powershell
15 Ways to Bypass the PowerShell Execution Policy
By default, PowerShell is configured to prevent the execution of PowerShell scripts on Windows systems. In this blog I’ll cover 15 ways to bypass the PowerShell execution policy without having local administrator rights on the system.
Attacking Azure with Custom Script Extensions
NetSPI's Jake Karnes explains two paths you can take to execute commands on Azure VMs from the Azure Portal and Cloud Shell.
Maintaining Azure Persistence via Automation Accounts
How do you maintain a privileged persistence in Azure? Learn how to use Automation Accounts to create a webhook backdoor to give you a way back in.
Using Azure Automation Accounts to Access Key Vaults
Have contributor access to a subscription, but no vault access? This post covers accessing Key Vault Keys via privileged Automation Accounts.
Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence
Logging in with RunAs certificates is a great way for maintaining access in an Azure environment during a penetration test. See how we export the PFX files.
ADIDNS Revisited – WPAD, GQBL, and More
This post will mainly cover some additional techniques on both the offensive and defensive fronts for exploiting Active Directory-Integrated DNS (ADIDNS).
Running PowerShell on Azure VMs at Scale
Getting PowerShell scripts to run on Azure VMs can be a bit of a pain. Using the AzureRM cmdlets, NetSPI shows you how to get quickly your scripts running.
Anonymously Enumerating Azure Services
Microsoft makes use of a number of different domains/subdomains for each of their Azure services. NetSPI has a tool to help enumerate Azure hosted services.
Inveigh – What's New in Version 1.4
New Inveigh release! This blog details all the new features.
Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions
Get-AzurePasswords.ps1 is a PowerShell script for automating the credential gathering process for Microsoft Azure subscriptions.
Anonymously Enumerating Azure File Resources
Much like publicly exposed S3 buckets, Microsoft's Azure platform can suffer from similar data exposure issues via its Blob file storage service.
Beyond LLMNR/NBNS Spoofing – Exploiting Active Directory-Integrated DNS
Exploiting weaknesses in name resolution protocols is a common technique for performing man-in-the-middle (MITM) attacks. This blog dives into two particularly vulnerable name resolution protocols: Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBNS).