me. I was extremely excited to be given the opportunity to work with it!
Not only did I get the opportunity to deploy DirectAccess in an enterprise environment, but I also had the chance to share my experience with the Brisbane Infrastructure Group. My presentation can be found here.
So I thought why not provide you all with links to some of the resources that I used during my deployment of DirectAccess
Blogs:
Richard Hicks (MVP DirectAccess) - http://directaccess.richardhicks.com/
Tom Shinder (MVP DirectAccess / TMG) - http://blogs.technet.com/b/tomshinder
Iron Networks - http://www.ironnetworks.com/blog/
Specific articles you should read:
http://www.ivonetworks.com/news/2013/10/is-isatap-required-for-directaccess/
http://www.ironnetworks.com/blog/application-compatibility-issues-microsoft-directaccess
http://www.ironnetworks.com/blog/directaccess-network-location-server-considerations
http://www.ironnetworks.com/blog/common-directaccess-implementation-mistakes
There are probably some links missing, if there are other things that I realize I have missed, I will update this post.