1. Pentesting with Powershell
by Rajganesh Pandurangan

2. Rajganesh (Raj) Pandurangan - OSCP, CISSP, CEH, QSA, PA-QSA MCSD.NET
Senior Managing Consultant at U.S.Bank
16 years of security consulting experience
Results-driven success across a multitude of Fortune 100 companies
Consulting Services
Web Application security assessment.
Mobile security assessment.
Network penetration testing.
Wireless security testing.
Security code review.
Payment Card Industry Assessment
Security GAP assessment.
Implementing effective security solutions and strategies

3. Web Applications and Exploitation Distro (WAED)
Site:
Features:
WAED is based on Debian 8.0 distribution.
Use Docker to provide sandboxed environment
Pre-installed web application testing tools
13 pre-installed vulnerable web application
Each application can be started separately
DEMO

4. What is Powershell Microsoft attempt to make admins use command line
Task automation and configuration management framework
Command line shell and scripting language
Built on .NET framework
Provides full access to WMI and COM
Perform administrative tasks on local and remote windows systems
Great for log parsing and WMI queries
Available by default on Windows 7 and up

5. Contd.. Security Lot of work in DFIR -http://www.invoke-ir.com
DLL injection
WMI Abuse
Hard to protect against attacks

6. Pentesting Methodology

7. (Firewall, IDS, IPS, DNS, DHCP)
Host Machine
(Mac)
Kali Linux
External Testing
External
DMZ
PFSENSE -port 80, 443
(Firewall, IDS, IPS, DNS, DHCP)
DHCP
Windows 2012
Domain Controller, DNS
Internal
Debian - WAED
Kali Linux
Internal Testing
Windows 7
Windows 8
Windows 10

8. Tools Required for Offensive Powershell
Nishang -
Powersploit -
Empire -
Posh-SecMod -
PSAttack -
PowerUPSQL - for-attacking-sql-server.html

9. Few Important Scripts Invoke-CredentialsPhish Import-module Port-Scan
out-csv, out-excel
Get-help
Get-NetComputer
Get-NetDomainController
Get-Netuser, Get-Netuser -user pentest3
Get-NetLocalGroup
Invoke-filefinder
Find-LocalAdminAccess
Invoke-UserHunter
Get-ServiceUnquoted
Invoke-TokenManipulation -enumerate
Invoke-TokenManipulation -createprocess "cmd.exe" -username "NT AUTHORITY\SYSTEM” (ls hklm:\security)
Get-PassHashes
Invoke-Mimikatz
Invoke-AllChecks
Get-GPPPassword
Invoke-CredentialsPhish

10. Powershell Empire http://www.powershellempire.com
Powerful post exploitation framework built on PowerShell
Integrates tools from Powersploit
Easily Extensible