The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
73 views

Powershell opened up, switched to administrator mode and ran scripts all without me touching my computer. How worried should I be?

I'm on a laptop running Window 8.1 connected to the internet running Kaspersky. I am the sole user and administrator of this laptop. While going about my usual work, I paused for a moment (hands off ...
0
votes
1answer
54 views

Windows netsh pivoting

I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. ...
0
votes
0answers
87 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
1
vote
1answer
179 views

What causes a powershell payload to run the first time but not the second?

I created a windows/meterpreter/reverse_https powershell payload using the python script provided at the end of this article. In the first run, the meterpreter session opened successfully, when I ...
-1
votes
3answers
492 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...
10
votes
2answers
588 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
4
votes
1answer
3k views

Checklist for configuring WinRM Security settings on servers

WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited. In other words, insecurity ...
5
votes
1answer
274 views

What is the security impact of changing PowerShell's PSLanguageMode?

A vendor is asking me to change the PSLanguageMode from within IIS on my Exchange server(s). What potential vulnerabilities am I opening myself up to? I'm surprised to see this option present within ...
5
votes
1answer
2k views

What are the security implications of enabling WINRM on all domain members?

As Powershell becomes more and more popular, it appears that using WINRM may end up being a better option than using PSEXEC from SysInternals for remote management. Given that WINRM is disabled by ...
10
votes
2answers
26k views

How is PowerShell's RemoteSigned execution policy different from AllSigned?

I'm still pretty new to PowerShell, and recently read this in a blog posting about creating and using PowerShell scripts. To prevent the execution of malicious scripts, PowerShell enforces an ...