PowerShell Proxy-Aware Communication
In this module, we have primarily used the Net.WebClient download cradle.
This class is, by default, proxy-aware.
To validate this,
we’ll first set the proxy settings of the Windows 10 victim client
to match that of the Windows 10 development client,
which is running the Squid proxy software.
To set up the proxy on our machine,
we’ll right-click on the Windows Start icon and navigate to Settings
Network & Internet
and then Proxy,
and scroll down to “Manual proxy setup”.
We’ll enable the proxy server and enter the
IP address of the Windows 10 development client,
and the static TCP port 3128.
Finally, we’ll click Save and close the settings menu.
We can observe the proxy in action
by executing a two-line PowerShell download cradle.
Running the PowerShell code does not generate any errors.
If we switch to Kali,
and dump the latest entry from the Apache access logs,
we’ll find a request for run.ps1
coming from our Windows 10 development client
running the proxy server.
Since our Windows 10 victim client is at 192.168.120.11,
it seems the proxy is, in fact, working.
The proxy settings used by Net.WebClient
are stored in the .proxy property
and are populated from the DefaultWebProxy property
when creating the object.
We can view these settings using the GetProxy method
by specifying the URL to test against.
We can use this to quickly verify both the proxy server IP address and network port.
Since the proxy settings are configured dynamically through the proxy property,
we can remove them by simply creating an empty object
and running the code again.
Once again we can use the tail command
to dump the latest entry of the Apache access logs,
and this time observe the HTTP request
coming directly from the Windows 10 victim client.
In some environments,
network communications not going through the proxy will get blocked
by an edge firewall.
Otherwise,
we could bypass any monitoring that processes network traffic at the proxy.
We can quite easily manipulate the proxy settings of our download cradle
and as we shall see in the next section,
there is an additional property we can also tamper with.