In this lesson, we'll explore how PowerShell
and PsExec can be used
to disable security controls on a Windows system.
While these tools are effective
for legitimate admin purposes,
they can also be used by attackers
to weaken a system's defenses during a pentest.
Understanding these techniques is important for pentesters
as it allows us to demonstrate potential risk
and help organizations increase their security.
Just as a recap,
PowerShell is a scripting language
and command-line shell designed
for task automation and configuration management.
It is deeply integrated into the Windows operating system,
giving it powerful access to system functions.
PsExec is part of Microsoft's Sysinternals suite
and it's used to execute processes
on remote systems, keyword being remote.
When combined, PowerShell and PsExec can be potent tools
for both system administration
and unfortunately for disabling security controls.
First, let's discuss using PowerShell
to disable security controls.
PowerShell's deep integration with Windows allows it
to interact with system services, registry systems,
and other critical components.
For example, an attacker could use PowerShell
to disable Windows Defender,
a built-in antivirus solution,
by modifying registry keys or stopping services.
To disable Windows Defender using PowerShell,
you might start by opening
a PowerShell session with administrative privileges.
Then, to stop the Windows Defender Service,
you can execute the following command,
Stop-Service -Name "WinDefend" -Force.
Here in this example,
we see that the command is being blocked
even though we have admin level privileges
showing us the additional layers of security
that have been integrated
for Windows applications and processes.
If successful, this command would stop
the Windows Defender service,
effectively disabling the real-time protection
that it provides.
Next, to prevent Windows Defender
from starting again after reboot,
you can set the service to be disabled
using the following command,
Set-Service -Name "WinDefend" -StartupType Disabled.
Now this will ensure that the service
remains disabled even after the system is restarted.
Another approach involves modifying register keys
that control various aspects of Windows Defender.
For example, you could disable real-time protection
by configuring the correct registry key.
Here's the command for that,
Set-ItemProperty -Path
"HKLM:\SOFTWARE\Policies\Microsoft
\Windows Defender" -Name DisableRealtimeMonitoring"
Value one.
This command modifies the Windows Defender policy
to disabled real-time monitoring
which just further weakens the system's defenses.
If we look at this screenshot,
we can see how the command
for disabling real-time monitoring
in the registry went through,
but our prior attempt
at disabling Windows Defender at startup failed.
So again, this just further emphasizes
how granular systems can be when they enforce security,
even at the admin level.
Next, let's discuss using PsExec
in combination with PowerShell
to disable security controls on remote systems.
Remember, PsExec allows you
to run commands on remote machines
which is useful in a domain environment
where multiple systems need to be affected
at the same time.
To start, you would use PsExec
to open a remote PowerShell session on a target machine.
Here's the syntax of how you can use PsExec
to run a PowerShell script on a remote machine, okay?
So we have psexec \\
then, we have the [target_ip].
Then we have the -u option for a username.
Then -p for password,
powershell.exe -ExecutionPolicy Bypass -File.
Then, we have the [path_to_script]
that we're trying to execute.
Now, this command connects to the remote machine
using the provided credentials,
bypassing the PowerShell execution policy
which might block the script from running
and then it executes the specified PowerShell script.
This script could contain
commands to disable security controls,
similar to what we discussed earlier.
For instance, if you wanted to disable
the Windows firewall on the remote machine,
your PowerShell script might include
Set-NetFirewallProfile -Profile
Domain, Public, Private -Enabled False.
This command disables the firewall
across all network profiles on the remote machine,
leaving it more vulnerable to additional attacks.
You can also use PsExec to run individual commands
directly without needing a script.
For example, to disable User Account Control (UAC)
on a remote machine,
you could use the following:
psexec \\, then, we have the [Target_ip] again,
u for the [username],
p for the [password], reg.exe add.
Then, we have the path to the registry key,
/v EnableLUA /t REG_DWORD /d 0 /f.
Now again, you don't need to remember all that,
but again, I just wanted to go over so you can be
familiar with the structure of the language.
This command modifies the registry
on the remote machine to disable UAC
which can prevent users from receiving prompts
before changes are made to the system
which lowers the bar for performing additional attacks.
So remember while PowerShell
and PsExec are powerful tools for system administration,
they can also be misused
to disabled critical security controls,
leaving systems vulnerable to attack.
As a penetration tester,
understanding how these techniques work
allows you to demonstrate potential risk to your clients
and help them implement better defenses.