Questions tagged [powershell]

task automation and configuration management CLI for Windows, the first release was in Windows XP SP2 in 2006

Filter by
Sorted by
Tagged with
7
votes
1answer
207 views

Is this Windows local code execution bug also a security vulnerability?

I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. Functionality The bug affects the context menu ...
0
votes
0answers
26 views

Get Spawned .exe of windows service via command line [migrated]

On the windows command line (preferably powershell), how can I see the process that a service spawns? using the powershell cmdlet get-service | select *, none of the properties for the service objects ...
0
votes
0answers
10 views

Grant "Read all properties” and “Create Computer objects” permissions to a Computer object [migrated]

Using a Powershell script how do I grant the "Read all properties” and “Create Computer objects” permissions to this Computer object: mylab.com/Computers/Cluster1. The permissions should be ...
1
vote
1answer
41 views

Learn Bash or Powershell for Security Work? [closed]

Is Bash more commonly used in security work than PowerShell? If so, why? (Now that Powershell can be used on Linux) I tried to Google around for an answer on this, and the only questions we seem to ...
0
votes
1answer
42 views

How can I execute a base64 encoded exe stored as a variable, inside a powershell script without writing any files?

Basically if I have exe1 encoded with base64 and I copy that encoded source into a powershell script as a variable. I want to be able to decode it and execute the source exe without writing the exe to ...
-1
votes
1answer
55 views

Metasploit shell non-responsive

Metasploit successfully executes the exploit, but after that, I get a non-responsive shell: Do you know what could be the problem here?
1
vote
1answer
52 views

How does one tighten up their git repo security for Powershell?

Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after ...
2
votes
0answers
400 views

How do I stabilize a reverse shell in when the attack box is using powershell?

So I've managed to get a version of netcat onto my windows machine and I can run the standard: nc -lvnp 1234 and this properly connects to the victim's machine, but it's a very fragile connection. ...
0
votes
0answers
220 views

How to prevent amsi bypass powershell Windows 10

I have found a well known way to bypass an antivirus solution and run well known malicious powershell scripts. The method is the 6+ year old way of shutting down amsi and running the powershell script ...
0
votes
0answers
40 views

Error while doing DCOM lateral movement

Current user is in "Distributed COM Users" group. Anyone can help with using DCOM for lateral movement? Getting this error: PS C:\> $ComputerName = "TEST-BOX" # Remote computer ...
0
votes
0answers
56 views

Any Recommended Windows 10 Process Mitigations

I am looking to do the maximum process mitigations for most processes (such as web browsers, document viewers, etc) on my Windows 10 machine (Via powershell's set-processmitigation). However, I can't ...
0
votes
0answers
43 views

ntlmrealyx powershell usage

I would like to know about your experience regarding the use of ntlmrelayx When using ntlmrelayx.py -tf targets.txt -c "Powershell command" does this powershell command need to be an Empire ...
0
votes
0answers
79 views

How to hide tcp port listener powershell script?

GOALS: run a powershell script without showing the window (it's ok if it pops up for few seconds). PROBLEM: the script tcplisten.ps1 works just if the window is displayed to the user. All the attempts ...
0
votes
0answers
82 views

autorunscript metasploit

I'm trying to run the following autoscript use exploit/multi/handler set payload … set lhost set lport set AutoRunScript multi_console_command -r /root/script.rc set ...
1
vote
1answer
677 views

Getting an Interactive Powershell Reverse Shell Using socat

I've read that socat is capable of creating interactive shells. I'd like to create an interactive Powershell shell. Kali Listener # socat - tcp4-listen:1338 Windows (socat.exe used from here: https://...
0
votes
1answer
66 views

Why Invoke-ReflectivePEInjection not recognized [closed]

I was trying Invoke-ReflectivePEInjection by doing .\Convert-BinaryToString Convert-BinaryToString C:\file.exe $InputString="base64string" $PEBytes=[System.Convert]::FromBase64String($InputString) ...
0
votes
0answers
476 views

Powershell (WinRM) and cmd.exe: reg query output deviation

during a CTF I encountered the following anomaly regarding PS & cmd.exe: I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
2
votes
1answer
92 views

Is running Powershell always as administrator a good practice?

I work as software engineer in a company. The IT deparment has decided to forbid powershell execution from our computers as part of the actions they are implementing to avoid Emotet malware. As ...
2
votes
1answer
240 views

Would my USB interface be infected if I attached and immediately detached an infected USB device?

Two days ago, someone gave me their pen drive to copy some songs from. As soon as I inserted the drive into my laptop's USB interface, Windows Defender immediately warned me that the drive was ...
1
vote
0answers
66 views

Calling Powershell script from external program passing an argument

I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
1
vote
0answers
196 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
0
votes
2answers
550 views

Can a PowerShell script inside a Zip file execute automatically upon unzipping?

I have a zip file that has a Powershell script inside that I want to look at. Is it possible that the Powershell script could execute automatically just by unzipping the file? This is not something I ...
1
vote
2answers
115 views

What causes Windows security logs saying an attempt was made to reset an account's password?

This falls under the category of eliminating what might be normal activity from my attention. I'm looking at Windows 7 security event logs. I don't have context to know if the following event is a ...
0
votes
1answer
218 views

How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?

The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
1
vote
0answers
139 views

How should you configure PowerShell logs permissions?

I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that it is secure (Attackers cannot gain sensitive data out of it) it helps in DFIR (digital forensic and ...
1
vote
2answers
96 views

Insider threat mitigation sql databases

I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
3
votes
1answer
416 views

What security implications are involved when using a CSV file to fill a SQL table?

I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers. I am using a script based on the one ...
-1
votes
1answer
127 views

Java web app hosted in tomcat hanged for more than 10 min with logs containing powershell attack

We have a java web application running in tomcat which is hosted in AWS. The operating system used in the server is Centos. Today it become inaccessible for more than 10 minutes. When we got access, ...
0
votes
1answer
126 views

How do I prevent someone from using my certificate to sign a malicious script on my PC?

The first step to make Powershell more secure is to create a certificate to sign my scripts. Then you actually sign it with this command: Set-AuthenticodeSignature -FilePath myScript.ps1 -Certificate ...
1
vote
1answer
514 views

How to retrieve Kerberos Service tickets?

I am learning Kerberoasting see below are my steps that I am following. Step:1. Attacker will find the SPN's Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
1
vote
1answer
634 views

What is this PowerShell script sending Discord info to random server?

Upon turning on my personal Windows 10 computer tonight, I was greeted with ConEmu telling me that two PowerShell commands were run at startup. Both commands were the same thing: powershell -...
0
votes
2answers
490 views

Windows - How to restrict access to VBScript.dll and JScript.dll?

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform. Recorded Future ...
1
vote
0answers
329 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
0
votes
1answer
29 views

Extensions and Modules and Packages, Oh My! [closed]

How do you know if extensions (e.g., Code, Chrome, Firefox), modules (e.g., PowerShell), or packages (e.g., Python, R) are not malicious? How can you control or monitor that in an environment? Stuff ...
4
votes
2answers
518 views

Did I just infect my machine?

I just ran an AVI file that was sent to me, thinking AVIs were safe. Turns out it was a windows shortcut with this in the path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoPr -WINd 1 ...
2
votes
1answer
41 views

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
1
vote
4answers
186 views

why do I get an email with address of Me'.exe'

I am wondering if there is a security issue with this. I use Mozilla, and I got an email with Me, '.exe' <myemail@server.com>. I have never seen this. What is it? Is it a way to send mass email? ...
4
votes
1answer
461 views

Powershell says microsoft's own ps1 script is insecure, should I proceed with running the script?

I am trying to update Powershell to version 5.1 which I have downloaded directly from Microsoft's website. The download's are signed from Microsoft (although the signatures are expired by a few ...
0
votes
1answer
335 views

Is this type of encryption one-way?

I am writing a Powershell script that requires a privileged account to do something. Of course, I'm not going to include the password of this account in the .ps1 file in clear text so I am following ...
3
votes
0answers
215 views

Cortana password bypass CVE-2018-8140

Recently a vulnerability in Microsoft's Cortana (CVE2018-8140) has been patched. Mcafee made a blog post about it explaining some background information. There is also a video showing a Proof of ...
1
vote
0answers
26 views

Are the interactive methods of credential gathering listed here actually secure, since they dont store the credentials on disk?

I found an article about different ways to collect and pass credentials in powershell. The author states that some of these methods are 100% secure (which is obviously an exaderation) but for ...
1
vote
0answers
486 views

How can I safely use Get-Credential to obtain a username and password for a set period of time for use as command line arguments?

Credentials in the form of SSH keys can be stored in memory using SSH Agent; However, if clicking the wrong link, or running a malicious program they can also be snatched from memory and sent ...
0
votes
3answers
10k views

How can I track executed PowerShell commands within a network?

I wanto to track PowerShell commands which are executed by users in the intranet. How can I do this? I need the user's information and their executed commands. Is it possible? Edit 1: I guess I can ...
0
votes
2answers
303 views

Have I created some kind of malware? [closed]

I am quite new to this type of stuff and I'm experimenting a little bit. This weekend I had some spare time and decided to joke around with VBScript and powershell. What I did is I wrote a VBScript ...
0
votes
2answers
266 views

Defending Against Empire

My understand of Empire is a framework that allows hackers to create listeners, and run code over the internet with the help of power shell through the use of DLL injections, Thread Injections, and ...
-1
votes
1answer
597 views

Does C# code running with PowerShell Add-Type set off anti-virus?

C# code can be included and executed in a PowerShell script using Add-Type. According to Microsoft: "Add-Type compiles the specified source code and generates an in-memory assembly that contains ...
1
vote
1answer
200 views

Give users a powershell script to run - Secure?

Is there a secure and practical way to give a group of users a powershell script to run on their laptops? The users all have active directory accounts, but their computers are not joined to any ...
-1
votes
4answers
741 views

Does a Turing complete shell means equal secure?

I have heard that Linux is more secure than Windows. Is that true? I think they are equally secure because both has a Turing complete shell so if you management to do harm on one system, there is a ...
2
votes
2answers
138 views

How do you find out if your PC is reverse shelled?

I am just wondering, how do you find out is your PC is reverse shelled or not? Does your antivirus protect against it?
4
votes
1answer
1k views

Powershell Empire - Token Impersonation

I have been struggling trying to get token impersonation to work in Empire 2.0. I use the credentials/mimitokens module to list and elevate to use a specific users token - I see mimikatz' output ...