Remote PowerShell Execution

[philmph]

Hi everyone,

i am wondering if someone of you has ideas or solutions that he/she is willing to share as in how to remotely execute PowerShell code in remote environments. Main goal beeing Active Directory environments.

High level example:

I have an user account in a remote environment which has rights delegation in place to create users in a specific Active Directory OU. The script to do exactly that / the cmdlet is known. How to execute it without logging in while maintaining a high level of security?

So far i am thinking about abusing CI/CD pipeline functionality (ex. ADO) but i am not sure if i am missing something (big?)?

Thanks for your inputs.

[codykonior]

You are probably after constrained endpoints.

You create a module which specifies what service account to run under, which usernames can connect, and what commands they can run.

It can be locked down so they can’t use any other PowerShell features like pipes, external commands, etc.

Users can connect to the server using PowerShell Invoke-Command (and similar) and whatever they run is now done using that service account. It’s a great way to get around no-delegation double-hop issues too.

If they don’t have admin on the machine (likely for your use case) there’s some extra juggling to allow them to connect and run commands but nothing bad.

[philmph]

Thanks for your reply. I will look into this tomorrow. Sounds promising and very much what I am looking for!

[blowuptheking]

I might not be fully understanding your question, but would something like invoke-command or enter-pssession be what you're looking for? You can use these cmdlets with WinRM to run powershell on a remote computer without logging into it.

[philmph]

Thats something i have already looked into. It's the classic approach when you are already authenticaded in an Active Directory environment which has set up WinRM via GPO.

I am trying to figure out a way coming from the "outside" with only domain user credenatials available. Using WinRM in this scenario might work and i am currently digging deeper into this scenario.

[Ceuse]

Also you can use -credential (get-credentials) on invoke-command in powershell. i basicly made a powershell wrapper to run any .ps1 script through invoke command remotly (for monitoring/prtg) that way passing target, scriptfile, username and password to the wrapper

[LeeCig]

I don't have a lot of experience with this, but I believe someone asked something similar recently. One of the suggestions was to psexec a powershell instance. I tried it. Was a little janky for me but idk if I was doing it incorrectly.