Social Engineering is where an attacker tricks a user into disclosing secrets or engaging in risky technical actions via deception.
Spearphishing is a form of phishing in which an email is customized to the target, increasing likelihood of the victim succumbing to the attack.
Typically the attack comes in three forms:
User solicitation
Malicious attachment
Malicious link
Installing Microsoft Office
This is specific to the OffSec labs.
Navigate to C:\tools\windows_client_side_attacks\ and double click the Office2019.img file to mount it. Run the installer Setup64.exe located in the Office directory on this new mount. Close the pop-up to begin a 7-day trial.
Using Macros
Macros are a series of command and instructions grouped together to accomplish a task programmatically.
Running Outlook with an empty PIM file
Setting up a listener for our infected attachment reverse shell to connect to
Protected View followed by Compatibility Mode both stop the macro from executing. In our scenario, we'll select Enable Editing followed by Enable Content so the macro executes.
Compared to a staged payload, a non-staged payload sends all of the shellcode at the same time. The attachment would contain the full reverse shell to be encoded and executed when opened by the user. Non-staged payloads are typically larger in size and present two problems. First, they may be too large for the deployment attachment or buffer. Second, they can be easier to detect by most endpoint anti-virus solutions.
Table of all SysmonEvents within the minute of downloading and running Meterpreter
Limiting the Sysmon events to ProcessCreate
Querying the FileCreate events
Querying the following events
Sysmon can be configured to save files that are deleted based on extension, including PowerShell scripts. The configuration entry for this is CopyOnDeleteExtensions.
Querying the DNSEvent created by the malicious attachment
When encountering network indicators of suspicious activity, it is worthwhile to check other resources in your environment such as firewalls and proxies. Reviewing these resources may mean the difference between a successful infection or a potential incident that was stopped with automated mechanisms.
Searching for NetworkConnect events with the identified IPv4 address
Monitoring Windows PowerShell
Introduction to PowerShell Logging
PowerShell logging can be enabled via group policy.
The settings for PowerShell logging are located in Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell.
Local Group Policy Editor - Windows PowerShell settings
PowerShell Module Logging
Module logging records all pipeline execution events in PowerShell, showing the order and details of the executing activity.
Turn on Module Logging configuration
Wildcard selection for all Modules for Module Logging
Runnin Get-WMIObject to generate events
The event ID for module logging events is 4103.
Pipeline Execution events with Module Logging
Expanding an entry to view the content
Context entry of Get-WMIObect, Format-Table event
The Command Name is the cmdlet that initiated the pipeline execution. If it was a script, it would be shown beside Script Name. The Sequence Number tracks the order for PowerShell event execution while Pipeline ID is the unique ID for a given pipeline.
PowerShell Script Block Logging
Script block logging captures the contents of code contained within script blocks, including some deobfuscated commands.
Turn on PowerShell Script Block Logging configuration
Generating an event
The event ID for Script Block events is 4104.
Script Block event
Encoding a Get-Hotfix PowerShell cmdlet
Executing the encoded PowerShell command
Script block event for the encoded command
PowerShell Transcription
Transcription generates full records of a PowerShell session, with all input and output stored in a text file.
Information saved in a transcript is in cleartext, ensure these files are secured properly.
Turn on PowerShell Transcription configuration
Generating an event
Transcription file header information
Transcription logging input command and output
Case Study: PowerShell Logging for Phishing Attacks
Custom Function Get-PSLogEvent for PowerShell logs
Extra Mile
In regards to the Extra_Mile.msg:
Identify the .exe that runs the malicious .hta file with Sysmon.
Identify the PowerShell script block and module log events generated by the malicious attachment.
Find the malicious attachment activity in a PowerShell transcription log.
Obfuscating/Deobfuscating Commands
Obfuscation is not the same as encoding. Encoding is a translation that is meant to be converted and restored using the same encoding scheme. Obfuscation is the deliberate act of makin something harder to understand for evasive purposes.
...
Context:
Severity = Informational
Host Name = ServerRemoteHost
Host Version = 1.0.0.0
Host ID = bee883d3-7ebf-4e72-8f4a-70d283c190ac
Host Application = C:\Windows\system32\wsmprovhost.exe -Embedding
Engine Version = 5.1.19041.1151
Runspace ID = 6b83aae0-ef79-421f-a6a7-6563439d23f8
Pipeline ID = 13
Command Name = Get-WmiObject
Command Type = Cmdlet
Script Name =
Command Path =
Sequence Number = 26
User = CLIENT01\offsec
Connected User = CLIENT01\offsec
Shell ID = Microsoft.PowerShell
[192.168.51.10]: PS C:\Users\offsec> { "This is a script block" }; Write-Host (Get-Date)
"This is a script block"
6/15/2021 2:49:43 PM
[192.168.51.10]: PS C:\Users\offsec\Documents> Get-WinEvent -FilterHashtable @{Logname='Microsoft-Windows-PowerShell/Operational'; StartTime="06/15/2021 14:49:42"; EndTime="06/15/2021 14:49:44"; ID=4104} | Format-List
TimeCreated : 6/15/2021 2:49:43 PM
ProviderName : Microsoft-Windows-PowerShell
Id : 4104
Message : Creating Scriptblock text (1 of 1):
{ "This is a script block" }; Write-Host (Get-Date)
ScriptBlock ID: e01d4655-46ad-44f8-a459-be392a6f8119
Path:
PS /home/kali/SOC-200/Windows_Client_Side_Attacks> Import-Module ./Invoke-Obfuscation/Invoke-Obfuscation.psd1
PS /home/kali/SOC-200/Windows_Client_Side_Attacks> Invoke-Obfuscation
...
HELP MENU :: Available options shown below:
[*] Tutorial of how to use this tool TUTORIAL
[*] Show this Help Menu HELP,GET-HELP,?,-?,/?,MENU
[*] Show options for payload to obfuscate SHOW OPTIONS,SHOW,OPTIONS
[*] Clear screen CLEAR,CLEAR-HOST,CLS
[*] Execute ObfuscatedCommand locally EXEC,EXECUTE,TEST,RUN
[*] Copy ObfuscatedCommand to clipboard COPY,CLIP,CLIPBOARD
[*] Write ObfuscatedCommand Out to disk OUT
[*] Reset ALL obfuscation for ObfuscatedCommand RESET
[*] Undo LAST obfuscation for ObfuscatedCommand UNDO
[*] Go Back to previous obfuscation menu BACK,CD ..
[*] Quit Invoke-Obfuscation QUIT,EXIT
[*] Return to Home Menu HOME,MAIN
Choose one of the below options:
[*] TOKEN Obfuscate PowerShell command Tokens
[*] AST Obfuscate PowerShell Ast nodes (PS3.0+)
[*] STRING Obfuscate entire command as a String
[*] ENCODING Obfuscate entire command via Encoding
[*] COMPRESS Convert entire command to one-liner and Compress
[*] LAUNCHER Obfuscate command args w/Launcher techniques (run once at end)
Invoke-Obfuscation> token
Choose one of the below Token options:
[*] TOKEN\STRING Obfuscate String tokens (suggested to run first)
[*] TOKEN\COMMAND Obfuscate Command tokens
[*] TOKEN\ARGUMENT Obfuscate Argument tokens
[*] TOKEN\MEMBER Obfuscate Member tokens
[*] TOKEN\VARIABLE Obfuscate Variable tokens
[*] TOKEN\TYPE Obfuscate Type tokens
[*] TOKEN\COMMENT Remove all Comment tokens
[*] TOKEN\WHITESPACE Insert random Whitespace (suggested to run last)
[*] TOKEN\ALL Select All choices from above (random order)
Invoke-Obfuscation\Token> command
Choose one of the below Token\Command options to APPLY to current payload:
[*] TOKEN\COMMAND\1 Ticks --> e.g. Ne`w-O`Bject
[*] TOKEN\COMMAND\2 Splatting + Concatenate --> e.g. &('Ne'+'w-Ob'+'ject')
[*] TOKEN\COMMAND\3 Splatting + Reorder --> e.g.
&('{1}{0}'-f'bject','New-O')
Invoke-Obfuscation\Token\Command> back
Choose one of the below Token options:
[*] TOKEN\STRING Obfuscate String tokens (suggested to run first)
[*] TOKEN\COMMAND Obfuscate Command tokens
[*] TOKEN\ARGUMENT Obfuscate Argument tokens
...
Invoke-Obfuscation\Token> argument
Choose one of the below Token\Argument options to APPLY to current payload:
[*] TOKEN\ARGUMENT\1 Random Case --> e.g. nEt.weBclIenT
[*] TOKEN\ARGUMENT\2 Ticks --> e.g. nE`T.we`Bc`lIe`NT
[*] TOKEN\ARGUMENT\3 Concatenate --> e.g. ('Ne'+'t.We'+'bClient')
[*] TOKEN\ARGUMENT\4 Reorder --> e.g. ('{1}{0}'-f'bClient','Net.We')
[192.168.51.10]: PS C:\Users\offsec> Import-Module C:\tools\windows_client_side_attacks\Revoke-Obfuscation\Revoke-Obfuscation.psm1
WARNING: The names of some imported commands from the module 'Revoke-Obfuscation' include unapproved verbs that might make them less discoverable. To find the commands with unapproved verbs, run the Import-Module command again with the Verbose parameter. For a list of approved verbs, type Get-Verb.
