SEARCH
TOOLBOX
LANGUAGES
Difference between revisions of "Spring Training 2016 - PowerShell for Penetration Testers"

Difference between revisions of "Spring Training 2016 - PowerShell for Penetration Testers"

From BruCON 2017

Jump to: navigation, search
m (Protected "Spring Training 2016 - PowerShell for Penetration Testers" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite)))
(What would the attendees gained ?)
Line 63: Line 63:
 
* Security controls available with PowerShell
 
* Security controls available with PowerShell
  
== What would the attendees gained ? ==
+
=== What would the attendees gain ===
  
 
* PowerShell Hacker’s Cheat Sheet, access to the online CTF, solutions to exercises, sample source code, Lab manual, Lab machines (VM) , updated tools and extra slides explaining things which could not be covered.
 
* PowerShell Hacker’s Cheat Sheet, access to the online CTF, solutions to exercises, sample source code, Lab manual, Lab machines (VM) , updated tools and extra slides explaining things which could not be covered.

Revision as of 21:12, 7 December 2015

PowerShell for Penetration Testers

Course Description

PowerShell has changed the way Windows networks are attacked. It is Microsoft’s shell and scripting language available by default in all modern Windows computers. It could interact with .Net, WMI, COM, Windows API, Registry and other computers on a Windows network. This makes it imperative for Penetration Testers and Red Teamers to learn PowerShell.

This training is aimed towards attacking Windows network using PowerShell and is based on real world penetration tests done by the instructor. The course runs as a penetration test of a secure environment with detailed discussion and use of custom PowerShell scripts in each phase. Some of the techniques (see the course content for details), implemented using PowerShell, used in the course:

  • In-memory shellcode execution using client side attacks.
  • Exploiting SQL Servers (more than executing commands)
  • Using Metasploit payloads with no detection
  • Active Directory trust mapping, abuse and Kerberos attacks.
  • Dump Windows passwords, Web passwords, Wireless keys, LSA Secrets and other

system secrets in plain text

  • Using DNS, HTTPS, Gmail etc. as communication channels for shell access and

exfiltration.

  • Network relays, port forwarding and pivots to other machines.
  • Reboot and Event persistence
  • Bypass security controls like Firewalls, HIPS and Anti-Virus.

The course is a mixture of demonstrations, exercises, hands-on and lecture. The course also has a live CTF which attendees could try with and after the training. Attendees would be able to write own scripts and customize existing ones for security testing after this training. This training aims to change how you test a Windows based environment.

Course contents

  • Introduction to PowerShell
  • Language Essentials
    • Using ISE
    • Help system
    • Syntax of cmdlets and other commands
    • Variables, Operators, Types, Output Formatting
    • Conditional and Loop Statements
    • Functions
    • Modules
    • PowerShell Remoting and Jobs
    • Writing simple PowerShell scripts
  • Extending PowerShell with .Net
  • WMI with PowerShell
  • Playing with the Windows Registry
  • COM Objects with PowerShell
  • Recon, Information Gathering and the likes
  • Vulnerability Scanning and Analysis
  • Exploitation – Getting a foothold
    • Exploiting MSSQL Servers
    • Client Side Attacks with PowerShell
    • PowerShell with Human Interface Devices
    • Writing shells in PowerShell
    • Using Metasploit and PowerShell together
    • Porting Exploits to PowerShell
  • Post-Exploitation – What PowerShell is actually made for
    • Enumeration and Information Gathering
    • Privilege Escalation
    • Dumping System and Domain Secrets
    • Kerberos attacks (Golden, Silver Tickets and more)
    • MITM Attacks
    • Backdoors
  • Pivoting to other machines
    • Poshing the hashes™
    • Replaying credentials
    • Network Relays and Port Forwarding
  • Achieving Persistence
  • Clearing Tracks
  • Quick System Audits with PowerShell
  • Detecting PowerShell attacks
  • Security controls available with PowerShell

What would the attendees gain

  • PowerShell Hacker’s Cheat Sheet, access to the online CTF, solutions to exercises, sample source code, Lab manual, Lab machines (VM) , updated tools and extra slides explaining things which could not be covered.
  • The attendees would learn a powerful attack method which could be applied from day one after the training.
  • The attendees would understand that it is not always required to use a third party tool or non-native code on the target machine for post exploitation.
  • The attendees would learn how PowerShell makes things easier than previous scripting options on Windows like VB.

Target audience

Penetration Testers, Red Team members, System Administrators, Blue Team members and security professionals.

Requirements

  • Basic understanding of how penetration tests are done.
  • Basic understanding of a programming or scripting language could be helpful but is not

mandatory.

  • An open mind

Hardware/software Requirements

A Windows 7 or later system with 4 GB RAM, with Administrative access and ability to run PowerShell scripts. Ability to run VMware virtual machines.

Trainer Biography

Nikhil Mittal is a hacker, infosec researcher, speaker and enthusiast. His area of interest includes penetration testing, attack research, defence strategies and post exploitation research. He has 6+ years of experience in Penetration Testing for his clients which include many global corporate giants. He is also a member of Red teams of selected clients. Mon. 20 - 22 April 2016 (09:00 - 17:00) (3-day)

Register.jpg

Back to Training Overview