Windows oneliners to download remote payload and execute arbitrary code

stephengillie wrote: post #3

Modifying the execution permissions in Powershell requires admin permissions. I'm guessing the author has local admin and does not realize it.

Exactly, which was done to prevent the old WSH attack vectors.

Then again all cool kids now do curl | sh anyway.

Re: Windows oneliners to download remote payload and execute arbitrary code

#5

Post by resoluteteeth » Sat, Oct 13, 2018, 2:08 PM UTC

stephengillie wrote: post #3

Modifying the execution permissions in Powershell requires admin permissions. I'm guessing the author has local admin and does not realize it.

Perhaps I'm misunderstanding what you're saying, but if by "execution permissions" you mean running "powershell -executionpolicy bypass" this doesn't require you to be administrator.

The only thing you need to be administrator for is to run "Set-ExecutionPolicy -Scope LocalMachine"

Re: Windows oneliners to download remote payload and execute arbitrary code

#6

Post by skrebbel » Sat, Oct 13, 2018, 2:16 PM UTC

pjmlp wrote: post #4

stephengillie wrote: post #3

Modifying the execution permissions in Powershell requires admin permissions. I'm guessing the author has local admin and does not realize it.

Exactly, which was done to prevent the old WSH attack vectors. Then again all cool kids now do curl | sh anyway.

I'm a lifelong Windows user - I usually install software by downloading installers and double clicking them.

Every so often HN rolls their eyes at all these idiots who do "curl | sh". How is doing so any different from downloading an installer over https and running it? Really, if installing software is what we're doing, isn't running it part of the objective?

Or, in short, why is "curl | sh" frowned upon and why are alternatives better?

Re: Windows oneliners to download remote payload and execute arbitrary code

#7

Post by auxym » Sat, Oct 13, 2018, 2:16 PM UTC

stephengillie wrote: post #3

Modifying the execution permissions in Powershell requires admin permissions. I'm guessing the author has local admin and does not realize it.

Permanently modifying it (using Set-ExecutionPolicy) requires admin, but from what I remember, setting it on a per-process basis by starting powershell.exe with the -ExecutionPolicy flag does not.

Re: Windows oneliners to download remote payload and execute arbitrary code

#8

Post by thrower123 » Sat, Oct 13, 2018, 2:26 PM UTC

skrebbel wrote: post #6

pjmlp wrote: post #4

Earlier quoted context omitted.

Exactly, which was done to prevent the old WSH attack vectors. Then again all cool kids now do curl | sh anyway.

I'm a lifelong Windows user - I usually install software by downloading installers and double clicking them. Every so often HN rolls their eyes at all these idiots who do "curl | sh". How is doing so any different from downloading an installer over https and running it? Really, if installing software is what we're doing, isn't running it part of the objective? Or, in short, why is "curl | sh" frowned upon and why are…

An installer should be digitally signed, and Windows will flag unsigned installers and try to tell you it is questionable to run.

You can also check that an installer isn't corrupted sfter downloading and before running, classically withe the md5 hash.

Re: Windows oneliners to download remote payload and execute arbitrary code

#9

Post by resoluteteeth » Sat, Oct 13, 2018, 2:27 PM UTC

auxym wrote: post #7

stephengillie wrote: post #3

Modifying the execution permissions in Powershell requires admin permissions. I'm guessing the author has local admin and does not realize it.

Permanently modifying it (using Set-ExecutionPolicy) requires admin, but from what I remember, setting it on a per-process basis by starting powershell.exe with the -ExecutionPolicy flag does not.

You actually can even permanently modify it as a normal user. You need to be admin to run set-executionpolicy -Scope LocalMachine (which is the default) but you can run set-executionpolicy -Scope CurrentUser as a normal user.

(This can be overridden by policies though.)

Also, in windows 10 the default ExecutionPolicy changed from Windows 7 so by default you can run powershell scripts even without using -executionpolicy bypass.

Re: Windows oneliners to download remote payload and execute arbitrary code

#10

Post by bobalob_wtf » Sat, Oct 13, 2018, 2:28 PM UTC

skrebbel wrote: post #6

pjmlp wrote: post #4

Earlier quoted context omitted.

Exactly, which was done to prevent the old WSH attack vectors. Then again all cool kids now do curl | sh anyway.

I'm a lifelong Windows user - I usually install software by downloading installers and double clicking them. Every so often HN rolls their eyes at all these idiots who do "curl | sh". How is doing so any different from downloading an installer over https and running it? Really, if installing software is what we're doing, isn't running it part of the objective? Or, in short, why is "curl | sh" frowned upon and why are…

It all comes down to trust. If you trust that the code you're downloading is good then by all means curl | sh.

A lot of things can go wrong with this though, if you pull a script from a github link and run it, the code could have been modified since you last looked at the repo and now you're directly running malicious code.

When you download an msi in Windows and then double click to install, you're also putting your trust in the website, the software author and anyone else in the supply chain.

I think the better option is downloading, manually reviewing the script you downloaded, and then running it.

If you're devops-ing something then you should probably download the script/code and then do some kind of hash or signature check to make sure it's the known good version, then run it.