In this demonstration,
we're going to walk through a simple PowerShell script.
We're going to break down each line
to understand what it is doing,
and then modify the script to enhance its functionality.
Now, this type of script is going to be used
more than likely doing post-exploitation,
once you gain a foothold into the target system.
The purpose of this script is to identify processes
that are running under the context of a specific user.
So, we see that identified here, right?
So, right now, we're focused on the administrator.
During a penetration test,
especially in the privilege escalation phase,
it is often important to know
what processes are running under privileged accounts
to identify potential targets for exploitation, okay?
So, again, here, this is where we're going to set
the user's variable to 'Administrator,' right?
So, we can change this to my name
or any other target user that we're looking for
during our penetration test, right?
So, then, we have this 'write-output' line right here,
line number three.
This just simply outputs a message,
indicating that the script is listing processes
running under this specific user account, okay?
So, we see write-output,
and this is going to print, "Listing processes
running under the user account user."
So, it's going to be administrator,
so it's going to substitute that for administrator,
it was my name, it was substituted for Jamario.
Then we have the Get-WMIObject
and WIN32_Process line here, okay?
Now, this line retreats all the processes
running on the system using WMI,
also known as the Windows Management Instrumentation.
Now, the WIN32_Process class provides details
about each process.
So, we'll see it listed out.
And then we have Where-Object right here, okay?
Now, what that is doing,
it gathers a list of processes
to include only those that are running
under the specified user account.
So, the Get-Owner method is usually to determine
the user that owns each process, okay?
And then we have this big long line here, right?
It could be a little intimidating, but it's pretty long.
Now, we're just going to kind of sum things up here.
We're going to list the Name, ProcessId,
User, the Domain,
and we're also going to list the memory usage, okay?
And then we're going to write the output that says,
"Filtered process listing for the user is complete."
All right?
That was kind of a summary
of what's going on in this script.
Very simple.
It's a lot of different things going on.
It's not as I think to the point as other scripts,
such as Bash or Python, but we need to learn this.
Okay, let's simply run this script.
Ah, it's actually using my name still.
So, it wasn't saved.
Let's save this, but it's fine.
We can use Jamario Kelly for now.
So, it lists every single process
that's running under my name.
I didn't even know all these processes
was running under my name.
'Cause again, once you start the system,
there's so many things happening in the background,
behind the scenes that you're unaware of.
And this can be a good point for us
to either examine what we can use
after we compromise that particular user account,
or, also, we can inject processes into another one.
So, for example, just say we initially entered
into the explorer.exe with ProcessId 5844.
We could then use something like Metasploit
to pivot to code.exe
and hide our functionalities under ProcessId 6888.
So, again, this script simply just goes through,
lists all the names of the process that's running,
the ProcessId, Owner, the Domain,
and also how much memory's being used in megabytes, okay?
Now, let's just simply change this really quick
to see if anything's running under the administrative count.
So, it's already here.
Let's just save this.
All right, and just run this again.
Okay, so it's changed to administrator.
All right, so we have nothing actually running
under the administrative account,
but I am an administrator, so I have that privilege.
So, it's just as good pretty much.
All right, next, going to make some changes
to enhance the functionality.
And all we're going to simply do
is add an elevated privileges check.
Now, just because the process is running
with an administrator using it,
it doesn't mean that it is running
with administrative privileges.
So, we need to check to see if each process
is actually running with administrative privileges
and which ones are,
so then we could potentially use those to pivot,
or use those for other things.
All right, so we're going to add a line.
It's going to be pretty long,
but I'm going to simply sum up what's going on here.
All right, so I'm going to paste this in, comma here.
All right,
now, here,
this new calculated property
so what it's going to do,
it's going to check whether each process
is running with elevated privileges.
So, we have it name, ElevatedPrivileges,
and it's going to use the Windows Principal Object,
and that's based on the current Windows identity,
by checking if it belongs to the administrative role.
So, again, this WindowsPrincipal property
is going to get the current information,
it's going to focus on the role,
and it's looking for if it's running as an administrator.
PowerShell scripting has a lot more syntax typically
than the other languages.
So, Bash and Python.
But again, simply, a lot of times,
you're just expanding one function and just writing all out.
It doesn't have a lot of shortcuts,
like the other languages.
So, it looks very long, but it's really not doing much.
All it's doing is adding another check
to see if we have elevated privileges.
So, let's save this, right?
Let's use my name
'cause we know that the administrator last time
didn't have anything
So, save this.
All right, perfect.
Let's run this again.
Okay, perfect.
So, we see that it went through,
and it's added this ElevatedPrivileges check,
and it's trying to see if these processes
are actually running with elevated privileges.
Right now, there has none
that's running with elevated privileges.
But again,
in a scenario where we're doing a penetration test,
Windows is very secure a lot of times
and it's kind of hard to crack through Windows
versus other operating systems, I believe.
But we're looking for something that's running.
We would say true here, okay?
So, that could be our point, a pivot.
So, just say PowerShell is running
at the elevated privileges state.
Then, maybe we could run yes exec and attack it remote,
or do some type of remote code execution,
depending on all the different
other security protocols in place.
But that's what we're looking for here,
the additional ElevatedPrivileges check
added to our script, all right?
Now, to sum things up,
we simply went through a script and PowerShell
that's checking for the running processes,
and we're listening by memory,
to see what's running under a specific user.
We then added the ElevatedPrivileges check
to see if it's running with elevated privileges.
So, we're able to go through pivot,
use those particular processes,
again, maybe do some process ejection
to hide our malicious activities
if our initial entry point was closed.
So, I hope you liked this demonstration,
and I'll see you in the next one.