Harness: PowerShell Weaponization Made Easy
Rich Kelley introduces Harness, a remote PowerShell payload execution and management framework designed for stealthy interactive post-exploitation.
Summary
Architecture and Background
The Harness toolset aims to give penetration testers and red teams the ability to pull a remote powershell interface with all the same features of the native Powershell CLI and more. Several tools and utilities have been released to solve the powershell weaponization problem, but no freely available tool give operators the full capabilities of powershell through a remote interface.
Vulnerability Analysis
We’ll start the talk with a quick survey of the previous methods of weaponizing powershell, and then move into the capabilities of the Harness toolset which includes a fully interactive powershell CLI, and remote importing of modules across the wire without staging. We’ll conclude with taking a look at the underlying code that makes the toolset work, and briefly discuss planned features.
Exploitation and Demonstrations
The Harness toolset will be released open source in conjunction with this talk. Rich Kelley (@RGKelley5) is a security researcher and the co-founder of Gray Tier Technologies, a small InfoSec start-up based out of Alexandria, VA.
Remediation and Defensive Strategies
After his time in the military he held positions as a network engineer, software engineer, and penetration tester for various government agencies. He recently moved into exploit development and reverse engineering, and is pretty sure he knows less than when he started.
Related talks
Main Stage·42 min
Nikhil Mittal
Nikhil Mittal details powerPreter: Post Exploitation Like a Boss NIKHIL MITTAL SECURITY RESEARCHER Powerpreter is "The" post exploitation tool.
Red Team Village·1 hr
Anthony Rose · Jake Krasnov
Anthony Rose and Jake Krasnov debunk the myth that PowerShell is dead for red teams, showing how modern adversaries weaponize PowerShell while evading AMSI and logging.
Village Presentations·51 min
Dave Kennedy
TrustedSec founder Dave Kennedy analyzes the dominance of targeted phishing attacks, demonstrating macro weaponization, PowerShell evasion, and lateral movement.