Detecting Obfuscated PowerShell

Edit: If you want to see how deep this rabbit hole goes, check out our Black Hat / DEF CON presentation: https://www.youtube.com/watch?v=x97ejtv56xw I was recently looking at a sample that was encoded using MSF’s basic template obfuscation (stolen without attribution from Matt Graeber of course): https://github.com/rapid7/metasploit-framework/blob/b206de77081069dd53b1f90f57bfaccd0ecbb0d8/data/templates/scripts/to_mem_pshreflection.ps1.template For example: function mtKZ { Param ($l7PpJu1SE4VO, $qhnBBk5lHo) $pcE6VKGt = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') return $pcE6VKGt.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($pcE6VKGt.

Launching Modern Applications from the Command Line

We had an interesting discussion at work the other day about how to launch modern Windows applications from the command line. There are a few solutions out there (Tome’s is close), although few of them are happy with their results :) Many of them rely on protocol handlers (i.e.: “start bingnews://”), but that means memorizing a bunch of protocol handler prefixes. Tome’s blog mentions the Get-AppxPackage cmdlet – the real workhorse of a proper solution.

ScanSnap ix500 Handwriting Recognition

I got a question today about the handwriting recognition capabilities of my ScanSnap ix500. I’m still madly in love with the ScanSnap for paperwork and automatic document filing, but handwriting isn’t its strong point. Here’s an example document I scanned: Here’s what was recognized: e//o vjon ‘anreo/ia//po/n/ 0 V/or d reqw ar 3a eilo yor, c 0 Worio /C Ol2 “po/yi //e[[o is/oMiiaftc chsel Hello regularcbhcl iiellc W(^rU ^Ic^iYcksel //e//o wr/c/^m/ec///ey reouiar lex

Adding custom confirmation to commands

We recently had a customer question where they were concerned that some commands might be typed accidentally and end up causing significant disruption. In general, commands that fit that classification include a confirmation message to warn you, but sometimes you just don’t agree with what the cmdlet author thought was a high-impact action. While Restart-Computer might be a day-to-day operation for some servers, it might be certain doom for others.

The Wonderful World of PowerShell Filtering and Globbing

If you’ve been using PowerShell for long, you are probably familiar with the concept of wildcards. At the very least, you’ve done something like this: PS C:\temp> dir *.txt Directory: C:\temp Mode LastWriteTime Length Name ---- ------------- ------ ---- -a--- 1/21/2015 10:01 AM 664 test.txt Or perhaps you’ve taken a lap or two around about_wildcards and now type things like this in your sleep: PS C:\temp> dir C:\win*\*.N[a-f]?\F*\v2*\csc.exe Directory: C:\Windows\Microsoft.NET\Framework\v2.0.50727 Mode LastWriteTime Length Name ---- ------------- ------ ---- -a--- 5/26/2014 9:39 PM 77960 csc.

Extracting Tables from PowerShell's Invoke-WebRequest

If you’ve ever wanted to extract tables from a web page in PowerShell, the Invoke-WebRequest cmdlet is exactly what the doctor ordered. Once you’ve invoked the cmdlet, the ‘ParsedHtml’ property gives you access to the Internet Explorer DOM of that page. From there, you can get elements by tag name (“TABLE”), ID, and more. One neat application of this technique is to automatically parse data out of tables on the web page.

Maslow's Hierarchy of Security Controls

You’ve probably heard of Maslow’s Hierarchy of Needs. It’s a useful way to think about human needs and the priority in which we tend to fulfill them. Somebody dealing with a physiological crisis such as lack of food and water is unlikely to improve their situation much by focusing on self-actualization issues like finding opportunities for their artistic expression. When thinking about an organization’s security stance or security controls, I find that there is a very close parallel to Maslow’s Hierarchy of Needs.

Saving yourself from Sender's Remorse with Outlook

tl;dr summary: Create an Outlook rule to “delay outgoing mail by <5> minutes”, “unless body contains: е”, where the character used for the body exclusion comes from typing ALT+1077. “When it comes to email, it seems that I always do my best proof reading immediately after I press the Send button.” Perhaps you’ve been in the situation before, where you immediately regret sending an email in anger. Or realize after a few more moments of reflection that the email you just sent was well and truly wrong.

Repairing a NatureBright SunTouch Plus

I recently had the misfortune of having my relatively unused NatureBright SunTouch Plus break down: It’s a “Light Therapy” box that is very popular on Amazon, but a recurring problem among the disappointed reviews seems to be that it turns on, but then just immediately clicks and then turns off again. My lamp was out of warranty, so I decided to look into whether it was possible to fix it myself.

Absolute Positioning in Autodesk 123D Design

If you’re looking for a way to position an object in an exact spot in Autodesk 123D Design, you might have stumbled on forum topics like: The last meaningful response was: It doesn’t appear to have been added yet. Or it has been newly added, and the usability leaves something to be desired. In any case, it’s not as easy as you might think, but here’s a technique that works in version 1.