Skip to main content

Vynae - process exploration in PowerShell

Vynae can be found on my GitHub.

Vynae is a fleshed-out version of the original project, PidHunter. PidHunter was written for use in the Collegiate Cyber Defense Competition for tracing process IDs and gathering simple information about processes running in Windows Server environments. It started as a lightweight script that could be deployed on multiple servers and return consistent results. Mainly, it was used to detect Crowd Strike beacons after we discovered one of our servers had a beacon running on it. I wanted a way to pull up process and network information on the fly without needing to run multiple commands or tools. As such, it was hyper-specific to the situation I was in. While I originally tried to expand PidHunter to be useful in normal operations, it never really took off and was abandoned.

Cue summer semester 2022 where I found I had a good amount of extra time before classes started in earnest. I needed to take a break from some other projects, and as I'm taking an IR class this summer, I wanted to work on a project related to that. As I was digging through some older projects, I came across PidHunter and decided to roll with it. I very quickly realized that PidHunter was not something that could be updated without fully restarting it from bottom to top. To begin with, it relied entirely on WMI instead of CIM and used conversions to take the PowerShell objects and convert them into string variables for output formatting. This cut out a lot of functionality and advantage that PowerShell has when working with objects, and heavily reflected the inexperience I had writing PowerShell code at the time.

A little side note, Windows Management Framework is a Microsoft version of the open-source standard Common Information Model. CIM provides the same access as WMI, while also being more secure to use, and having more future-proofing as Microsoft is deprecating WMIC and likely WMI at some point. They seem to have been moving away from WMI to the more secure WinRM.

Moving on, after I decided to start from scratch on Vynae, I also wanted to create a more distinct output that was easier to understand at a glance. Unfortunately, I originally decided on re-writing the process tracing and information gathering functions of PidHunter, so I stuck with hardcoded Write-Host output formatting. As feature creep rose, the viability of this solution sunk greatly. One of the future updates will pass all formatting to a special function, allowing the actual process handling functions better readability. Regardless, I made the choice to have the most important information output in green and, in the case of a bad result, red. This allowed a break in the standard white on blue and made parsing through the results visually, easier.

Regarding feature creep, Vynae added network connection filtering, hashing, improved PPID tracing, and process spawn tracing. PidHunter only supported the display of certain process information and filtering by name or ID. As these features came to mind, they were added to the code without much planning or thought. This led the code to be rather redundant, leaving each function self-contained. The code then is somewhat lacking in readability and conciseness. This is something to be addressed at some point in the future but isn't a large issue for the moment.

Keeping in mind the intended features and the outcome goals (Using CIM and output formatting), I decided to use parameters instead of relying purely on arguments as PidHunter had. I hadn't used parameters in PowerShell scripts before, and a lot of the earlier code reflects that. Instead of directly using the values of the parameters in individual functions, I tended to pass them as variables and then use the value of the passed variable within the function. While this isn't a terrible issue, it does lead some functions to have redundant code and extra lines.

Vynae is the first 'completed' project I've done, in the sense that it meets all the original design goals and features. Typically, I draft something out and then leave it sitting, not moving forward with the project. As such, I've gone all out with it, and plan on keeping it updated for some time, adding improvements and optimizations over time. It isn't necessarily solving any great problem in tech, but I do think that it's a nifty little script that can be used in the day-to-day to get process information without running multiple commands.

Comments

Popular posts from this blog

Using PGPy to encrypt and decrypt files and messages

 PGPy is a library for python that enables the creation, storage, and encryption/decryption of PGP keys and files in python. Recently, in a small project to reacquaint myself with python, I used PGPy for key generation and encryption and decryption. That project can be found in my github at  https://github.com/lpowell . The goal of the project was to use command-line switches to control the program, and to provide basic encryption and decryption capabilities, along with rot13 and base64 encoding.  First, to load in a key use key, _ = pgpy.PGPKey.from_file(keyfilename) . This loads the key from either a binary or ASCII armored file. You can swap out .from_file for .from_blob , if you plan on using a key stored in a string or bytes object rather than a file. In my example code, I pull the key from a file, as I found it to be the simpler method.  Next, you'll need to open a file or create a string or bytes object that contains the message you wish to encrypt. We'll cal...

Using the Ubertooth One to sniff and intercept Bluetooth packets

While researching for my individual video project I came across this tool which allows for the sniffing and interception of bluetooth packets. This article covers some of the basic functionality of an Ubertooth One.  It's really quite interesting to see all the possibilities with devices like these. The tech behind them is very interesting as well. Hopefully, I'll be able to integrate some of this technology into my project video and include a demo of some of the interesting things it can do.

Huntress CTF Challenge Writeups: HumanTwo: MoveIt IoC Analysis Challenge

HumanTwo: MoveIT IoC Analysis Challenge The HumanTwo challenge is a malware CTF from the 2023 Huntress CTF. This write-up walks through the initial discovery, de-obfuscation, and solving of the challenge. The actual flag will be redacted from the document, but interested parties should be able to follow the steps and derive it themselves. While the write-up assumes a base level of knowledge regarding the command line and Linux. Most tools and commands will be accompanied by short explanations. Step 1: Initial Analysis To start off, we are given an archive with 1000 files named after their file hash. The hint we are given is that there are minor differences between each file. We also know that HumanTwo relates to the MoveIT vulnerability and exploit. The easy way to progress is to look up articles that tell you about the vulnerability and what stands out in each exploit script. However, I didn’t do that, so I’ll put the process I followed down instead. First, because I knew that...