{"id":8332,"date":"2020-01-14T13:13:25","date_gmt":"2020-01-14T07:43:25","guid":{"rendered":"http:\/\/kalilinuxtutorials.com\/?p=8332"},"modified":"2020-01-14T13:13:25","modified_gmt":"2020-01-14T07:43:25","slug":"chaps","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/chaps\/","title":{"rendered":"CHAPS : Configuration Hardening Assessment PowerShell Script"},"content":{"rendered":"\n

CHAPS <\/strong>is a PowerShell script for checking system security settings where additional software and assessment tools, such as Microsoft Policy Analyzer, cannot be installed. <\/p>\n\n\n\n

The purpose of this script is to run it on a server or workstation to collect configuration information about that system. The information collected can then be used to provide recommendations (and references) to improve the security of the individual system and systemic issues within the organization’s Windows environment. <\/p>\n\n\n\n

Examples of environments where this script is useful include Industrial Control System (ICS) environments where systems cannot be modified. These systems include Engineer \/ Operator workstations, Human Machine Interface (HMI) systems, and management servers that are deployed in production environments.<\/p>\n\n\n\n

This script is NOT intended to be a replacement for Microsoft’s Policy Analyzer. The best way to audit a system’s configuration is to use the Microsoft Security Compliance Toolkit<\/a> and Policy Analyzer with a Windows Workstation Security Baseline GPO<\/a>. <\/p>\n\n\n\n

The Policy Analyzer’s output can be exported an MS Excel file, but it requires the Microsoft Excel is installed on the system. Cut and pasting this information does work, but might not be an option on a physical system. Also, using the Policy Analyzer requires installation of the Windows software, which may not be permitted.<\/p>\n\n\n\n

This script runs in PowerShell and should be PowerShell-version \nindependent. Some checks may fail depending on the Windows version, \nsystem configurations, and whether or not it is run with Administrator \nprivileges. Instances where commands did not run successfully are noted \nand should be manually investigated where possible.<\/p>\n\n\n\n

This script was developed using information from several sources (noted in Useful Resources section) to identify recommended security configurations to reduce the likelihood of a compromised system and to log user events conducted on the system. It pulls heavily from the Securing Windows Workstations<\/a> baseline outlined by Sean Metcalf<\/a>.<\/p>\n\n\n\n

Also Read – Stowaway : Multi-hop Proxy Tool For Pentesters<\/a><\/strong><\/p>\n\n\n\n

<\/a><\/h2>\n\n\n\n

How To Use?<\/strong><\/p>\n\n\n\n

The best way to run this script within an ICS environment is to not write any programs or scripts to the system being reviewed. Do this by serving these scripts from a webserver running on another system on the network. <\/p>\n\n\n\n

Download CHAPS and PowerSploit into the same directory and open a terminal and change into that directory. Using Python3 run the command ‘python3 -m http.server 8181’. This will start a webserver listening on all of the systems IP addresses.<\/p>\n\n\n\n

On the target system open a CMD.exe window, preferably as an Administrator. Run the command powershell.exe -exec bypass<\/code> to being a PowerShell prompt. From this prompt, run the following command to execute the chaps.ps1<\/code> script.<\/p>\n\n\n\n

IEX (New-Object Net.WebClient).DownloadString(‘http:\/\/:8181\/chaps\/chaps.ps1′) <\/webserver><\/strong><\/p>\n\n\n\n

To run the chaps-powershell.ps1<\/strong><\/code> script be sure to turn off the system’s Anti-virus to include real-time protection. Running the following commands will import the appropriate PowerSploit scripts and then run them.<\/p>\n\n\n\n

IEX (New-Object Net.WebClient).DownloadString(‘http:\/\/:8181\/PowerSploit\/Recon\/PowerView.ps1′) <\/webserver>
IEX (New-Object Net.WebClient).DownloadString(‘http:\/\/:8181\/PowerSploit\/Exfiltration\/Get-GPPPassword.ps1′) <\/webserver><\/webserver>
(New-Object Net.WebClient).DownloadString(‘http:\/\/:8181\/PowerSploit\/Exfiltration\/Get-GPPAutologon.ps1′) <\/webserver><\/webserver><\/webserver>
IEX (New-Object Net.WebClient).DownloadString(‘http:\/\/:8181\/PowerSploit\/Exfiltration\/Get-VaultCredential.ps1′) <\/webserver><\/webserver><\/webserver><\/webserver>
IEX (New-Object Net.WebClient).DownloadString(‘http:\/\/:8181\/PowerSploit\/Privesc\/PowerUp.ps1′) <\/webserver><\/webserver><\/webserver><\/webserver><\/webserver>
IEX (New-Object Net.WebClient).DownloadString(‘http:\/\/:8181\/chaps\/chaps-powersploit.ps1′) <\/webserver><\/webserver><\/webserver><\/webserver><\/webserver><\/webserver><\/strong><\/p>\n\n\n\n

Each script’s outputs will be written to the user’s Temp directory as\n defined by the $env:temp variable. Copy these files off of the system \nbeing reviewed, delete them, and, if necessary, restart the system’s \nanti-virus.<\/p>\n\n\n\n

<\/a><\/h2>\n\n\n\n

System Configuration Checks<\/strong><\/p>\n\n\n\n

<\/a><\/h3>\n\n\n\n

System Info Command<\/strong><\/p>\n\n\n\n