WinRM in Workgroup Environments
Just a quick blog post this time, mainly focusing on some configuration items you “may” need to do if you are working with WinRM, in particular in workgroup environments. These are settings you may need to configure client side when trying to interact with servers. You probably saw these in the notes section of Get-WinRMPassword.
Firstly, how do you view your configuration?
winrm get winrm/config
Next, if you are connecting to systems where HTTP listeners have been configured on the server, if your running on a later Windows Client, you will need to allow for the connection to be made. By default “unencrypted” that is HTTP sessions will not be allowed.
winrm set winrm/config/service @{AllowUnencrypted="true"}
Now I recommend enabling basic auth, just incase.
winrm set winrm/config/client/auth @{Basic="true"}
Finally, the server a client connects to, actually needs to be listed in trusted hosts. This can be done like this:
winrm set winrm/config/client @{TrustedHosts="myserver"}
Note that the command above will clear any other trusted host entries you might have.
And that is pretty much all you need to do!
The easiest to understand guides are (in no particular order):
PowerShell + WinRM = Get-WinRMPassword
Hi All!
So I was working out what I will be putting in the paper based upon my PowerShell Shenanigans presentation from CrikeyCon, and started to ponder a few things around WinRM. In particular:
- How many machines have WinRM exposed to the public Internet?
- Out of these, are they exposing HTTP or HTTPS endpoints?
- Could this be an interesting remote dictionary/brute force attack?
- Could this be written in PowerShell for humour sake?
- Could we use this to breach a network and go from there?
- Has anyone else thought of this?
Let’s take a look at the answers to these questions.
Well the first two are pretty easy to answer. Turning to our good friend, Shaodan, we can put in some queries to get some rough estimates:
WinRM HTTP Hosts (TCP 5985) 185316
WinRM HTTPS Hosts (TCP 5986) 83840
Now we can’t easily assume that there is 269156 individual hosts out there, because we might have some duplicates (hosts listening on both HTTP and HTTPS) as well as some hosts with other services out there. There could also be older Windows Server systems listening on TCP 80 and 443. Either way, almost 300K is a pretty nice number to work with.
Now surely people really are not enabling HTTP? Well, I found this on some of my “out of the box” test systems. Interesting.
I think this would be an interesting attack method…
Could we make an attack tool and could it be made in PowerShell? It turns out, Microsoft has given us a significant amount code to perform this attack. As usual, let’s see if there is anything in PowerShell which looks like the basis for a brute force or dictionary based attack tool…test-wsman looks good!
Get-Help Test-WSMan: http://pastebin.com/uxKeEPHr
And we know how to read files and build PSCredential objects dynamically. So what would the CMDLet look like then?
CMDLet, Get-WinRMPassword: http://pastebin.com/RdygF0J6
And how would it work?
Examples: http://pastebin.com/pUhVazW3
So has anyone else done this? Yes, and some very smart people pointed out this as a possibility several years ago. TheLightCosine and Mubix (disclosure: I am a massive fan of Mubix’ work) talked about this very thing back in November 2012, and even wrote a MetaSploit module doing just this. And there were some very interesting discussions on Reddit about a year ago, and even a post on NetSPI.Com.
So some bright people pointed it out, and no one really seemed to pay much attention, this is a real shame.
So where to from here? Well, it is really hard to tell to be honest. WinRM has be around for a number of years (almost 10) and yet it isn’t something that has gained a huge amount of attention in the IT community, from an automation or security point-of-view. Brian Krebs wrote late last year on Windows RDP enabled servers to which access was for sale on underground forums. Attackers had gained access to these systems via poorly selected passwords and RDP connections exposed to the internet, whilst it certainly is easy to brute force passwords via RDP, WinRM makes it even easier, yet there doesn’t seem to be much of an appetite.
It could be that we simply do not know about it. It could be the case that a lot of these systems with WinRM exposed could have been taken over my malicious users and we simply don’t know about it. I really hope to see more people looking at why they are exposing WinRM to the internet, and if they have indeed been attacked via it. Perhaps now that we are shinning some light on it, we might really see what is hiding in the dark.
Risky Business: Featuring ME! Kieran Jacobsen
Patrick Gray interviewed me for Risky Business on Wednesday, and on Friday, the whole world got to hear the result. You can find the interview here.
Here is a brief description from the site:
On this week's show we have a look at PowerShell, the Microsoft sorta scripting language admin thingy. As it turns out, PowerShell can be an attacker's best friend when it comes to lateral movement through a network. We'll chat with Kieran Jacobson about that in this week's feature interview. He did a cracker presentation at CrikeyCon where he demo'd owning a domain controller and dumping all its creds with something like five lines of PowerShell. I mean, there are caveats there, but wow... the demotime was food for thought.
I am still working on Video/Paper, and have also been side tracked on another super awesome use of PowerShell + WinRM.
Thank you all for all of your feedback over the past week!
Crikey, was CrikeyCon FUN!
I am still overwhelmed by the amazing and super positive response from my presentation at this year’s inaugural CrikeyCon. I really didn’t expect anywhere near the reaction from those who attended, it has taken the last few days for everything to really sink in. I never expected people to be so amazed by the lateral movement capabilities of PowerShell combined with WinRM, I expected some to be shocked but not as many as I did.
As requested, you can find the slide deck here, and the GitHub code is available here. If you take a look through my GitHub repositories, you will notice how much PowerShell code I normally write, and you can also see the previous version of the same code.
I have to admit, there are two minor inaccuracies in my presentation. One makes things better, the other makes things much, much worse.
1. In the slides I stated that “WinRM is enabled by DEFAULT on domain 2012(R1/R2) joined servers”. I gathered this from Microsoft, but upon further investigation, this link from Microsoft actually states the situation is much worse: “In Windows Server 2012 R2 and Windows Server 2012, remote management is enabled by default.”
2. During question time, I said that installing the Windows Remote Management 4.0 bundle onto Windows 2008 (R1/2) servers, will enable WinRM for domain joined systems. I currently don’t believe this to be true, there doesn’t seem to be any confirmation from Microsoft, I am still testing in my lab and will let you all know.
I am currently working on an extended video of my presentation, in which I will go into more detail around each of the issues and will show the code in detail as well. I am also planning on writing a paper which will discuss using PowerShell and WinRM for lateral movement, possible attack vectors as well as strategies to protect your environment. Once these have been completed, I will let you all know.
I would really like to thank Ash and Wade for convincing me to speak and for organising CrikeyCon as well as Patrick over at Risky.biz for being an excellent MC.
Lastly, sorry for the lame title for this post.
Once again:
Running 32Bit PowerShell Jobs
Occasionally, you might need to run something in PowerShell that needs to strictly be run under a 32bit session. This can be very annoying, here is a trick, use the PowerShell jobs to your advantage!
Start-Job -Name 32bitjobs -RunAs32 -ScriptBlock { <CODE HERE> }
Receive-Job -Name 32bitjobs
This will start the script blog as a 32bit PowerShell session. Start-Job actually kicks off a separate PowerShell.exe instance, so make sure everything that script block needs is available.
PowerShell Error: The specified structure must be blittable or have layout information.
So recently I was working with the Get-TSLsaSecret CMDLet which was written by Niklas Goude, a guest blogger from TrueSec who was writing on the Hey Scripting Guy Blog.
You can find the write up on the CMDLet here, It is also worth reading the previous post in the series here.
Everytime I ran the CMDLet, ensuring that I was running as a 32bit session, which was elevated, I would receive the message "The specified structure must be blittable or have layout information.", I looked and looked and couldn't see anything I was doing wrong, or anything wrong in the code.
I the stumbled upon Microsoft KB 2909958. Resolving the issue is very simple, we just need to do another cast on the line with the error.
In the code from Microsoft/Niklas, change:
[LSAUtil.LSAUtil+LSA_UNICODE_STRING] [System.Runtime.InteropServices.marshal]::PtrToStructure($privateData, [LSAUtil.LSAUtil+LSA_UNICODE_STRING])
to:
[LSAUtil.LSAUtil+LSA_UNICODE_STRING][System.Runtime.InteropServices.marshal]::PtrToStructure($privateData, [System.Type][LSAUtil.LSAUtil+LSA_UNICODE_STRING])
And you are done!
More to come on Get-TSLsaSecret!!!!
Tools of the trade
I have been asked a few times what gear I use, for work and for personal use.
Hardware
I use three computers on a regular basis, a personal laptop/tablet, work laptop and then my gaming rig.
Firstly there is my simply fantasic Surface Pro 2 (128GB SSD, 4GB of RAM), this is one of the most amazing devices I have used, I am simply surprised by how much I can do with it.
I have my tweaked out HP EliteBook Folio 9470m, this is my work device. It isn't spec-ed out how you would get it normally from the shop, or even HP internally. Featuring a similar CPU as the Surface Pro 2, but with 256GB SSD and 16GB of RAM. Compared to all other work devices I have had over the years, it is by far the best. It is quite light, and packs a very nice 15 inch screen. The only limitation is there is no ESATA, but it has an abundance of USB3 ports.
Finally I have my gaming rig, not much to say but I7, 24GB of RAM, tonnes of storage and a beast video card to boot all on a Gigabyte Sniper 2 motherboard. I game and code on this thing on a regular basis.
Software
Must Haves
- Windows 8.1 X66
- Office 2013
Development/PowerShell
- PowerShell (obviously)
- Visual Studio 2013
- PrimalScript 2012
- Notepad++
- Winmerge
- GitHub for Windows
- Tortise SVN
Networking/Security
- Bitvise SSH Client
- Virtualbox
- Tor
- CCLeaner
- GPG
- Putty
- F Secure AV
- Inssider
- NMap
- WireShark
- EMET
- OpenVPN
- Keepass
- SMAC
Media
- VLC
- Winamp
Communications and Social Media
- Hexchat
- Line
- Skype
- Lync
And the Rest...
- Wunderlist
- Firefox
- Feedly
- Kindle
- 7Zip
- Cashplan
- Foxit Reader
- Steam
Peripherals
Nothing really special here. I like a good keyboard and mouse, preferably gaming gear like G510 etc.
My Partner bought me some fantastic Sony headphones for Christmas, the Sony MDR-1RBT Mark2. Quite amazing, Bluetooth, NFC and 30 hour battery life!
So that is pretty much it. I will try and keep this updated as I change what I am using.
What am I reading?
Just a quick post about the blogs found in my RSS reader. It is all pretty self explanatory!
Comics
PHD Comics http://www.phdcomics.com
Penny Arcade http://www.penny-arcade.com
xkcd.com http://xkcd.com/
Dilbert http://dilbert.com/
Microsoft (and related) blogs
Security Research & Defense http://blogs.technet.com/b/srd/
Powershell.CA http://www.energizedtech.com/
MSRC http://blogs.technet.com/b/msrc/
Richard Hicks' DirectAccess Blog http://directaccess.richardhicks.com
Microsoft Security Bulletins http://technet.microsoft.com/security/bulletin
Jeff Alexander's Weblog http://blogs.technet.com/b/jeffa36/
istartedsomething http://www.istartedsomething.com
Ben Armstrong http://blogs.msdn.com/b/virtual_pc_guy/
Bink.nu News http://www.bink.nu
WinBeta | Microsoft centered, Technology focused http://www.winbeta.org
Group Policy Central http://grouppolicy.biz
Security
Darknet - The Darkside http://www.darknet.org.uk
F-Secure Antivirus Research Weblog http://www.f-secure.com/weblog
security.crudtastic.com http://security.crudtastic.com
Hak5 - Technolust since 2005 http://hak5.org
Schneier on Security https://www.schneier.com/blog/
Packet Storm Security http://packetstormsecurity.com/
General
IFTTT Blog http://blog.ifttt.com/
Ars Technica http://arstechnica.com
LifeHacker Australia http://lifehacker.com.au
The Food Avenue...Diary of a food addict http://thefoodavenue.com