How to Hack Like a Legend: Breaking Windows by Sparc Flow

Author:Sparc Flow [Flow, Sparc]
Language: eng
Format: epub
Amazon: B08YJYR4N7
Goodreads: 63121471
Published: 2022-08-18T21:48:32+00:00

PS C:\Lab> $scriptBlockLogging = $dict.getValue(””)[$key]

PS C:\Lab> $scriptBlockLogging[‘EnableScriptBlockLogging’] = 0

When executing this script on the target machine, we need not worry

about ATA, since these commands do not involve any network communica-

tion with the domain controller. QRadar, on the other hand, still poses a

real threat. This bypass command line is executed right before Script Block

Logging is disabled, which means that it will inevitably be logged as a Warning

under event 4104, as shown in Figure 8-3.

Figure 8-3: The bypass command line is logged under event 4104 as a Warning.

Notice that unlike this one, the other 4104 events were simply catego-

rized as Verbose. This categorization of Warning or Verbose happens in the

Windows Management Framework engine, which is the component execut-

ing PowerShell commands. The WMF engine checks any commands that

are run against a list of suspicious strings defined in the internal property

signatures of the public class ScriptBlock. Dangerous strings and functions,

like NonPublic, GetField, Add-Type, and many others, are automatically flagged

by the execution engine. QRadar is likely looking for any events in the

PowerShell log categorized as Warnings, so this will probably be picked up

by the security team if we run it in Strat Jumbo’s network. This is an unnec-

essary exposure that we should avoid in case it triggers a detection rule.

ScriptBlock is declared as a public class, so we can directly reference

it using the [ScriptBlock] object. However, the signatures field containing

the list of suspicious strings is private, so we resort to reflection once more

using the GetField and GetValue methods (Listing 8-1).

PS C:\> [ScriptBlock].GetField(‘signatures’,‘NonPublic,Static’).

GetValue($null)

Add-Type

DllImport

DefineDynamicAssembly

DefineDynamicModule

DefineType

—snip—

Listing 8-1: Viewing the list of strings defined in the signatures property of the

ScriptBlock class

92 Chapter 8

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.