colligomentis.com

obscuresecurity.blogspot.com

obscuresec: June 2013

http://obscuresecurity.blogspot.com/2013_06_01_archive.html

Sunday, June 30, 2013. Logging Keys with PowerShell: Get-Keystroke. I was recently inspired by Matt Graeber's. Series of posts on Microsoft's "Hey, Scripting Guy! To go back and look at old scripts and implement reflection. One of the scripts that I use regularly and mentioned in a previous post. A preferred method would be to hook each window with SetWindowsHookEx but there are several security products that flag on that behavior, so I avoided it. If you have read Matt's posts, then you understand why t...

obscuresecurity.blogspot.com

obscuresec: December 2012

http://obscuresecurity.blogspot.com/2012_12_01_archive.html

Wednesday, December 12, 2012. Finding Simple AV Signatures with PowerShell. Executed with the Inject-Shellcode. Was released by class101 which was used to demonstrate how some AV signatures could be bypassed by finding and modifying one byte within the binary. Unfortunately, the original file (and source code? Is no longer available for download by the author. Since the method still works, we decided to create a similar PowerShell script with a few improvements:. Do you want to create the directory?

obscuresecurity.blogspot.com

obscuresec: November 2012

http://obscuresecurity.blogspot.com/2012_11_01_archive.html

Friday, November 30, 2012. The amount of effort that goes into writing any book is substantial, but the amount of effort that goes into a great book is mind-boggling. " Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers, and Security Engineers. By TJ O'Connor is a great book. Despite the "cookbook" title, this book is well-organized and can be read cover-to-cover. If you are a security professional, you have already or will use the methods mentioned in the book. Exporting work...

obscuresecurity.blogspot.com

obscuresec: January 2013

http://obscuresecurity.blogspot.com/2013_01_01_archive.html

Monday, January 14, 2013. Automating Screenshots with PowerShell. There are applications that can take screenshots for you at regular intervals and in the past I used an AutoIt. Macro to printscreen and save. That works well when I am on my own machine, but what if I was at a kiosk or doing an insider assessment from one of their workstations? I needed a PowerShell script that could take a screenshot at regular intervals, time stamp it, save it to a file and not tamper with the contents of the clipboard.

obscuresecurity.blogspot.com

obscuresec: March 2014

http://obscuresecurity.blogspot.com/2014_03_01_archive.html

Monday, March 31, 2014. Retrieving NTDS.dit without a Shell on the DC. Combine that with PowerShell. And achieving a memory-resident shell, regardless of AV product,was trivial with PowerSploit. Armed with a fully-privileged shell on a seldom used backup server, I was in business. First lets look at the tokens on the box:. Of copying the NTDS.dit. But I prefer a simpler one. This technique relies on the Ntdsutil. File and download them both with Meterpreter:. Subscribe to: Posts (Atom). HID Reader Arduin...

obscuresecurity.blogspot.com

obscuresec: May 2014

http://obscuresecurity.blogspot.com/2014_05_01_archive.html

Monday, May 19, 2014. Modifying MAC properties with PowerShell. Laziness is the demise of Red Team engagements. Whether it is writing PsExec to a user's desktop. Utility. Meterpreter has TimeStomp. Which works on Windows and makes it easy to blend your files with files around it by modifying the MACE attributes. After a request to add the capability to PowerSploit. S Beacon. I asked Raphael. And he pointed me to a well-documented part of the Windows API. So naturally I headed over to pinvoke.net. Wow, we...

obscuresecurity.blogspot.com

obscuresec: Standard Disclaimer

http://obscuresecurity.blogspot.com/p/standard-disclaimer.html

I am opinionated and those opinions are mine and in no way represent my employer. You are welcome to disregard or disagree with me! I am not a programmer, coder or developer. I script on occasion, but often its for a strange purpose and of little value to others. PowerShell is helping me bridge the gap into learning .NET, but I will likely never be an expert. Thank you for reading and commenting. Subscribe to: Posts (Atom). Modifying MAC properties with PowerShell. View my complete profile. Creating Real...

obscuresecurity.blogspot.com

obscuresec: Dirty PowerShell WebServer

http://obscuresecurity.blogspot.com/2014/05/dirty-powershell-webserver.html

Sunday, May 18, 2014. I was recently asked why there wasn't a PowerShell entry in this great list of web-server one-liners. Of course it is possible, but not as easy as with other scripting languages. Web-servers are dangerous in the wrong hands, but testers use them all the time (not always safely). I have seen people upload utilities like Mongoose. To accomplish serving static files, but it can be accomplished with PowerShell and the .Net httplistener class. We will need to have admin rights to grab a ...

obscuresecurity.blogspot.com

obscuresec: April 2013

http://obscuresecurity.blogspot.com/2013_04_01_archive.html

Tuesday, April 30, 2013. Its been a few weeks and my tan (burn) is gone, but I wanted to write a quick post about my time at BSides Puerto Rico. It was an awesome conference and a great venue. Although it was Puerto Rico's first security conference, it certainly didn't feel that way. The people that put the conference together were professional and obviously worked their butts off to make it happen. For a small con, it had some nice amenities such as an upscale venue and lunch. Subscribe to: Posts (Atom).

obscuresecurity.blogspot.com

obscuresec: September 2013

http://obscuresecurity.blogspot.com/2013_09_01_archive.html

Tuesday, September 17, 2013. Hammer Instead of a Scalpel: Brute-force AV Evasion. Several years ago, I was on an engagement with Skip. Where we were faced with the common problem of antivirus evasion for callback binaries. The environment was such that we feared that any custom backdoor or tool would be submitted to an AV vendor so we wanted to use Meterpreter. Obviously, this was before the golden age of PowerShell. Of figuring that out. I felt pretty educated. Available now it's not a huge deal. I ...