New Shell in Town: Adventures in using PowerShell on Linux

Key Takeaways

well we'll go ahead and get started so uh as she said i'm fernando tomlinson i'm happy to be here today i'm certainly happy that you all have joined in for my talk as we start to talk about powershell in many different facets so the flow for today will really be highlighting some of the history of powershell the advantages of the language would do some comparison between windows powershell and powershell core well highlight how do you get started with the language and then we'll sum it up with me sharing some resources with you right so you can walk away and put some of this stuff to good use but also continue your learning and being able to advance your uh your ability in powershell as a whole all right so this whole powershell thing right it was introduced in 2006 um by microsoft um specifically on windows powershell it's an object oriented scripting language so when you hear object oriented you're probably like well what is that right we could think of you know your car as an object and then your car has many attributes associated with it one of those attributes might be the make the model you know the color the year right all of those things associated with the object being the car well powershell operates in the same manner with all the data that it retrieves and interacts with it treats them as objects and as we go through this talk you'll see one case where that is hugely beneficial but certainly as you continue your endeavors with uh the language you'll you'll certainly see it to be a significant uh increase in your ability to do things with the language it's an automation platform so from a system administration perspective or defensive person offensive it really doesn't matter you can automate tasks built into the operating system to allow you to repeatedly on a time schedule be able to accomplish certain things it's a remote management framework meaning that i can be on workstation one and be able to access workstation two in the same manner that i would do my own workstation it isn't necessarily a one-to-one it's also has the ability to do one-to-many being able to do that right from the powershell language console is certainly beneficial the last thing i'll say here is functionalities in in the language is generally provided by what we call command lists commandlets and these commandlets they really follow a format of verb now so these verb noun formats of the commandlets really allow us to um utilize the the language and when we look at what these verb nouns look like well we can execute get verb within our powershell window and we'll see roughly 100 of them i only have about 32 on the screen here but when i'm thinking about trying to retrieve information well the verb get sounds like i would be retrieving the information and i highlighted it there because not only does it show the verbs itself it shows um some other information associated with it if we wanted to remove information well that sounds like you know or we want to delete that sounds like we would be removing if we wanted to create something um that sounds like new and then if we wanted to alter something that sounds like set the good thing is if you don't fully understand um the the verbs associated with the language being able to type in get dash verb brings this information up so that way you can start to get introduced exposed to the verbs within powershell and then guess what as soon as you start to fully um take in that when you see get that insinuates your retrieving information you can rinse and repeat that with nearly any and every commandment that you see within the powershell language from an avengers perspective the blue team has a number of them and when we say blue team we're talking about people doing defensive actions security operations actions within a network right so from that perspective they have access to uh essentially all the apis within windows and these apis are application uh programming interfaces essentially a set of definitions that are used to build and integrate application software within an operating system so the fact that these apis exist existing operating system and windows or excuse me powershell as a whole has access to it then allows us to interoperate our ability and our code and really develop more because we're able to dial into some of these things that are already there we have the ability to um track and uh really highlight the abuse of the language across an entire entire enterprise we can essentially encrypt our traffic so when you hear about you know people using packet sniffers and you know uh traffic being transmitted in the clear uh ie not encrypted uh powershell has the ability where we can encrypt that making it difficult and in some cases nearly impossible for somebody to be able to read our communication this is good from a blue team perspective as you can imagine i don't want to be querying a machine and have the data that i'm retrieving back just floating in the wind where anybody can essentially capture that traffic and make some sense of it we also can build tools and capabilities that allow us to monitor what's going on in our network so if we can't afford the next generation of you know endpoint security platform or our organization doesn't allow us to use certain things based upon where we currently sit or rules and regulations well we can utilize powershell to be able to minimize uh our impact for not having that but certainly give us the visibility that we may desire we also have the ability to look at this from a red team perspective and from a red team perspective we'll see things like the ability to bypass and avoid detection so that's good because again it being a scripting language we can execute it in such a way to where uh we can certainly bypass detection mechanisms and then as these tech convention mechanisms um illuminate themselves and prevent us from doing things we can then alter the code to then continuously be on the cutting edge of what we're doing conversely we mentioned these apis just a minute ago and how that was useful for a blue team it's also useful for renting and since these are script based attacks it certainly makes being able to signature them very difficult i see some detection mechanisms and signature detection mechanisms where they try to highlight key words in particular powershell code to be able to highlight their maliciousness however it takes nothing for a person to be able to alter that word that's in there to something go so it certainly makes it difficult for somebody to stay abreast of it and when we look at this some more there are a couple of things that well they're equally beneficial to a blue team as they are beneficial to a red team member yes you are absolutely correct now we're not finished talking about a red team member or really anybody of malicious intent at large because i'm going to bring you to another thing where we're talking about uh scissor right so we understand sizza is a a us government uh entity really charged with um how the government does defense and helping with rules and regulations regulatory guidance now they do essentially assessments responsibility assessments with different organizations and they use the miter attack framework the miter attack framework is essentially a subset of tactics techniques that have been shown to be used by malicious actors these are categorized in a number of different subsets now i say all that to say from the execution perspective execution is essentially how do i get my malicious code to execute because malicious code by itself it poses no threat unless it's actually executing so malicious actors want to get whatever their malware is whatever their capability is to execute on a system overwhelmingly powershell is leading the way as far as what malicious actors are using to execute their code now albeit this is what scissors sees from their uh perspective and the organizations that they've done these assessments with so we can take that with a grain of salt and not and not say well this doesn't account for the whole world but giving the responsibility of scissor certainly this is worthwhile and it's not by just a couple of percent it's nearly you know double almost from the next one right behind it so it's really a big thing now we highlighted blue team using it we highlighted the red team using it there's also system administrators and really powershell as a whole was generally made for system administrators to help them with their tasks to automate some of the things that they were doing to be able to retrieve information in such a manner that was useful for a system administrator so when we look at the landscape it isn't this is a capability for one entity versus the next it's there's some shared overage if you will in the capability from different entities and there are some pieces of it that really apply to only that entity itself it really depends on the intent in which i'm trying to accomplish and really the timing and scope in which i am on a particular [Music] mission if you will so just to provide something else redmonk redmonk provides a um programming language rating rankings rather uh generally once a quarter they're a little bit behind this is the latest one that they have and what i found by looking at red monk because it's a little bit difficult to find these types of numbers out there they have taken the number of projects on github github is a repository open source platform where people can generate code they can post it there other people can help with that code kind of get it crowdsourced just an open source platform right and then based upon the number of tags in stack overflow if you've ever googled some type of programming like question stack overflow was probably one of the top three or four uh responses that came back so based upon the number of tags that are in that platform and then we have our access there powershell isn't at the top but it's nearly at the top it's actually number 17 out of whatever amount that's on here now as a enthusiast and a lover of powershell i'm not mad that it's not at the top i see things above powershell that probably should be there right like the language that's used to uh build microsoft windows the language that's used to build uh ios from an apple perspective you know some some other core languages as well so i just really want to highlight that power shell is certainly being used as noted by its position from what red monk is noted based upon the popularity in github and the popularity of tags based upon its resonance and stack overflow okay so now that we've gotten that out of the way we're really now talking about the versions and as we really delineate the different versions then it paves itself very well for us to to kind of move over to powershell core so windows powershell comes inherent on windows operating systems and on the chart i have there i've noted the operating system i've also noted the version of windows powershell that is installed by default so if you have a windows 7 machine and you fired up powershell right now you would have powershell version 2 on there by default if you've had a windows 10 machine and you fired up powershell it would be version 5 by default every version um provides some new level of functionality and security right so certainly the the newer version the better now microsoft is no longer developing windows powershell they've ceased after version five instead they are developing powershell core powershell core and that is cross platform so now i can run powershell core on windows mac os linux as we're talking about here today and a number of other special specialty platforms powershell core starts off with version 6 and then has version 7. by default powershell core is not installed on any operating system so it's something that we would need to install we can certainly run powershell core and windows powershell together on a windows platform just you know in case you wanted to be able to do that so how do we go about getting powershell core well first let's talk about a little bit of history of it it was announced in 2016 released in 2018 we've noted that it's platform we've also noted that you know windows mac os linux and there's a number of other operating systems especially systems as well when we're in microsoft windows we can launch powershell by calling upon pwsh when we see exe that's a general thing for actual windows although we can execute them in some respect on other platforms on a mac or linux we can call upon pws nonetheless you start to see the commonality in what it's known as on either one of those platforms so install in powershell core and we're talking specifically from from a linux perspective now that powershell is open source which is what they did when they came up with powershell core meaning they now have published publicized the code and everything about powershell and nothing stops you me or somebody else from going out to github and being able to um add to the powershell project and make it better so now it's being crowdsourced that code is on github the platform that i mentioned just a few minutes ago so we can browse to github we can manually download the software and then we can install it on our system and we'll have powershell core we could also execute a one-liner essentially one line of code to in an automated fashion go out download the powershell software and then auto install it for us okay so that's pretty cool i probably would want to do the latter option and let's walk through that so utilizing option two i'm going to specify what's called w get and within linux because now we're in a linux terminal with command line terminal wget allows me through the command line to interact with web applications so i'm browsing through the command line using wget out to aka.microsoft and i'm downloading uh that code called install powershell.sh sh is a bash script bash is a different language that's inherent to linux as we're on linux right now so we're just utilizing that inherent language to be able to install our new language that we're interested in from there i'm going to install or essentially execute that script and the way i'll do that is i'll call upon something called sudo and sudo is going to allow me to execute commands that i generally wouldn't have the ability to do as a regular user but it's going to allow me to execute those commands in the context of a more privileged user and when i try to do that it's going to ask me for my credentials as noted there now once that is all done i'm then going to remove the script so in a matter of let's say 30 seconds i'm able to go out get the code download it install it and i'm good to go with powershell core on my linux machine whoa all right well now i got to execute some commands so back in my my terminal command line window in linux i have two options option one is for me to be able to go into or create a powershell process execute powershell commands just as long as i want to one after the other and then when i'm finally done exit out of there so that's what i'm doing here i'm specifying pwsh notice that right before the pwsh it says nando at sign sent os that's my present um working directory if you will my current path and then right after that i then get essentially uh that path changing it now begins with ps that insinuates that i'm now in a power shell process and once i'm in that powershell process i can specify those commands one after the other discontinuously while i'm in that one process the command that i'm doing now is git host well we've realized that git is retrieving so i'm retrieving information about the host and what i get back is a subset of information but most importantly out of there what i get back is the version cool now when it's all said and done because i'm in a powershell process i'm going to type exit and after i typed exit it would bring me back to the prompt that says nando at ceno west now we also have the option to create the powershell process execute a command and bring us right back to the cina west prompt okay and that's what we're doing with option two so notice here pwsh we're specifying a parameter command and then we're going to feed it the command to execute that command is no different than what we were executing in our previous method and what we get back is the exact same thing but notice it automatically dropped me right back into my uh terminal prompt with nando adsen west so we have two different methods for us to be able to execute this powershell code not saying one is better than the other but certainly want to highlight to you that you have multiple ways to be able to do that okay so no matter what side of the fence you're on whether you're a system administrator or you're aspiring to be one or aspiring to be somebody on the defensive side or offensive red team side there's a number of things that we determine that are things that you would do that could span different facets and some of them are listed before you and we call them a system survey right so if i'm a red team person and i've gained access to a machine the first thing i would want to do is be able to understand this the makeup of the machine like who's logged on what processes are running when when uh you know software is installed if i'm a blue teamer or a defensive person and i am trying to proactively look to see if the system has been compromised i might try to do those same things now my reasoning would be possibly slightly different however i'm executing the same commands and the same could go for a system administrator but let's say we had a supervisor who said i need you to retrieve a list of running processes running processes so when i open up let's say microsoft word that's a process that's running when i open up notepad that's a process that's running internet explorer or chrome or whatever your browser of choice is that's a process that's running i want to be able to see all those running processes well i'm new to powershell i don't even know how to do that right and i'm in linux well let's walk through a methodology that gets you where you need to be that you can rinse and repeat with and use in other aspects all right so powershell has this thing called get help it's a command line git dash help we already have come to the determination what git generally means retrieve some information so i'm going to do git dash help process so now i'm going to retrieve any help documentation with the word process in it and i get roughly eight items back some of them are like exit right that tells me it's probably going to close out one is like start that sounds like it's creating right but i do see uh one that says get process and now what i'm able to do is shift over to the synopsis field and i can read the synopsis associated with it and that synopsis is telling me that it gets the processes that are currently running on a local machine okay that's awesome this might be what i need but i'm not quite sure yet so now that i have that command lit i can do get help dash get process or excuse me get help space get dash process and what does it do well it gives me the name synopsis and a little bit more information right but down at the bottom i also have this remarks field where it gives me the option to be able to go out and get the full help documentation i can get the details associated with the help documentation or i can get examples examples yeah examples so these examples when i call upon get dash help get dash process dash examples well it's going to give me examples of how to use that commandlet depending on the command that you're looking at it could give you one example i've seen some that gives up to like 14 somewhere in between may be your number but at any case an example of using it is certainly worth our time and effort to check out so when i see this and i've only captured two examples on the screen it gives us information about it cool the first one gets a list of active running processes on a local computer awesome and then it tells us the specific command to use wow right and then we get a more detailed synopsis associated with it now based upon this i think get process by itself is what i'm looking for so i'm going to go ahead and execute that and when i do i get a number of things back to the screen those though those attributes that i talked about earlier these properties well i see them going along the top npm pm ws cpu ibsi process name those are all attributes about the object being processed in this case okay well i don't care to see all of that i really only want to see things like the process name because that's important and i want to see the process id this process id is a unique identifier associated with the active running process while it's unique in nature there are some processes that when they execute will have a very static one however i want to only see those two things the id and the process name so how do i do that well if i'm going to use bash that is that inherent language that we mentioned earlier there's a couple of ways for us to do that and doing that well is very cumbersome it's not something that is easily repeatable you're really kind of finagling the data and manipulating it however with powershell we can literally just do get process uh pipe which is a straight up and down and then we can select the object that we care about in this case we care about the object or the property called id and looking at my screenshot let's say you want to get the name as well well you just add a comma and then you can add name there you get only that information back because it's object oriented you can get that same information because we're now going from windows powershell to powershell core the cross-platform aspect is huge and i use this person as an example this person is business casual ready business ready he's ready to go to the ballpark right he has one outfit that he weighs and in some cultures maybe this is accepted in other cultures it's it's it's odd right but the fact that he can use he can have that uh that attire and use it in many different facets is huge okay so as we bring this kind of to the end we've identified the language can be installed very quickly we've highlighted how helpful the help documentation is and certainly because windows powershell is already on windows being able to have powershell on linux gives us an object-oriented language that is on both platforms not to say that this is the only object-oriented platform that's out there all right no good commercial goes on without something like this so here's the point where i'm going to give you something for your your kickback and i recognize i'm running out of time so i'm gonna go through this fairly quickly now um abc right you always have to be coding to be able to get better at powershell there's the get help function that i talked about and if you're coming from let's say managing routers or um something else with particularly routers and network equipment you can generally hit the tab key and it will auto complete powershell is the same way one of the best books that i've ever seen was powershell in a month of lunches it is not free but it's fairly inexpensive and every day for a month you can learn more about powershell through text and hands-on i also run to challenge based powershell learning platform so i'll talk about here in a second and then being able to use a quick reference sheet i happen to have a quick reference sheet although maybe a little small for you to read now as soon as this is over with i'm going to put the link to this quick reference sheet in my hallway chat the idea here is you can print this out put it on your desk and there's a number of things that you'll rinse and repeat and always use within powershell so slowly but surely you'll go from looking at it every day to not even needing it one of the powershell platforms that i was mentioning is called under the wire 75 linear challenges one after the other where it's focused on the core aspects of powershell we allow you to connect to our servers me and three of my my buddies put this together and we'll present you with challenges as you answer one challenge the answer becomes the password for the next challenge and then you'll rinse and repeat that for the 75 challenges thus far we've had almost 200 000 unique players from over 78 countries the biggest thing about this is it is free when you need help or assistance you're going to get me or you're going to get one of my buddies when you're done with that i also created posh hunter posh hunters 90 interactive challenges focus on red and blue team tactics it is also free i give you a virtual machine that you'll go and download it's riddled with artifacts i'll have you complete scenario based challenges and supply those answers back to my uh my gaming server to get points if you will but every one of those challenges are based upon real world first-hand uh things that i've seen in my endeavor right so this isn't things that would never ever happen and you're only using powershell through both of these platforms you're going to be introduced to things that you've never seen before which is an opportunity for you to grow all right with that being said i believe i'm out of time however here's a couple of uh links that are important maybe you want to jot them down if not no worries i will put them in the slack chat right after this and that's where i'll be hanging out for the rest of the day catching up on some of the content here so with that i i yield back to you