The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
21 views

Some Windows servers do not seem to have RSA certificates. What is wrong?

Some Windows Server 2012 machines have certificates. Some do not. I am running this command: Get-ChildItem -Path Cert:\CurrenterUser\My | Where-Object { $_.PrivateKey -is [System.Security....
0
votes
0answers
16 views

Does running a PowerShell script using an embedded System.Managment.Automation DLL prevent it from being scanned by AMSI?

A new feature called Antimalware Scan Interface, that allow AVs to 'see' Powershell commands executed, was introduced in Powershell v5. According to adsecurity, this feature seems to rely on the ...
0
votes
1answer
40 views

Feeding Azure portal logs into a SIEM solution

Currently working on a cloud transformation project where all infrastructure is being placed into Azure. We currently use a SIEM solution to monitor and assess events across the environment. The ...
1
vote
1answer
20 views

Is it always safe to type [i.e. run Get-Content] on a file in PowerShell?

Supposedly an attacker sends me a malicious readme.txt and I'm going to open PowerShell and run type readme.txt. Can the attacker via any sort of control char sequences or using any other technique ...
1
vote
3answers
64 views

Powershell scripts inside meterpreter sessions

I have aquestion i tried to answer myself without much success. I love all the powershell script provided for post exploitation purposes -> Powersploit; Nishang etc... My only problem is that i can't ...
0
votes
0answers
57 views

how to start a reverse meterpreter session with powershell

I'm doing some pentesting training. Since powershell scripts more easily allow to bypass antivirus protection I wanted to start a meterpreter session with a powershell script. Here is how I generated ...
0
votes
0answers
15 views

meterpreter/reverse_tcp handler other then metasploit's handler [duplicate]

Actually i am getting the error on metasploit handler "Connection reset by peer ssl_accept". On investigation, I came to know that I was running my powershell payload using powershell.exe (32 bit ...
3
votes
1answer
92 views

using netcat as a handler for windows/meterpreter/reverse_tcp payload

How we can use netcat as a handler for windows/meterpreter/reverse_tcp payload. I am getting the connection but unable to run any command.
1
vote
1answer
58 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
1
vote
1answer
75 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
6
votes
1answer
100 views

What's the purpose of “ExecutionPolicy” settings in PowerShell if the “-bypass” switch circumvents it?

PowerShell's "ExecutionPolicy" allows for restricting all scripts from running, only allowing signed scripts, etc - see this article for reference. However, if I simply do: PowerShell -...
1
vote
0answers
20 views

IX509Extension XCN encoding?

I understand from reading MSDN that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject ...
0
votes
1answer
58 views

Unsafe to not provide full path to powershell script?

Is the following statement in a batch file unsafe? powershell -executionpolicy bypass -File .\test.ps1 test.ps1 is located in the same folder as the batch file. Is it possible to add something in ...
6
votes
4answers
653 views

Is this powershell script an infection?

While I was sitting in front of the computer not using it,my Windows 10 machine quickly flashed a few terminal windows, and then gave me a Windows Security popup, asking for my password. I have no ...
0
votes
0answers
62 views

How to prevent injection attacks powerscript scripts when dealing with user made variables

I have a large number of scripts with code looking like this: task "$argument" Which is then called by: powershell.Runspace.SessionStateProxy.SetVariable(argument, UserMadeValue); powershell....
2
votes
1answer
588 views

PowerShell's Module logging, a few questions

I'm looking for some more information concerning the white paper which goes into some detail over PowerShell's Module logging. Specifically, once this is enabled, are the default cmdlets logged? For ...
1
vote
0answers
457 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
3
votes
2answers
457 views

Powershell opened up, switched to administrator mode and ran scripts all without me touching my computer. How worried should I be?

I'm on a laptop running Window 8.1 connected to the internet running Kaspersky. I am the sole user and administrator of this laptop. While going about my usual work, I paused for a moment (hands off ...
6
votes
3answers
536 views

Windows netsh pivoting

I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. ...
0
votes
0answers
436 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
1
vote
0answers
147 views

What is the security of Powershell “TrustedHosts”? (is it just a name match)?

Powershell has a TrustedHost section that is configured like this: winrm s winrm/config/client '@{TrustedHosts="CorpServer56"}' What security is implied for CorpServer56? Is it just an ASCII name ...
3
votes
1answer
386 views

What causes a powershell payload to run the first time but not the second?

I created a windows/meterpreter/reverse_https powershell payload using the python script provided at the end of this article. In the first run, the meterpreter session opened successfully, when I ...
-1
votes
3answers
695 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...
10
votes
2answers
929 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
4
votes
1answer
5k views

Checklist for configuring WinRM Security settings on servers

WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited. In other words, insecurity ...
5
votes
1answer
402 views

What is the security impact of changing PowerShell's PSLanguageMode?

A vendor is asking me to change the PSLanguageMode from within IIS on my Exchange server(s). What potential vulnerabilities am I opening myself up to? I'm surprised to see this option present within ...
6
votes
1answer
4k views

What are the security implications of enabling WINRM on all domain members?

As Powershell becomes more and more popular, it appears that using WINRM may end up being a better option than using PSEXEC from SysInternals for remote management. Given that WINRM is disabled by ...
16
votes
2answers
36k views

How is PowerShell's RemoteSigned execution policy different from AllSigned?

I'm still pretty new to PowerShell, and recently read this in a blog posting about creating and using PowerShell scripts. To prevent the execution of malicious scripts, PowerShell enforces an ...