Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [powershell]

task automation and configuration management CLI for Windows, the first release was in Windows XP SP2 in 2006

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Why is running an exe created from ADS, failing in Win-11 with incompatibility of 64-bit OS?

I'm experimenting with ADS (Alternative Data Streams), and tried to create a text file with the calc.exe embedded in an ADS. I used the following steps to do this: "Hello" >t2.txt Get-...
not2qubit's user avatar
  • 275
0 votes
0 answers
25 views

Minimal permissions for EXCEL COM operations

I have a situation where i'm trying to limit the required permissions for an account that leverages Excel COM / process operations. Worth to be noted, this account is an AD Managed Service Account. ...
Segfault's user avatar
0 votes
0 answers
117 views

How to force persistent privacy & security best practice settings on Windows

Some of you might know privacy.sexy. It gives you plenty of options regarding your Windows privacy and security settings. However, after a major Windows update, those settings will be reset by Windows....
Dr3xler's user avatar
  • 308
0 votes
0 answers
77 views

Can already opened event logs of PowerShell's event properties screens on Windows be hacked by hackers in milliseconds?

I am wondering some issues about event log safety of powershell. I think is it possible to alter the powershell itself. But theorically the event log should show us every attempt made in powershell ...
kurosakichigoo's user avatar
0 votes
0 answers
9 views

Seeking advice for possible virus [duplicate]

I have grown suspicious because I just witnessed powershell opening and immediately closing very fast and multiple times, probably 15 times. After that, the same happened with schtasks.exe. The ...
user294710's user avatar
4 votes
2 answers
615 views

How to find the process that is running PowerShell commands that appear in Windows Defender

On one of our Windows Datacenter 2016, there's an alert that a trojan is trying to install : The following PowerShell commands are trying to execute at seemingly random hours of the day (always ...
Maxime's user avatar
  • 139
1 vote
0 answers
100 views

Bypassing Office365 Server Send As Denial [closed]

I am trying to send an e-mail via Windows Powershell ISE using Office365's hosting server, on behalf of another user which is specified in FROM part of the code using. But when I try to do this, I get:...
KontrCode's user avatar
1 vote
2 answers
213 views

API Client Secrets are Being Logged in Plaintext (PowerShell Logs)

I'm currently implementing a PowerShell script to call the Sophos API (https://developer.sophos.com/intro). Write-Output "`nEnter the Sophos API key / client secret." $ClientSecret = Read-...
TheCyberWarden's user avatar
1 vote
0 answers
394 views

Is it safe to disable certificate checking?

I am developing a web API, which runs only on my local computer, and using PowerShell to test it. Here is an example test: $baseUri = 'https://localhost:5001' $body = '{ "title": "...
Matt Cassinelli's user avatar
1 vote
0 answers
237 views

Intercept API calls of powershell module

I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
LucaBonadia's user avatar
0 votes
0 answers
464 views

Invoke GetProcAddress returns nothing

I try to execute a meterpreter shellcode to a windows machine. In order to bypass the AV, I try to load the shellcode in the memory thanks to the DelegateType Reflection technique. Below, the first ...
salt's user avatar
  • 259
-1 votes
1 answer
307 views

PowerShell - privilege escalation [closed]

In the past, I have used the Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. However, I am looking for a similar script, but I ...
Asparuh Gavrailov's user avatar
4 votes
1 answer
461 views

Is there a way to run a downloaded powershell script as admin without setting a global ExecutionPolicy bypass?

Since the 20H2 build of Windows 10 came out, if I want to run a script without copying and pasting it into a PowerShell window, I have to write the following command: Set-ExecutionPolicy -...
leeand00's user avatar
  • 1,441
1 vote
1 answer
2k views

How to run PrintSpoofer in memory from powershell?

PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
PaperTsar's user avatar
  • 123
0 votes
1 answer
293 views

How can I modify Windows registry programmatically? [closed]

Which programming language I can use to modify Windows registry? Can I use js or powershell?
Fatih Durmuş's user avatar
1 vote
1 answer
1k views

Possible to create a self-signed certificate with AIA extension using PowerShell or openssl?

I am able to use the PowerShell New-SelfSignedCertificate cmdlet to create a self-signed cert just fine, but I'd like to create one with an AIA extension and give it an OCSP responder URL. There is a ...
ericOnline's user avatar
8 votes
1 answer
354 views

Is this Windows local code execution bug also a security vulnerability?

I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. I would like to read other opinions. ...
Enos D'Andrea's user avatar
1 vote
1 answer
329 views

Learn Bash or Powershell for Security Work? [closed]

Is Bash more commonly used in security work than PowerShell? If so, why? (Now that Powershell can be used on Linux) I tried to Google around for an answer on this, and the only questions we seem to ...
VSO's user avatar
  • 523
0 votes
1 answer
1k views

How can I execute a base64 encoded exe stored as a variable, inside a powershell script without writing any files?

Basically if I have exe1 encoded with base64 and I copy that encoded source into a powershell script as a variable. I want to be able to decode it and execute the source exe without writing the exe to ...
404's user avatar
  • 3
-1 votes
1 answer
204 views

Metasploit shell non-responsive

Metasploit successfully executes the exploit, but after that, I get a non-responsive shell: Do you know what could be the problem here?
Grokhtar's user avatar
1 vote
1 answer
165 views

How does one tighten up their git repo security for Powershell?

Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after ...
leeand00's user avatar
  • 1,441
3 votes
1 answer
7k views

How do I stabilize a reverse shell in when the attack box is using powershell?

I've managed to get a version of netcat onto my Windows machine and I can run the standard: nc -lvnp 1234 and this properly connects to the victim's machine, but it's a very fragile connection. Ctrl +...
user248411's user avatar
0 votes
0 answers
699 views

autorunscript metasploit

I'm trying to run the following autoscript use exploit/multi/handler set payload … set lhost set lport set AutoRunScript multi_console_command -r /root/script.rc set ...
stack2020's user avatar
2 votes
2 answers
3k views

Getting an Interactive Powershell Reverse Shell Using socat

I've read that socat is capable of creating interactive shells. I'd like to create an interactive Powershell shell. Kali Listener # socat - tcp4-listen:1338 Windows (socat.exe used from here: https://...
RandomDisplayName45463's user avatar
0 votes
1 answer
258 views

Why Invoke-ReflectivePEInjection not recognized [closed]

I was trying Invoke-ReflectivePEInjection by doing .\Convert-BinaryToString Convert-BinaryToString C:\file.exe $InputString="base64string" $PEBytes=[System.Convert]::FromBase64String($InputString) ...
ampf27's user avatar
  • 3
0 votes
0 answers
822 views

Powershell (WinRM) and cmd.exe: reg query output deviation

during a CTF I encountered the following anomaly regarding PS & cmd.exe: I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
Andres R's user avatar
2 votes
1 answer
480 views

Is running Powershell always as administrator a good practice?

I work as software engineer in a company. The IT deparment has decided to forbid powershell execution from our computers as part of the actions they are implementing to avoid Emotet malware. As ...
joanlofe's user avatar
  • 131
1 vote
1 answer
637 views

Would my USB interface be infected if I attached and immediately detached an infected USB device?

Two days ago, someone gave me their pen drive to copy some songs from. As soon as I inserted the drive into my laptop's USB interface, Windows Defender immediately warned me that the drive was ...
Water Cooler v2's user avatar
1 vote
0 answers
173 views

Calling Powershell script from external program passing an argument

I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
Geo V's user avatar
  • 11
1 vote
0 answers
427 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
bigder's user avatar
  • 11
1 vote
2 answers
2k views

Can a PowerShell script inside a Zip file execute automatically upon unzipping?

I have a zip file that has a Powershell script inside that I want to look at. Is it possible that the Powershell script could execute automatically just by unzipping the file? This is not something I ...
Brent's user avatar
  • 11
1 vote
2 answers
352 views

What causes Windows security logs saying an attempt was made to reset an account's password?

This falls under the category of eliminating what might be normal activity from my attention. I'm looking at Windows 7 security event logs. I don't have context to know if the following event is a ...
mcgyver5's user avatar
  • 6,864
1 vote
1 answer
1k views

How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?

The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
n00b's user avatar
  • 465
1 vote
0 answers
392 views

How should you configure PowerShell logs permissions?

I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that it is secure (Attackers cannot gain sensitive data out of it) it helps in DFIR (digital forensic and ...
Ville's user avatar
  • 19
1 vote
2 answers
170 views

Insider threat mitigation sql databases

I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
bain2236's user avatar
5 votes
1 answer
1k views

What security implications are involved when using a CSV file to fill a SQL table?

I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers. I am using a script based on the one ...
techguy1029's user avatar
-1 votes
1 answer
311 views

Java web app hosted in tomcat hanged for more than 10 min with logs containing powershell attack

We have a java web application running in tomcat which is hosted in AWS. The operating system used in the server is Centos. Today it become inaccessible for more than 10 minutes. When we got access, ...
Shakir's user avatar
  • 1
0 votes
1 answer
342 views

How do I prevent someone from using my certificate to sign a malicious script on my PC?

The first step to make Powershell more secure is to create a certificate to sign my scripts. Then you actually sign it with this command: Set-AuthenticodeSignature -FilePath myScript.ps1 -Certificate ...
BadSnowflake's user avatar
2 votes
1 answer
2k views

How to retrieve Kerberos Service tickets?

I am learning Kerberoasting see below are my steps that I am following. Step:1. Attacker will find the SPN's Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
Utkarsh Agrawal's user avatar
1 vote
1 answer
1k views

What is this PowerShell script sending Discord info to random server?

Upon turning on my personal Windows 10 computer tonight, I was greeted with ConEmu telling me that two PowerShell commands were run at startup. Both commands were the same thing: powershell -...
Mike Boch's user avatar
0 votes
2 answers
912 views

Windows - How to restrict access to VBScript.dll and JScript.dll?

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform. Recorded Future ...
RealDrGordonFreeman's user avatar
1 vote
0 answers
559 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
md154199's user avatar
0 votes
1 answer
91 views

Extensions and Modules and Packages, Oh My! [closed]

How do you know if extensions (e.g., Code, Chrome, Firefox), modules (e.g., PowerShell), or packages (e.g., Python, R) are not malicious? How can you control or monitor that in an environment? Stuff ...
E.V.I.L.'s user avatar
  • 125
4 votes
2 answers
593 views

Did I just infect my machine?

I just ran an AVI file that was sent to me, thinking AVIs were safe. Turns out it was a windows shortcut with this in the path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoPr -WINd 1 ...
Brad Irby's user avatar
  • 141
2 votes
1 answer
113 views

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
lawndoc's user avatar
  • 23
1 vote
4 answers
265 views

why do I get an email with address of Me'.exe'

I am wondering if there is a security issue with this. I use Mozilla, and I got an email with Me, '.exe' <[email protected]>. I have never seen this. What is it? Is it a way to send mass email? ...
Sam's user avatar
  • 11
5 votes
2 answers
2k views

Powershell says microsoft's own ps1 script is insecure, should I proceed with running the script?

I am trying to update Powershell to version 5.1 which I have downloaded directly from Microsoft's website. The download's are signed from Microsoft (although the signatures are expired by a few ...
MXBuster's user avatar
0 votes
1 answer
494 views

Is this type of encryption one-way?

I am writing a Powershell script that requires a privileged account to do something. Of course, I'm not going to include the password of this account in the .ps1 file in clear text so I am following ...
Matthias's user avatar
  • 115
3 votes
0 answers
279 views

Cortana password bypass CVE-2018-8140

Recently a vulnerability in Microsoft's Cortana (CVE2018-8140) has been patched. Mcafee made a blog post about it explaining some background information. There is also a video showing a Proof of ...
toom's user avatar
  • 584
1 vote
0 answers
90 views

Are the interactive methods of credential gathering listed here actually secure, since they dont store the credentials on disk?

I found an article about different ways to collect and pass credentials in powershell. The author states that some of these methods are 100% secure (which is obviously an exaderation) but for ...
leeand00's user avatar
  • 1,441