Chapter 1
Engagement Management
Course: Comptia Pentest Pt0 003
Subject: Comptia Pentest Plus
Chapter: Attacks And Exploits
Attackers use scripting languages such as PowerShell to automate reconnaissance, privilege escalation, and lateral movement within Windows environments. PowerShell is particularly useful in Active Directory (AD) attacks, allowing attackers to gather information, manipulate security settings, and exploit misconfigurations. Below are common PowerShell attack frameworks, their use cases, and defensive measures.
1. PowerShell for Attack Automation
PowerShell is a scripting language and automation framework built into Windows. While it is widely used for system administration, attackers leverage it for unauthorized access, persistence, and network traversal.
1. PowerSploit
PowerSploit is a post-exploitation framework designed for privilege escalation, credential dumping, and persistence. It includes modules that allow attackers to inject malicious code into processes, extract credentials, and move laterally across networks.
Primary use cases
- Process injection: Injects malicious payloads into legitimate processes to evade detection.
- Credential dumping: Uses tools like Mimikatz to extract passwords and hashes from memory.
- Lateral movement: Uses PowerShell Remoting to move between machines within a domain.