When it comes to penetration testing,
you will find that you need to download and execute files,
and this can be to spawn reverse shells or to run an exploit,
or for other reasons.
Having the ability to run or download files using built‑in tools
within the operating system is really beneficial.
This is what we call living off the land.
Some of the benefits are that it can be applications
that are already white‑listed,
or applications that can help evade endpoint security.
Within Windows, PowerShell gives you that ability.
You can use it to download and execute files entirely
within the process of PowerShell itself.
This is great because it avoids dropping any artifacts to the disk,
therefore not leaving much of a forensic trail behind.
Within PowerShell,
there are two primary ways that you can use to download these files.
The one is downloading it to disk via PowerShell,
which is what you don't really want to use,
and then the other one, like I mentioned earlier,
is to leverage the PowerShell process within memory and download
and execute a script within that same process.
Now there are a few different methods that you can use,
for example, what you see on your screen,
the Net.WebClient.DownloadString,
that is a method that can be used to download and
execute files within the process memory.
And let's take a look at a few examples.
Currently,
this machine does not have PowerView or the PowerSploit
suite loaded within the PowerShell modules,
and to confirm this, I will run one of the PowerView commands,
which is the Get‑NetDomain, to show me information about the domain.
And we see from the error that this is not a recognized command.
So let's go ahead and load the PowerView module
using PowerShell entirely in memory.
I've gone ahead and crafted a download cradle and here we
are using the invoke expression followed by the
Net.WebClient and the DownloadString.
The URL is my Kali machine, and I'm pointing to the PowerView module.
So let's go ahead and try the same command that we've tried
earlier and see what the results are.
And sure enough, I get results.
So this is one way that you can use to run scripts within PowerShell's memory.
The great thing about this command is that you can use it within Command
prompt as well; you just need to change the quotation marks.
Instead of using double quotes, within Command prompt,
you will use a single quote.
Within PowerShell,
you can also go one step further and break the PowerShell
commands up so that you can instantiate it in different
lines using different variables, and let me show you an example of this.
The first line is used to instantiate our System.Net.WebClient class,
and I'm doing it as a $downloader variable.
I'm going one step further and making use of the Headers.Add method,
and this is a type of evasion method that you can use to
evade detection mechanisms that may be flagging
communication on abnormal user agents.
So here, I have defined a number of different agents,
but of course, you can tweak it to a specific agent that you would like to use.
The next variable that I'm using is the $payload variable,
and here, I've got a script, which I'm hosting on my Kali Linux machine.
Now for the sake of the demonstration, this is just a simple script,
which is going to dump all of the processes within this computer,
but of course, you can tweak this to make use of a PowerSploit script,
or any other PowerShell script that you would like to use.
And then the $command variable is actually combining the two variables
above that so that we can run this as one single command.
Now, when I go ahead and hit Enter,
PowerShell will download and execute this within the memory,
and here we've got all of our processes.
Now you may be wondering, what about systems that have a proxy?
Could I use PowerShell to leverage that proxy?
Well, the answer is yes, you can.
So let's take a look at the same command that we've just run,
but this time we can add in the proxy variable.
So here, you can see three additional lines.
The first one is we are using the GetSystemProxy,
which is going to look at the proxy that is currently set up on the system.
We're then going to go ahead and make use of the current default
credentials that exist within the proxy credential cache,
and then we're going to make use of the $downloader.Proxy to ensure
that we're using the proxy to download the script.
And then, of course, we execute the command and we get the results.
Another class that would also be beneficial to make
use of is the Net.WebClient class.
This can also be used to download and execute scripts in the target memory.
A sample of that type of execution script would look something like this.
The first thing that we are doing is we are defining the
System.Net.WebRequest class as the request variable.
Create a response variable,
which is going to be used to store the WebRequest response.
Then finally, we're going to make use of the invoke expression alias,
which is going to invoke the System.IO.StreamReader and execute the code.
Now, you may notice that there's something different here.
I am using a .gif file instead of a PS1 file.
Now, this is another invasion technique that you can make use of.
PowerShell is able to execute a script irrespective of its name.
So, although my script is names.gif, if you look at the code,
it's actually a PowerShell code within that file.
So let's go ahead and hit Enter, and we see that we get the results back.
Now, this WebClient class can also be used with a proxy service,
and all you need to do is make use of those same proxy
commands that we've used before.
Another type of evasion that I would like to show
you is making use of Com Objects.
These Com Objects can be used to both download and
execute scripts on a target machine.
The one that I'm going to use is the Msxml2.XMLHTTP object.
When you use a Com Object, these objects are already proxy aware.
That means that you do not need to go and configure proxy; it
will automatically be configured for you.
So the script that I'm using is pretty much similar to what we've used before.
I'm declaring the class, or the object, that I would like to use.
I'm defining the GET request of this object,
again, using my .gif file instead of a PS1 file,
and then I'm going to go ahead and get the response
of that $downloader variable.
As I hit Enter, I will get the results.
As you play around with your evasion techniques,
when you make use of variables listed out like this,
you can also put them in one line.
All you need to do is use a semicolon to break up the different commands.
So here we can see that PowerShell is a great living‑off‑the‑land tool
that you can use to execute malicious scripts in memory.
Now as you do some research on the internet and take a look
at the more information of this module,
you will see that there are tons of different evasion
techniques that you can leverage on PowerShell.
I encourage you to take a look at those evasion techniques and
try them out in your own lab environment.