Episode 174 - PowerScripting Podcast - Matt Graeber using PowerShell in Infosec

Matt Graeber on using PowerShell in the Infosec industry
News
This segment is brought to you by TrainSignal
Get online computer based training for you and your whole staff from TrainSignal. TrainSignal offers more than 80 IT training courses in the areas of Security, Network Administration, Virtualization, PowerShell and more. With 24/7 online access, TrainSignal’s training courses are accessible on almost any device including PC, Mac, iPhone, iPad, Android smartphones, and more.  For more info and a list of courses, visit TrainSignal.com.


Columbus, OH gets the world’s first PowerShell Saturday event! Block out March 10th on your calendar. Details will be announced here soon!


Version 2.7 of PowerWF and PowerSE are now available


Version 1.1 of the iLO PowerShell Library is out


Interview
This segment brought to you by Start-Automating

Start Scripting to Your Fullest Potential.  At Start-Automating, we can help you unleash the full Power of PowerShell V2.  You can use our deep PowerShell expertise to build rich PowerShell solutions, or we can train you to use PowerShell like a pro. Isn’t it time you Save-Time, Save-Money, and Start-Automating?  Find out more at Start-Automating.com.

Links


Matt’s blog: http://www.exploit-monday.com/


Chatroom Banter

[21:51:04] ## How does he get around the execution policy remotely?
[21:51:32] "Post Exploitation" - an important point is that PowerShell is a glorious language to do what he could have already done in other ways
[21:52:04] Excel macros can also do all the stuff Syringe does
[21:54:47] http://technet.microsoft.com/en-us/library/cc722487.aspx
[21:54:53] "Ten immutable laws of security"
[21:55:04] #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore
[22:00:28] halr9000: Did Matt discover any WMI vulns during pen testing?
[22:00:32] VBA (excel) macro to do what he just did:
[22:00:33] Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Long, lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, ByVal lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long
[22:01:51] Does he consider PowerShell a vulnerability, or does it just make it easier to do what he could otherwise have done?
[22:03:22] ## Did Matt discover any WMI vulnerabilities during his testing?

The Question

Super Power: Omnipotence!
Resources


Get Windows Update info from PowerShell


Jeff Hicks presents PowerShell in Nutshell


Josh Atwell has a function to make cloning VMware VMs easier


Boe Prox wrote about managing remote services


Don Jones teaches many ways to create custom objects


Tips


Sean Kearney shows us how to explore cmdlet parameters


Monitor Memory usage from your PowerShell prompt


Use the range operator to build consecutive computer names


Quickly find folders in a directory listing


Manage cookies with PowerShell