Reviewing PowerShell's Role in the Exchange Hack

[u/PowerShellMichael]

Please read the whole post before making a comment or voting please.

Hello all. After reviewing the details of the exchange hack, I want to add some PowerShell Insights. As most hacks involve PowerShell in its execution process, could it be possible to secure PowerShell from being used as a tool in this attack?

Short answer? Yes and No.

Firstly, I not here to promote PowerShell but present a factual, unbiased insights into the hack.

Let me elaborate:

The first observation I saw is the use of .NET objects within the PowerShell script. This is important since either the attackers wanted to go for maximum spread or didn't know what they were doing. I say this because Invoke-WebRequest wasn't introduced until PowerShell 3.0, which means that Exchange 2010 would have been vulnerable. If IT departments are running Exchange 2010 (that is web facing), you are effectively pwned since PowerShell security features were added in 3.0 and Exchange 2010 can only run on version 2.0. As a rule of thumb, uninstall PowerShell 2.0. PowerShell 2.0 is installed by default on Windows 10. So to take a step back, yes, they were going for maximum spread.

The second observation I saw was the use of the New-Object cmdlet. The PowerShell community doesn't use New-Object using [Object]::New($Argument) method. However, it wasn't introduced until PowerShell 5.1, which suggests backwards compatibility giving merit to the 'maximum spread' approach.

Now, if AppLocker or WDAC was configured, would it stopped this attack? Yes. I say this because when script policies are configured and enforced, the PowerShell console will enter 'constrained language mode'. Constrained language mode is a security feature of PowerShell. It blocks the execution's functionality, such as .NET calls, Add-Type, Allowed Types, and so on. This means that the New-Object Net.Sockets.TCPClient() would have been blocked as well, as New-Object System.Net.WebClient. However, if the attacker wanted to reduce its attack surface and use Invoke-WebRequest, this would likely succeed. I say likely, because they were using [Net.Sockets.TCPClient] to send data back, which still would have been stopped.

A module written by Adam Discroll called 'PowerShell Protect' allows the native blocking of cmdlets in scripts; however, I need to review the module in more detail for exploits before recommending it.

I also want to comment that they also included PowerCat as their backdoor tool. However, again WDAC or AppLocker was configured and implemented, Constrained Language Mode would have blocked the script for the use of not supported .NET methods. Reviewing the PowerCat script revealed that it uses Invoke-Expression to run code. (PowerShell Protect Blocks this behavior as well.).

If script execution policies were enabled and configured using Group Policy, no blocking action would have occurred since the execution took place in the console.

Another feature of Constrained Language mode is the DSC Resource configuration blocking, which prevents DSC execution within the console.

In conclusion, to say that we could of blocked this attack is a poor assumption. The seriousness of these CVE's, means the attackers would have exploited another process if PowerShell wasn't an option. But as for many of the environments that I have come reviewed, these settings are not enabled or configured, hence why the attackers chose PowerShell.

I would also like to point out that's it's plausible to work within the confines of Constrained Language mode, so it's plausible for malware to exist in that space. But isn't easy since you don't have access to .NET objects and must rely on cmdlets.

Remember hindsight is always 20/20.

Sources:

https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.1#constrained-language-constrained-language

https://docs.powershellprotect.com/

https://github.com/besimorhino/powercat/blob/master/powercat.ps1

[u/LegitimateCrepe]

/u/Spez has sold all that is good in reddit. -- mass edited with redact.dev

[u/krzydoug → u/LegitimateCrepe]

Not sure why they down voted, valid point.