The Enhance Mitigation Experience Toolkit (EMET) has to be one of the Microsoft security tools that I recommend the most to organizations of all sizes, friends and family do to that it helps curve in many cases the window of exploitation for many client side attacks when configured right on client machines in the network. EMET also provides protection for known vulnerabilities that have not been tailored to bypass it and against 0 day client side exploits for known software.

Many other people have written about the capabilities of EMET so I will not cover all the new features added and new capabilities in 4.0, in fact the documentation from Microsoft is great http://www.microsoft.com/en-us/download/details.aspx?id=39273 it covers how to deploy EMET via Group Policy and how to deploy it using System Center Configuration Manager. The documentation also cover all the features in great detail so I will not bore you regurgitating that information from there.

Now for this blog post it will part from some pre-conceived notions:

• All machines where we will deploy EMET are part of a Domain.
• WSUS is configured and issuing patches to the machines in the domain.
• You have organized your machines in to groups and your deployment of EMET is planned along this groups.

On September 25 and 26 I will be teaching at Derbycon my class on Introduction to PowerShell for Security Professionals https://www.derbycon.com/training-courses/#intropower . To give a bit of background on it I have since 2007 been using PowerShell since version 1 for automating, managing, securing and breaking Exchange, Windows, VMware, NetApp and even Cisco for several customers in the Caribbean, Central and South America. I have to admit of all the command shells I have used PowerShell has to be my favorite, it is truly a very powerful shell. I have coded several thousands of lines of PowerShell, in modules both in PowerShell and C#, I have also written several blog posts on it, all of this leading me to the creation of these class. Microsoft is evolving its technologies at a more rapid pace and PowerShell has become a critical pillar of its Management Framework for Windows and Server products. In the class targeted at security professionals, to me these are:

• System Admins that care about security.
• Auditors and Incident Response teams that need to work with live and offline Windows Systems.
• Pentesters that want to expand their skills with new ways to discover, enumerate, attack and do post exploitation using PowerShell.

The first day it will be a fast paced introduction to PowerShell and its philosophy, Covering:

• What is PowerShell.
• Using the Help Subsystem.
• Working with the Pipeline.
• Extending PowerShell via Module and Snappings.
• Formatting
• Remoteting
• PowerShell notion of security
• WMI and CIM
• Powershell Scripting Syntax

The second day will cover:

• Network Discovery.
• Incident Response and Auditing.
• Post Explotation

The Mimikatz extension on Meterpreter allows us to use the same commands we would on the standalone tool inside of Meterpreter as native commands. This blog post will cover specifically the stealing of a users certificates by exporting their keys for use by the attacker. In this specific scenario we have gotten a Meterpreter session on a developers system. The system is a Windows 7 System as we can see

Just updated DNSRecon to check if it can pull the Bind Version by doing a query for the TXT Record version.bind and it will now check if the RA Flag is set in responses from each of the NS servers it detects. If the server has recursion enabled it could be used for DDoS attacks and for performing Cache Snooping.