The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
15 views

meterpreter/reverse_tcp handler other then metasploit's handler [duplicate]

Actually i am getting the error on metasploit handler "Connection reset by peer ssl_accept". On investigation, I came to know that I was running my powershell payload using powershell.exe (32 bit ...
3
votes
1answer
29 views

using netcat as a handler for windows/meterpreter/reverse_tcp payload

How we can use netcat as a handler for windows/meterpreter/reverse_tcp payload. I am getting the connection but unable to run any command.
-1
votes
0answers
6 views

kill process by its own description [migrated]

I need help for killing putty.exe by searching process for it's description even if the user change the name and the class name ( win title ) for the putty.exe if process description on process list ...
1
vote
1answer
42 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
2
votes
1answer
468 views

PowerShell's Module logging, a few questions

I'm looking for some more information concerning the white paper which goes into some detail over PowerShell's Module logging. Specifically, once this is enabled, are the default cmdlets logged? For ...
1
vote
0answers
19 views

script to temporarily block remote users from logging into a windows server during downtime [migrated]

I'm looking for a solution to the following issue: we have a windows server with a bunch of people logging in remotely to work on stuff; when we need to upgrade the server, we issue warnings via ...
1
vote
1answer
54 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
5
votes
1answer
384 views

What is the security impact of changing PowerShell's PSLanguageMode?

A vendor is asking me to change the PSLanguageMode from within IIS on my Exchange server(s). What potential vulnerabilities am I opening myself up to? I'm surprised to see this option present within ...
15
votes
2answers
35k views

How is PowerShell's RemoteSigned execution policy different from AllSigned?

I'm still pretty new to PowerShell, and recently read this in a blog posting about creating and using PowerShell scripts. To prevent the execution of malicious scripts, PowerShell enforces an ...
6
votes
1answer
68 views

What's the purpose of “ExecutionPolicy” settings in PowerShell if the “-bypass” switch circumvents it?

PowerShell's "ExecutionPolicy" allows for restricting all scripts from running, only allowing signed scripts, etc - see this article for reference. However, if I simply do: PowerShell ...
5
votes
3answers
476 views

Is this powershell script an infection?

While I was sitting in front of the computer not using it,my Windows 10 machine quickly flashed a few terminal windows, and then gave me a Windows Security popup, asking for my password. I have no ...
1
vote
0answers
18 views

IX509Extension XCN encoding?

I understand from reading MSDN that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject ...
4
votes
1answer
5k views

Checklist for configuring WinRM Security settings on servers

WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited. In other words, insecurity ...
3
votes
2answers
407 views

Powershell opened up, switched to administrator mode and ran scripts all without me touching my computer. How worried should I be?

I'm on a laptop running Window 8.1 connected to the internet running Kaspersky. I am the sole user and administrator of this laptop. While going about my usual work, I paused for a moment (hands off ...
0
votes
1answer
50 views

Unsafe to not provide full path to powershell script?

Is the following statement in a batch file unsafe? powershell -executionpolicy bypass -File .\test.ps1 test.ps1 is located in the same folder as the batch file. Is it possible to add something in ...
6
votes
3answers
493 views

Windows netsh pivoting

I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. ...
0
votes
0answers
56 views

How to prevent injection attacks powerscript scripts when dealing with user made variables

I have a large number of scripts with code looking like this: task "$argument" Which is then called by: powershell.Runspace.SessionStateProxy.SetVariable(argument, UserMadeValue); ...
3
votes
1answer
361 views

What causes a powershell payload to run the first time but not the second?

I created a windows/meterpreter/reverse_https powershell payload using the python script provided at the end of this article. In the first run, the meterpreter session opened successfully, when I ...
1
vote
0answers
425 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
1
vote
0answers
138 views

What is the security of Powershell “TrustedHosts”? (is it just a name match)?

Powershell has a TrustedHost section that is configured like this: winrm s winrm/config/client '@{TrustedHosts="CorpServer56"}' What security is implied for CorpServer56? Is it just an ASCII name ...
0
votes
0answers
415 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
-1
votes
3answers
676 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...
10
votes
2answers
898 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
6
votes
1answer
4k views

What are the security implications of enabling WINRM on all domain members?

As Powershell becomes more and more popular, it appears that using WINRM may end up being a better option than using PSEXEC from SysInternals for remote management. Given that WINRM is disabled by ...