Edit

Module 5: Windows Client-Side Attacks

Attacking Microsoft Office

Social Engineering and Spearphishing

Social Engineering is where an attacker tricks a user into disclosing secrets or engaging in risky technical actions via deception.

Spearphishing is a form of phishing in which an email is customized to the target, increasing likelihood of the victim succumbing to the attack.

Typically the attack comes in three forms:

  1. User solicitation

  2. Malicious attachment

  3. Malicious link

Installing Microsoft Office

This is specific to the OffSec labs.

Navigate to C:\tools\windows_client_side_attacks\ and double click the Office2019.img file to mount it. Run the installer Setup64.exe located in the Office directory on this new mount. Close the pop-up to begin a 7-day trial.

Using Macros

Macros are a series of command and instructions grouped together to accomplish a task programmatically.

Running Outlook with an empty PIM file

Setting up a listener for our infected attachment reverse shell to connect to

Protected View followed by Compatibility Mode both stop the macro from executing. In our scenario, we'll select Enable Editing followed by Enable Content so the macro executes.

Compared to a staged payload, a non-staged payload sends all of the shellcode at the same time. The attachment would contain the full reverse shell to be encoded and executed when opened by the user. Non-staged payloads are typically larger in size and present two problems. First, they may be too large for the deployment attachment or buffer. Second, they can be easier to detect by most endpoint anti-virus solutions.

Table of all SysmonEvents within the minute of downloading and running Meterpreter

Limiting the Sysmon events to ProcessCreate

Querying the FileCreate events

Querying the following events

Sysmon can be configured to save files that are deleted based on extension, including PowerShell scripts. The configuration entry for this is CopyOnDeleteExtensions.

Querying the DNSEvent created by the malicious attachment

When encountering network indicators of suspicious activity, it is worthwhile to check other resources in your environment such as firewalls and proxies. Reviewing these resources may mean the difference between a successful infection or a potential incident that was stopped with automated mechanisms.

Searching for NetworkConnect events with the identified IPv4 address

Monitoring Windows PowerShell

Introduction to PowerShell Logging

PowerShell logging can be enabled via group policy. The settings for PowerShell logging are located in Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell.

Local Group Policy Editor - Windows PowerShell settings

PowerShell Module Logging

Module logging records all pipeline execution events in PowerShell, showing the order and details of the executing activity.

Turn on Module Logging configuration
Wildcard selection for all Modules for Module Logging

Runnin Get-WMIObject to generate events

The event ID for module logging events is 4103.

Pipeline Execution events with Module Logging

Expanding an entry to view the content

Context entry of Get-WMIObect, Format-Table event

The Command Name is the cmdlet that initiated the pipeline execution. If it was a script, it would be shown beside Script Name. The Sequence Number tracks the order for PowerShell event execution while Pipeline ID is the unique ID for a given pipeline.

PowerShell Script Block Logging

Script block logging captures the contents of code contained within script blocks, including some deobfuscated commands.

Turn on PowerShell Script Block Logging configuration

Generating an event

The event ID for Script Block events is 4104.

Script Block event

Encoding a Get-Hotfix PowerShell cmdlet

Executing the encoded PowerShell command

Script block event for the encoded command

PowerShell Transcription

Transcription generates full records of a PowerShell session, with all input and output stored in a text file.

Information saved in a transcript is in cleartext, ensure these files are secured properly.

Turn on PowerShell Transcription configuration

Generating an event

Transcription file header information

Transcription logging input command and output

Case Study: PowerShell Logging for Phishing Attacks

Custom Function Get-PSLogEvent for PowerShell logs

Extra Mile

In regards to the Extra_Mile.msg:

  1. Identify the .exe that runs the malicious .hta file with Sysmon.

  2. Identify the PowerShell script block and module log events generated by the malicious attachment.

  3. Find the malicious attachment activity in a PowerShell transcription log.

Obfuscating/Deobfuscating Commands

Obfuscation is not the same as encoding. Encoding is a translation that is meant to be converted and restored using the same encoding scheme. Obfuscation is the deliberate act of makin something harder to understand for evasive purposes.

LogoGitHub - danielbohannon/Invoke-Obfuscation: PowerShell ObfuscatorGitHub

Invoke-Obfuscation Menu

Setting Script Block command for Invoke-Obfuscation

Invoke-Obfuscation: Obfuscating command tokens menu

Invoke-Obfuscation: Obfuscated Cmdlets

Moving back to the Token submenu

Invoke-Obfuscation: Obfuscating argument tokens menu

Invoke-Obfuscation: Obfuscated Arguments

Showing optiosn in Invoke-Obfuscation

Obfuscated command generating expected results

Script Block Log event for obfuscated command

Module Log event for obfuscated command

LogoGitHub - danielbohannon/Revoke-Obfuscation: PowerShell Obfuscation Detection FrameworkGitHub

Importing Revoke-Obfuscation module

Obfuscated PowerShell script

Exporting PowerShell log events using wevtutil

Deobfuscated PowerShell script from Event Logs

PreviousModule 4: Windows Server Side AttacksNextModule 6: Windows Privilege Escalation

Last updated