Jan 17 2023

Windows PowerShell Cheat Sheet

Powershell

Checkout our previous posts on “PowerShell Security”

More latest Titles on PowerShell…


InfoSec books | InfoSec tools | InfoSec services

Tags: Powershell Security


Jan 02 2023

Windows PowerShell Tutorial and Cheat Sheet

PowerShell Cheat Sheet

Powershell : The Complete Ultimate Windows Powershell Beginners Guide. Learn Powershell Scripting In A Day!

Mastering PowerShell Scripting: Automate and manage your environment using PowerShell


Infosec books
 | InfoSec tools | InfoSec services

Tags: Powershell Security


Aug 17 2021

Fortinet FortiWeb OS Command Injection allows takeover servers remotely

Fortinet addresses a command injection vulnerability that can allow attackers to take complete control of servers running vulnerable FortiWeb WAF installs.

An authenticated attacker could execute arbitrary commands as the root user on the underlying system via the SAML server configuration page. Experts pointed out that the flaw could be chained with an authentication bypass flaw that could allow an attacker

The vulnerability impacts Fortinet FortiWeb versions 6.3.11 and earlier, an authenticated attacker could exploit the issue to take complete control of servers running vulnerable versions of the FortiWeb WAF.

An authenticated attacker could execute arbitrary commands as the root user on the underlying system via the SAML server configuration page. Experts pointed out that the flaw could be chained with an authentication bypass flaw (i.e. CVE-2020-29015) to allow an unauthenticated attacker to trigger the vulnerability.

The vulnerability was reported by the researcher William Vu from Rapid7.

“An attacker, who is first authenticated to the management interface of the FortiWeb device, can smuggle commands using backticks in the “Name” field of the SAML Server configuration page. These commands are then executed as the root user of the underlying operating system.” reads the post published by Rapid7. “An attacker can leverage this vulnerability to take complete control of the affected device, with the highest possible privileges. “

The flaw could allow an attacker to deploy a persistent shell, install crypto mining software, or other malware families. If the management interface is exposed to the internet, an attacker could trigger the issue to reach into the affected network beyond the DMZ. Rapid7 researchers discovered less than three hundred devices exposing their management interfaces online. Let’s remind that management interfaces for devices like FortiWeb should not be exposed online!

OWASP WEB APPLICATION SECURITY THREATS – MARKET INTEREST TREND : FULL REPORT PACKAGE by [CURIOSITY PUBLISHERS]

Tags: OS Command Injection


May 14 2021

Magecart gang hides PHP-based web shells in favicons

Category: PowerShell SecurityDISC @ 12:07 pm

Magecart cybercrime gang is using favicon to hide malicious PHP web shells used to maintain remote access to inject JavaScript skimmers into online stores.

Magecart hackers are distributing malicious PHP web shells hidden in website favicon to inject JavaScript e-skimmers into online stores and steal payment information.

Researchers from Malwarebytes observed threat actors, likely Magecart Group 12, using this technique in attacks aimed at online stores running on Magento 1 websites.

The web shells employed in the attacks are tracked as Smilodon or Megalodon, they dynamically load JavaScript skimming code via server-side requests into online stores. This technique allows bypassing most client-side security tools.

“While performing a crawl of Magento 1 websites, we detected a new piece of malware disguised as a favicon. The file named Magento.png attempts to pass itself as ‘image/png’ but does not have the proper PNG format for a valid image file.” reads the analysis published by Malwarebytes.

Tags: web shells


Feb 12 2021

Microsoft warns of the rise of web shell attacks

Category: PowerShell Security,Web SecurityDISC @ 2:29 pm

An Introduction to Web Shells

Tags: Web Shell


Jul 05 2019

10 essential PowerShell security scripts for Windows administrators

Category: PowerShell SecurityDISC @ 3:40 pm

PowerShell is a valuable tool for automating Windows administration tasks, including laborious security chores

Source: 10 essential PowerShell security scripts for Windows administrators
 
Defending Against PowerShell Attacks



Enter your email address:

Delivered by FeedBurner




Tags: Powershell Security