TL;DR Base64 encoded commands in PowerShell and a corny IT Christmas carol
Merry Christmas and welcome to Part VII of our Back to the Basics Series!
Part I: NTDS.dit vs SAM
Part II: Ownership Matters
Part III: Recovering from a Crash
Part IV: Setting up a Simple Honeypot Account
Part V: Automating DC Deployment
Part VI: Sometimes it’s the dumbest thing
Part VII: Merry Christmas, macros, & Base64
Part VIII: Why old 0 Days make great teaching tools
Part IX: PowerShell & PS1s without PowerShell.exe
Part X: Ownership & so called “effective permissions”
Part XI: Windows Event Forwarding & SACLs
Part XII: Poorly planned honeypots & other Bad Ideas
Part XIII: Setting up a simple honey token
Part XIV: Smartcards and Pass-the-Hash
Part XV: Forwarding logs to Sentinel & basic alerts
Part XVI: Automating VM deployments in Hyper-V
Part XVII: Migrating the lab from ESXi to Hyper-V
Part XVIII: Centrally managing Hyper-V & Live Migrations
Background
I have seen a couple of cybersecurity courses mention attackers Base64 encoding PowerShell commands, but I had not seen them explain it well. We covered how malicious macros are still a threat and how to mitigate them previously. Attackers can write a macro that will run on document open and call out to PowerShell to run a Base64 encoded command that reaches out to the Internet to download malware. This malware can then establish an encrypted outbound connection to the attacker’s C2 server. If they are sneaky and use port 443 it may slip right through the FW as it looks rather like HTTPS web browsing.
Base64 PowerShell
First things first, in the spirit of Christmas:
PowerShell.exe -EncodedCommand VwByAGkAdABlAC0ASABvAHMAdAAgACcATQBlAHIAcgB5ACAAQwBoAHIAaQBzAHQAbQBhAHMAIAB0AG8AIABTAGMAcgBpAHAAdABpAG4AZwBXAGkAZgBlACAAZgByAG8AbQAgAE0AaQBzAGgAawB5ACEAJwAgADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzADAA
If you don’t trust us enough to copy/paste that into your run command then I don’t blame you. I wouldn’t trust us either. Hence here at test.local we like to show our work, share how we did something, and not hoard information while saying “trust us bro”.
#https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/
$MyCommand = "Write-Host 'Merry Christmas to ScriptingWife from Mishky!' ; Start-Sleep -Seconds 30"
$MyBase64 = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("$MyCommand"))
$MyBase64
$DecodedCommand = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("$MyBase64"))
$DecodedCommandThe variable $MyBase64 is holding the encoded ‘one liner’ command so just copy/paste it to create the encoded PowerShell above.
I am not sure why this is a feature in Windows, but it is. I am also not sure who, other than attackers and hobbyists, ever actually uses it. It is something that defenders need to be aware of.
A corny IT Christmas carol
It’s an oldie but a goodie. We originally made this up before Christmas 2020 when we were first starting these lab projects and were doing one on Kerberoasting and mitigations.
Kerberoasting on an open fire
Attackers nipping at your NTLMv2
Security carols being sung by a SOC
And EC Council dressed up in black hoodies
Everybody knows a service account and a weak pwd
Help to make an attacker's night
Script kiddies with their eyes all aglow
Will find it easy to crack tonight
They know that Delpy's on his way
He's loaded lots of hacks and tricks on his mimikatz
And every wannabe leet is gonna pry
To see if vulnerable SPNs really are gonna fly
And so I'm offering this simple phrase
To admins from one to ninety-two
Although it's been preached endlessly
Follow security best practices dammit!Summary
Be aware of phishing TTPs, macros, Base64, etc. Attackers are probably the only ones still using Visual Basic, but it will still run on document open in Office if you allow it.
Merry Christmas and stay safe!
References
Obfuscation & Base64: https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/
