Resolving Hostnames with PowerShell and the Pipeline

Thanks to Matt, PowerSploit has had a function to resolve hostnames to IP addresses for a while. The Invoke-ReverseDnsLookup utility is useful in mapping a domain from inside or out. Often, organizations use overly-descriptive names which can help an attacker narrow down their targets during initial recon and again once they have a foothold on the inside of a network. If you haven't used it, you should check it out.

Recently, we added support for two things to the function which I found helpful on a recent engagement. Both are simple enhancements that come with the PowerShell language that you may want to implement in your tools.

The first is the use of the Write-Verbose cmdlet which is a Common Parameter. That means it comes free when you declare your parameters with "[CmdletBinding()]" and then can be called by adding the "-verbose" switch when the function is called. Optionally, it can be enabled by changing $VerbosePreference, but by default it doesn't show anything. In the case of Invoke-ReverseDnsLookup, I added it to the function to be able to see what IP address it was currently trying to resolve. Since verbose statements are written to the console and not the output pipeline, you can use any of the "out-*" without it being cluttered with messages.

The next feature of PowerShell that we added is support for input from the pipeline. Pipeline input allows functions to be chained together and allows developers to focus on doing one thing. Where input is coming from and how the output is parsed or stored should be handled by the user. For example, I had a text file of several different network ranges and IP addresses that I wanted to be able to pass to Invoke-ReverseDnsLookup, but it didn't support it. Fortunately, it is simple to add support to your tools. The first thing you need to do is decide what logic (if any) only needs to happen once at the beginning or at the end of the script. In our case, Matt wrote a function to break out and validate CIDR ranges into individual addresses. We don't need to declare that function for every IP address, so we will create a BEGIN script block:

The only required script block is PROCESS. That is the part that will do the work on each object coming down the pipeline. You can see the PROCESS block above and how the current IP address in the pipeline is reference with the pipeline variable ($_). Once the PROCESS block is done, the optional END block does any post-processing for the function.

Certainly nothing ground-breaking here, but I thought I would share some neat features of PowerShell and how they can be applied to your tools. It may give you some insight into the "why" behind some of the functions in PowerSploit. Thank you for reading.

Scanning SharePoint with PowerShell

A few months ago, I published Get-HttpStatus - a PowerShell function that aides in generic directory and file fuzzing.  In order to get it added to PowerSploit, Matt suggested several improvements and eventually made a few of his own.  The function supports SSL and includes several dictionaries derived from other projects such as Nikto, Yokoso and SharepointURLbrute.  Without dictionaries, the function is pretty useless so a big thanks goes out to the developers of each of those tools and the hard work that went into creating the file and directory dictionaries.   

Lets take a look at one specific use-case for Get-HttpStatus - scanning a SharePoint installation.  We can start by opening PowerShell and copying and pasting the function into the shell.

Next we provide the function a target website and the path to the dictionary file.

In this example, there is an interesting directory and file that is accessible without credentials.  Lets check it out:

It appears that we may have the ability to increase permissions by adding users to different groups on the server.  That is definitely a security finding that could aid in a penetration test.  As with other scripts and functions that are added to the PowerSploit project, the maintained version is available on the github site.

Get-HttpStatus Functionfunction Get-HttpStatus { <# .SYNOPSIS PowerSploit Module - Get-HttpStatus Returns the HTTP Status Codes and full URL for specified paths. Author: Chris Campbell (@obscuresec) License: BSD 3-Clause .DESCRIPTION A script to check for the existence of a path or file on a webserver. .PARAMETER Target Specifies the remote web host either by IP or hostname. .PARAMETER Path Specifies the remost host. .PARAMETER Port Specifies the port to connect to. .PARAMETER UseSSL Use an SSL connection. .EXAMPLE PS > Get-HttpStatus -Target www.example.com -Path c:\dictionary.txt | Select-Object {where StatusCode -eq 20*} .EXAMPLE PS > Get-HttpStatus -Target www.example.com -Path c:\dictionary.txt -UseSSL .NOTES HTTP Codes: 100 - Informational * 200 - Success * 300 - Redirection * 400 - Client Error * 500 - Server Error Status Codes: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html .LINK http://obscuresecurity.blogspot.com #> [CmdletBinding()] Param( [Parameter(Mandatory = $True)] [String] $Target, [Parameter()] [String] [ValidateNotNullOrEmpty()] $Path = '.\Dictionaries\admin.txt', [Parameter()] [Int] $Port, [Parameter()] [Switch] $UseSSL ) if (Test-Path $Path) { if ($UseSSL -and $Port -eq 0) { # Default to 443 if SSL is specified but no port is specified $Port = 443 } elseif ($Port -eq 0) { # Default to port 80 if no port is specified $Port = 80 } $TcpConnection = New-Object System.Net.Sockets.TcpClient Write-Verbose "Path Test Succeeded - Testing Connectivity" try { # Validate that the host is listening before scanning $TcpConnection.Connect($Target, $Port) } catch { Write-Error "Connection Test Failed - Check Target" $Tcpconnection.Close() Return } $Tcpconnection.Close() } else { Write-Error "Path Test Failed - Check Dictionary Path" Return } if ($UseSSL) { $SSL = 's' # Ignore invalid SSL certificates [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $True } } else { $SSL = '' } if (($Port -eq 80) -or ($Port -eq 443)) { $PortNum = '' } else { $PortNum = ":$Port" } # Check Http status for each entry in the doctionary file foreach ($Item in Get-Content $Path) { $WebTarget = "http$($SSL)://$($Target)$($PortNum)/$($Item)" $URI = New-Object Uri($WebTarget) try { $WebRequest = [System.Net.WebRequest]::Create($URI) $WebResponse = $WebRequest.GetResponse() $WebStatus = $WebResponse.StatusCode $ResultObject += $ScanObject $WebResponse.Close() } catch { $WebStatus = $Error[0].Exception.InnerException.Response.StatusCode if ($WebStatus -eq $null) { # Not every exception returns a StatusCode. # If that is the case, return the Status. $WebStatus = $Error[0].Exception.InnerException.Status } } $Result = @{ Status = $WebStatus; URL = $WebTarget} $ScanObject = New-Object -TypeName PSObject -Property $Result Write-Output $ScanObject } } 

Please check out the other dictionaries and let me know if you see any other use cases for this script.  Thanks for checking this out and if you haven't bought your DerbyCon tickets yet, you should do so! If you are interested in PowerShell and security, Carlos Perez is teaching one of the first courses on the topic: "Introduction to PowerShell for Security Professionals" at this year's DerbyCon so sign up for it.  I can't wait!

-Chris