Autoplay Next video from Max length

DEF CON 21 - Joe Bialek - PowerPwning Post Exploiting By Overpowering PowerShell

3,201 views · Published 22 December 2013 · 22:27 · Indexed 29 October 2026

Channel: DEFCONConference · 2013 · Science & Technology

PowerPwning: Post-Exploiting By Overpowering PowerShell
JOE BIALEK SECURITY ENGINEER, MICROSOFT

PowerShell is a scripting language included with all modern Windows operating systems, which, among other features, provides access to the Win32 API and the capability to run scripts on remote servers without writing to disk. PowerShell scripts bypass application white listing, application-signing requirements, and generally bypass anti-virus as well.

While all of these characteristics are very desirable to a penetration tester, rewriting penetration test tools in PowerShell would be time consuming. Instead, I will show how to combine PowerShell and assembly to reflectively load existing EXE's and DLL's without writing to disk, triggering anti-virus, or triggering application whitelisting. I'll finish with several demonstrations of the Invoke-ReflectivePEInjection script in action.

Joe Bialek (@JosephBialek) is currently a Security Engineer on the Office 365 Red Team at Microsoft where he does security research, red teaming, penetration testing, tool development, and code review. Joe was a contributor to Microsoft's Pass the Hash guidance paper, and has been a contributor to other large security efforts within the company. Prior to his role at Microsoft, Joe graduated from Western Washington University with a Bachelors degree in Computer Science.

Materials:
https://www.defcon.org/images/defcon-21/dc-21-presentations/Bialek/DEFCON-21-Bialek-PowerPwning-Post-Exploiting-by-Overpowering-Powershell.pdf
https://www.defcon.org/images/defcon-21/dc-21-presentations/Bialek/Extras.zip

DEF CON 21 - Joe Bialek - PowerPwning Post Exploiting By Overpowering PowerShell

More from this channel