Social Engineering is where an attacker tricks a user into disclosing secrets or engaging in risky technical actions via deception.
Spearphishing is a form of phishing in which an email is customized to the target, increasing likelihood of the victim succumbing to the attack.
Typically the attack comes in three forms:
User solicitation
Malicious attachment
Malicious link
Installing Microsoft Office
This is specific to the OffSec labs.
Navigate to C:\tools\windows_client_side_attacks\ and double click the Office2019.img file to mount it. Run the installer Setup64.exe located in the Office directory on this new mount. Close the pop-up to begin a 7-day trial.
Using Macros
Macros are a series of command and instructions grouped together to accomplish a task programmatically.
Setting up a listener for our infected attachment reverse shell to connect to
kali@attacker01:~/SOC-200/Windows_Client_Side_Attacks$ ./wcsa_met_443.sh 192.168.51.50
Initiating... please wait
[*] Using configured payload generic/shell_reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_https
LPORT => 443
LHOST => 192.168.51.50
[*] Started HTTPS reverse handler on https://192.168.51.50:443
Protected View followed by Compatibility Mode both stop the macro from executing. In our scenario, we'll select Enable Editing followed by Enable Content so the macro executes.
Compared to a staged payload, a non-staged payload sends all of the shellcode at the same time. The attachment would contain the full reverse shell to be encoded and executed when opened by the user. Non-staged payloads are typically larger in size and present two problems. First, they may be too large for the deployment attachment or buffer. Second, they can be easier to detect by most endpoint anti-virus solutions.
Table of all SysmonEvents within the minute of downloading and running Meterpreter
[192.168.51.10]: PS C:\Users\offsec> Import-Module C:\Sysmon\Get-Sysmon.psm1
[192.168.51.10]: PS C:\Users\offsec> Get-SysmonEvent $null "6/17/2021 15:10:00" "6/17/2021 15:11:00"
ProviderName: Microsoft-Windows-Sysmon
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
6/17/2021 3:10:43 PM 3 Information Network connection detected:...
6/17/2021 3:10:42 PM 3 Information Network connection detected:...
6/17/2021 3:10:42 PM 22 Information Dns query:...
6/17/2021 3:10:40 PM 11 Information File created:...
6/17/2021 3:10:40 PM 1 Information Process Create:...
6/17/2021 3:10:39 PM 11 Information File created:...
6/17/2021 3:10:39 PM 1 Information Process Create:...
6/17/2021 3:10:18 PM 3 Information Network connection detected:... 6/17/2021 3:10:17 PM 3 Information Network connection detected:... 6/17/2021 3:10:17 PM 3 Information Network connection detected:... 6/17/2021 3:10:12 PM 3 Information Network connection detected:...
6/17/2021 3:10:11 PM 15 Information File stream created:...
6/17/2021 3:10:10 PM 1 Information Process Create:...
6/17/2021 3:10:10 PM 11 Information File created:...
6/17/2021 3:10:10 PM 15 Information File stream created:...
6/17/2021 3:10:10 PM 11 Information File created:...
6/17/2021 3:10:10 PM 11 Information File created:...
6/17/2021 3:10:10 PM 11 Information File created:...
6/17/2021 3:10:10 PM 15 Information File stream created:...
6/17/2021 3:10:10 PM 11 Information File created:...
6/17/2021 3:10:10 PM 11 Information File created:...
6/17/2021 3:10:04 PM 1 Information Process Create:...
6/17/2021 3:10:04 PM 10 Information Process accessed:...
6/17/2021 3:10:04 PM 10 Information Process accessed:...
6/17/2021 3:10:04 PM 10 Information Process accessed:...
6/17/2021 3:10:04 PM 10 Information Process accessed:...
6/17/2021 3:10:03 PM 1 Information Process Create:...
6/17/2021 3:10:03 PM 1 Information Process Create:...
Sysmon can be configured to save files that are deleted based on extension, including PowerShell scripts. The configuration entry for this is CopyOnDeleteExtensions.
Querying the DNSEvent created by the malicious attachment
When encountering network indicators of suspicious activity, it is worthwhile to check other resources in your environment such as firewalls and proxies. Reviewing these resources may mean the difference between a successful infection or a potential incident that was stopped with automated mechanisms.
Searching for NetworkConnect events with the identified IPv4 address
PowerShell logging can be enabled via group policy.
The settings for PowerShell logging are located in Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell.
PowerShell Module Logging
Module logging records all pipeline execution events in PowerShell, showing the order and details of the executing activity.
Runnin Get-WMIObject to generate events
[192.168.51.10]: PS C:\Users\offsec> Get-WmiObject -Class Win32_Process | Format-Table ProcessId, ParentProcessId, Name; Write-Host (Get-Date)
ProcessId ParentProcessId Name
--------- --------------- ----
0 0 System Idle Process
4 0 System
92 4 Registry
316 4 smss.exe
348 604 svchost.exe
440 432 csrss.exe
...
Monday, June 14, 2021 1:25:53 PM
The event ID for module logging events is 4103.
Pipeline Execution events with Module Logging
[192.168.51.10]: PS C:\Users\offsec> Get-WinEvent -FilterHashtable @{Logname='Microsoft-Windows-PowerShell/Operational'; StartTime="6/14/2021 13:25:52"; EndTime="6/14/2021 13:25:54"; ID=4103}
ProviderName: Microsoft-Windows-PowerShell
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
6/14/2021 1:25:53 PM 4103 Information CommandInvocation(Out-Default): "Out-Default"...
6/14/2021 1:25:53 PM 4103 Information CommandInvocation(Write-Host): "Write-Host"...
6/14/2021 1:25:53 PM 4103 Information CommandInvocation(Get-Date): "Get-Date"...
6/14/2021 1:25:53 PM 4103 Information CommandInvocation(Get-WmiObject): "Get-WmiObject"...
...
Context:
Severity = Informational
Host Name = ServerRemoteHost
Host Version = 1.0.0.0
Host ID = bee883d3-7ebf-4e72-8f4a-70d283c190ac
Host Application = C:\Windows\system32\wsmprovhost.exe -Embedding
Engine Version = 5.1.19041.1151
Runspace ID = 6b83aae0-ef79-421f-a6a7-6563439d23f8
Pipeline ID = 13
Command Name = Get-WmiObject
Command Type = Cmdlet
Script Name =
Command Path =
Sequence Number = 26
User = CLIENT01\offsec
Connected User = CLIENT01\offsec
Shell ID = Microsoft.PowerShell
The Command Name is the cmdlet that initiated the pipeline execution. If it was a script, it would be shown beside Script Name. The Sequence Number tracks the order for PowerShell event execution while Pipeline ID is the unique ID for a given pipeline.
PowerShell Script Block Logging
Script block logging captures the contents of code contained within script blocks, including some deobfuscated commands.
Generating an event
[192.168.51.10]: PS C:\Users\offsec> { "This is a script block" }; Write-Host (Get-Date)
"This is a script block"
6/15/2021 2:49:43 PM
The event ID for Script Block events is 4104.
Script Block event
[192.168.51.10]: PS C:\Users\offsec\Documents> Get-WinEvent -FilterHashtable @{Logname='Microsoft-Windows-PowerShell/Operational'; StartTime="06/15/2021 14:49:42"; EndTime="06/15/2021 14:49:44"; ID=4104} | Format-List
TimeCreated : 6/15/2021 2:49:43 PM
ProviderName : Microsoft-Windows-PowerShell
Id : 4104
Message : Creating Scriptblock text (1 of 1):
{ "This is a script block" }; Write-Host (Get-Date)
ScriptBlock ID: e01d4655-46ad-44f8-a459-be392a6f8119
Path:
Identify the .exe that runs the malicious .hta file with Sysmon.
Identify the PowerShell script block and module log events generated by the malicious attachment.
Find the malicious attachment activity in a PowerShell transcription log.
Obfuscating/Deobfuscating Commands
Obfuscation is not the same as encoding. Encoding is a translation that is meant to be converted and restored using the same encoding scheme. Obfuscation is the deliberate act of makin something harder to understand for evasive purposes.
Invoke-Obfuscation Menu
PS /home/kali/SOC-200/Windows_Client_Side_Attacks> Import-Module ./Invoke-Obfuscation/Invoke-Obfuscation.psd1
PS /home/kali/SOC-200/Windows_Client_Side_Attacks> Invoke-Obfuscation
...
HELP MENU :: Available options shown below:
[*] Tutorial of how to use this tool TUTORIAL
[*] Show this Help Menu HELP,GET-HELP,?,-?,/?,MENU
[*] Show options for payload to obfuscate SHOW OPTIONS,SHOW,OPTIONS
[*] Clear screen CLEAR,CLEAR-HOST,CLS
[*] Execute ObfuscatedCommand locally EXEC,EXECUTE,TEST,RUN
[*] Copy ObfuscatedCommand to clipboard COPY,CLIP,CLIPBOARD
[*] Write ObfuscatedCommand Out to disk OUT
[*] Reset ALL obfuscation for ObfuscatedCommand RESET
[*] Undo LAST obfuscation for ObfuscatedCommand UNDO
[*] Go Back to previous obfuscation menu BACK,CD ..
[*] Quit Invoke-Obfuscation QUIT,EXIT
[*] Return to Home Menu HOME,MAIN
Choose one of the below options:
[*] TOKEN Obfuscate PowerShell command Tokens
[*] AST Obfuscate PowerShell Ast nodes (PS3.0+)
[*] STRING Obfuscate entire command as a String
[*] ENCODING Obfuscate entire command via Encoding
[*] COMPRESS Convert entire command to one-liner and Compress
[*] LAUNCHER Obfuscate command args w/Launcher techniques (run once at end)
Setting Script Block command for Invoke-Obfuscation
Invoke-Obfuscation: Obfuscating command tokens menu
Invoke-Obfuscation> token
Choose one of the below Token options:
[*] TOKEN\STRING Obfuscate String tokens (suggested to run first)
[*] TOKEN\COMMAND Obfuscate Command tokens
[*] TOKEN\ARGUMENT Obfuscate Argument tokens
[*] TOKEN\MEMBER Obfuscate Member tokens
[*] TOKEN\VARIABLE Obfuscate Variable tokens
[*] TOKEN\TYPE Obfuscate Type tokens
[*] TOKEN\COMMENT Remove all Comment tokens
[*] TOKEN\WHITESPACE Insert random Whitespace (suggested to run last)
[*] TOKEN\ALL Select All choices from above (random order)
Invoke-Obfuscation\Token> command
Choose one of the below Token\Command options to APPLY to current payload:
[*] TOKEN\COMMAND\1 Ticks --> e.g. Ne`w-O`Bject
[*] TOKEN\COMMAND\2 Splatting + Concatenate --> e.g. &('Ne'+'w-Ob'+'ject')
[*] TOKEN\COMMAND\3 Splatting + Reorder --> e.g.
&('{1}{0}'-f'bject','New-O')
Invoke-Obfuscation\Token\Command> back
Choose one of the below Token options:
[*] TOKEN\STRING Obfuscate String tokens (suggested to run first)
[*] TOKEN\COMMAND Obfuscate Command tokens
[*] TOKEN\ARGUMENT Obfuscate Argument tokens
...
Invoke-Obfuscation: Obfuscating argument tokens menu
Invoke-Obfuscation\Token> argument
Choose one of the below Token\Argument options to APPLY to current payload:
[*] TOKEN\ARGUMENT\1 Random Case --> e.g. nEt.weBclIenT
[*] TOKEN\ARGUMENT\2 Ticks --> e.g. nE`T.we`Bc`lIe`NT
[*] TOKEN\ARGUMENT\3 Concatenate --> e.g. ('Ne'+'t.We'+'bClient')
[*] TOKEN\ARGUMENT\4 Reorder --> e.g. ('{1}{0}'-f'bClient','Net.We')
[192.168.51.10]: PS C:\Users\offsec> Import-Module C:\tools\windows_client_side_attacks\Revoke-Obfuscation\Revoke-Obfuscation.psm1
WARNING: The names of some imported commands from the module 'Revoke-Obfuscation' include unapproved verbs that might make them less discoverable. To find the commands with unapproved verbs, run the Import-Module command again with the Verbose parameter. For a list of approved verbs, type Get-Verb.
