Get $pwnd: Attacking Battle Hardened Windows Server
Systematically destroying hardened PowerShell JEA endpoints through insecure coding practices.
Summary
PowerShell JEA Hardening
Windows Server has introduced advanced remote management hardening through PowerShell Just Enough Administration (JEA). Correctly configured hardened JEA endpoints provide formidable barriers against attackers with whitelisted commands and no OS-level access.
Attack Methodology
The presentation shows systematic destruction of hardened JEA endpoints. Exploiting insecure coding practices and administrative complexity reveals weaknesses in otherwise strong hardening.
Bypass Techniques
When JEA is properly configured, attackers must exploit implementation weaknesses and command functionality misuse. The techniques show how proper hardening can still be circumvented.
Practical Demonstration
Live demonstrations showcase the attack process, illustrating how organizations can identify and eliminate the exploited weaknesses in their JEA implementations.
Related talks
Main Stage·18 min
Christopher Campbell
Christopher Campbell explores the $env:path less traveled at DEF CON 22, examining powershell and practical defenses.
Main Track 1·20 min
Dor Azouri
Exploiting Windows BITS service state files to inject jobs and execute code as NT AUTHORITY/SYSTEM.
Main Track 1·44 min
Saif El Sherei
Complete walkthroughs of Windows kernel exploitation using GDI bitmap objects with released exploits.