Overview

We’d like to introduce a new Zero-Tay technique for injecting code and maintaining persistency against common advanced attacker toolkits dubbed TripleAgent. We discovered this by ourselves in our very advanced labs, and are in the process of registering a new vanity domain as we speak. TripleAgent can exploit:

• Every toolkit version
• Every toolkit architecture (x86 and x64)
• Every toolkit user (RED / PURPLE / APT / NATION STATE / etc.)
• Every toolkit process (including PoC, GTFO, PoC||GTFO, METASPLOIT, UNICORN)

TripleAgent exploits a fundamental flaw in the design of commonly used advanced attacker toolkits, and therefore cannot be patched.

If you host your website in Azure, you might be interested in adding SSL support via Let’s Encrypt. Azure doesn’t offer any functionality to automate this or make it easy, but thankfully there are plenty of useful tools in the PowerShell community to make this easy.

1. ACMESharp - A PowerShell module to interact with Let’s Encrypt.
2. Azure PowerShell - A set of PowerShell modules to interact with Azure.

What’s been missing (until now!) is the glue. So now, here’s the glue: Register-LetsEncryptCertificate.ps1. So the steps:

We sometimes get the question: Why is the SeDebugPrivilege enabled by default in PowerShell? This is enabled by .NET when PowerShell uses the System.Diagnostics.Process class in .NET, which it does for many reasons. One example is the Get-Process cmdlet. Another example is the method it invokes to get the current process PID for the $pid variable. Any .NET application that uses the System.Diagnostics.Process class also enables this privilege.   You can see the .NET code that enables this here:

With the advent of PowerShell v5’s awesome new security features, old versions of PowerShell have all of the sudden become much more attractive for attackers and Red Teams.

PowerShell Downgrade Attacks

There are two ways to do this:

Command Line Version Parameter

The simplest technique is:

PowerShell –Version 2 –Command <…>

(or of course any of the –Version abbreviations). PowerShell.exe itself is just a simple native application that hosts the CLR, and the –Version switch tells PowerShell which version of the PowerShell assemblies to load. Unfortunately, the PowerShell v5 enhancements did NOT include time travel, so the v2 binaries that were shipped in 2008 did NOT include the code we wrote in 2014.  The 2.0 .NET Framework (which is required for PowerShell’s V2 engine) is not included by default in Win10+, but an attacker or Red Teamer could enable it or install it. Prior to Windows 10, where it is available by default, they could just use it.  

If you’re interested in knowing when specific Visual Studio compiler options have been introduced, here you go.

2003 to 2005

Option                 Purpose                                                                                             
------                 -------                                                                                             
/analyze               Enable code analysis.                                                                               
/bigobj                Increases the number of addressable sections in an .obj file.                                       
/doc                   Process documentation comments to an XML file.                                                      
/errorReport           Allows you to provide internal compiler error (ICE) information directly to the Visual C++ team.    
/favor                 Produces code that is optimized for a specific x64 architecture or for the specifics of             
                       micro-architectures in both the AMD64 and Extended Memory 64 Technology (EM64T) architectures.      
/FC                    Display full path of source code files passed to cl.exe in diagnostic text.                         
/Fp                    Specifies a precompiled header file name.                                                           
/G1                    Optimize for Itanium processor. Only available in the IPF cross compiler or IPF native compiler.    
/G2                    Optimize for Itanium2 processor (default between /G1 and /G2). Only available in the IPF cross      
                       compiler or IPF native compiler.                                                                    
/GF                    Enables string pooling.                                                                             
/homeparams            Forces parameters passed in registers to be written to their locations on the stack upon function   
                       entry. This compiler option is only for the x64 compilers (native and cross compile).               
/hotpatch              Creates a hotpatchable image.                                                                       
/LN                    Creates an MSIL module.                                                                             
/openmp                Enables #pragma omp in source code.                                                                 
/QIPF\_B                Does not generate sequences of instructions that give unexpected results, according to the errata   
                       for the B CPU stepping. (IPF only).                                                                 
/QIPF\_C                Does not generate sequences of instructions that give unexpected results, according to the errata   
                       for the C CPU stepping. (IPF only).                                                                 
/QIPF\_fr32             Do not use upper 96 floating-point registers. (IPF only).                                           
/QIPF\_noPIC            Generates an image with position dependent code (IPF only).                                         
/QIPF\_restrict\_plabels Enhances performance for programs that do not create functions at runtime. (IPF only).              
/Zx                    Generates debuggable optimized code. Only available in the IPF cross compiler or IPF native         
                       compiler.                                                                                           
                                                                          

2005 to 2008

Option                 Purpose                                                    
------                 -------                                                    
/MP                    Compiles multiple source files by using multiple processes.
/Qfast\_transcendentals Generates fast transcendentals.                            
/Qimprecise\_fwaits     Removes fwait commands inside try blocks.                  

2008 to 2010

Option Purpose                                
------ -------                                
/Fi    Sets the preprocessed output file name.

2010 to 2012

Option                                         Purpose                                                                     
------                                         -------                                                                     
/kernel                                        The compiler and linker will create a binary that can be executed in the    
                                               Windows kernel.                                                             
/Qpar (Auto-Parallelizer)                      Enables automatic parallelization of loops that are marked with the #pragma 
                                               loop() directive.                                                           
/Qvec-report (Auto-Vectorizer Reporting Level) Enables reporting levels for automatic vectorization.                       
/sdl                                           Enables additional compiler security checks.                                
/volatile                                      Selects how the volatile keyword is interpreted.                            
/ZW                                            Produces an output file to run on the Windows Runtime.                      

2012 to 2013

Option          Purpose                                                                                                    
------          -------                                                                                                    
/cgthreads      Specifies number of cl.exe threads to use for optimization and code generation.                            
/FS             Forces writes to the program database (PDB) file to be serialized through MSPDBSRV.EXE.                    
/Gv             Uses the \_\_vectorcall calling convention. (x86 and x64 only)                                               
/Gw             Enables whole-program global data optimization.                                                            
/Qsafe\_fp\_loads Uses integer move instructions for floating-point values and disables certain floating point load          
                optimizations.                                                                                             
/Zo             Generate enhanced debugging information for optimized code in non-debug builds.                            

2013 to 2015

Option                  Purpose                                                                     
------                  -------                                                                     
/guard:cf               Adds control flow guard security checks.                                    
/W0, /W1, /W2, /W3, /W4 Sets which warning level to output.                                         
/w1, /w2, /w3, /w4      Sets the warning level for the specified warning.                           
/wd                     Disables the specified warning.                                             
/we                     Treats the specified warning as an error.                                   
/wo                     Displays the specified warning only once.                                   
/Wv                     Displays no warnings introduced after the specified version of the compiler.
/WX                     Treats all warnings as errors.                                              

PowerShell to Generate these:

Time Journal helps you analyze where you spend your time by infrequently asking the simple question: “What are you doing?”

Visual Studio Code has a built-in feature to check for and install updates, but I’ve always been frustrated by having to acknowledge the update, allow the browser to restart, watch an installer, and then get back to what I was about to do anyways (which is edit some text). As a solution, here’s a quick little PowerShell script to run. It will create a background task to run every night at 3:14 AM and update VS Code for you automatically if one is available. If you tend to leave your editor open without saving files, you might want to enable the VS Code settings of files.AutoSave, and files.hotExit. When VS Code comes back up after an update, you’ll have to reopen any files that were previously open. Once VS Code gets more fully-featured crash recovery functionality, that annoyance will go away. And the PowerShell:

In 1799, Napoleon’s explorers discovered a 4-foot tall, 700 lb stone slab in Rosetta (Rashid), Egypt. Explore its hieroglyphics and their meanings with the Rosetta Stone Explorer.

If you’ve ever been interested in having all of Wikipedia in a plain-text format, you might have been disappointed to learn that Wikipedia doesn’t actually make this format available. This PowerShell script will create a plain-text version of Wikipedia for you.

Edit: If you want to see how deep this rabbit hole goes, check out our Black Hat / DEF CON presentation: https://www.youtube.com/watch?v=x97ejtv56xw

In a recent post, we talked a little bit about detecting obfuscated PowerShell through the use of PowerShell’s tokenizer - tackling, as an example, the highly irregular variable names generated by MetaSploit’s PowerShell encoder. Obfuscation has been around as long as computer programs have, so the rise of obfuscated PowerShell scripts shouldn’t be much of a surprise. Obfuscated VBScript, Perl, Ruby, Python, and of course assembly language are very common. A great example comes from this blog: http://perl-users.jp/articles/advent-calendar/2010/sym/11, which relies heavily on dynamic evaluation through Invoke-Expression: