search
RegScoutOSCP Prep

May-FlowerShell

Creator's Cut

hashtag
Scenario:

Take the following code and find the flag. (This code will not harm your pc)

Tip - I would create a Windows VM with Defender Turned off as some of these challenges will get flagged for their behavior.

hashtag
Challenge creation

- All levels were created with invoke-obfuscation

- https://github.com/danielbohannon/Invoke-Obfuscationarrow-up-right

- This tool can be used by APTs as a way to bypass av/detection

- Being able to reverse engineer these in some way to understand what is being done is critical to DCO

hashtag
Key Take Away For This Scenario:

  • All of these were created by a tool called invoke-obfuscation

  • This tool takes valid PowerShell code blocks and allows the write to obfuscate this in any number of ways in a matter of under a minute.

  • These are being used by script kiddies to APTs today in order to evade detection

  • Only some of these obfuscation techniques are captured by AV based on their behavior alone

  • As a Hunter/Defender we have one tool that they cannot hide from us at.

hashtag
PowerShell Script Block Logging and Module Logging

  • In order to enable this, edit the Local Group Policy for Computer and Users @ Administrative Templates -> Windows Components -> Windows PowerShell

  • Enable Script Block Logging and under Module Logging set the modules to * to get every module that gets called.

  • With these 4 settings all the PowerShell that runs on a box should show up.

  • Make sure you run gpupdate /force to implement these settings after setting.

  • All logs should be in the event viewer under Application and Service Logs -> Microsoft -> Windows -> PowerShell -> Operational

hashtag
The Questions:

This is to show how easy it is to solves these with the de-obfuscation done as the code is ran.

***if you do this with live malware make sure your sandboxed and isolated***

hashtag
Level 1:

We see this in the 4103 event

circle-check

fivectf{turkeys_go_gobble_gobble}

hashtag
Endcoded Message:

circle-check

hashtag
Obfuscation Technique:

String Concatenate x1

hashtag
Level 2:

This obfuscation created 6 events:

The 4104 Shows the de-obfuscated code:

circle-check

$baste="fivectf{lets_get_basted}"

fivectf{lets_get_basted}

hashtag
Endcoded Message:

circle-check

$baste="fivectf{lets_get_basted}"

hashtag
Obfuscation Technique:

Reorder x1

hashtag
Level 3:

hashtag
Level 4:

hashtag
Level 5:

hashtag
Level 6:

hashtag
Level 7:

hashtag
Level 8:

hashtag
Level 9:

hashtag
Level 10:

hashtag
Level 11:

PreviousInvoked!NextStego Troll

Last updated