Powershell Things

• Educational
• • Get-Help: An Intro to PowerShell and How to Use it for Evil - Jared Haight
  • Brosec
    • Brosec is a terminal based reference utility designed to help us infosec bros and broettes with usefuPowershelll (yet sometimes complex) payloads and commands that are often used during work as infosec practitioners. An example of one of Brosec's most popular use cases is the ability to generate on the fly reverse shells (python, perl, powershell, etc) that get copied to the clipboard.
  • Introducing PowerShell into your Arsenal with PS>Attack - Jared Haight
    • Introducing PS Attack, a portable PowerShell attack toolkit - Jared Haight
  • PowerShell Secrets and Tactics Ben0xA
  • Egress Testing using PowerShell
• Articles/Blogposts/Presentations/Talks/Writeups
  • Client Side attacks using Powershell
  • Accessing the Windows API in PowerShell via internal .NET methods and reflection
    • It is possible to invoke Windows API function calls via internal .NET native method wrappers in PowerShell without requiring P/Invoke or C# compilation. How is this useful for an attacker? You can call any Windows API function (exported or non-exported) entirely in memory. For those familiar with Metasploit internals, think of this as an analogue to railgun.
  • PSReflect
    • Easily define in-memory enums, structs, and Win32 functions in PowerShell
• Command and Control
  • Empire
    • Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent, and a pure Python 2.6/2.7 Linux/OS X agent. It is the merge of the previous PowerShell Empire and Python EmPyre projects. The framework offers cryptologically-secure communications and a flexible architecture. On the PowerShell side, Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework. PowerShell Empire premiered at BSidesLV in 2015 and Python EmPyre premeiered at HackMiami 2016.
  • Koadic
    • Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host (a.k.a. JScript/VBScript), with compatibility in the core to support a default installation of Windows 2000 with no service packs (and potentially even versions of NT4) all the way through Windows 10.
  • Babadook
    • Connection-less Powershell Persistent and Resilient Backdoor
• Active Directory
  • Offensive Active Directory with Powershell
  • Attacking ADFS Endpoints with PowerShell
  • Find AD users with empty password using PowerShell
  • LDAPDomainDump
    • In an Active Directory domain, a lot of interesting information can be retrieved via LDAP by any authenticated user (or machine). This makes LDAP an interesting protocol for gathering information in the recon phase of a pentest of an internal network. A problem is that data from LDAP often is not available in an easy to read format. ldapdomaindump is a tool which aims to solve this problem, by collecting and parsing information available via LDAP and outputting it in a human readable HTML format, as well as machine readable json and csv/tsv/greppable files.
  • ACLight
    • The tool queries the Active Directory (AD) for its objects' ACLs and then filters and analyzes the sensitive permissions of each one. The result is a list of domain privileged accounts in the network (from the advanced ACLs perspective of the AD). You can run the scan with just any regular user (could be non-privileged user) and it automatically scans all the domains of the scanned network forest.
  • MailSniper
    • MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain. MailSniper also includes additional modules for password spraying, enumerating users/domains, gathering the Global Address List from OWA and EWS, and checking mailbox permissions for every Exchange user at an organization.
  • I hunt sys admins 2.0
  • Invoke-TheHash
    • Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB services are accessed through .NET TCPClient connections. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.
  • LAPSToolkit
    • Tool to audit and attack LAPS environments
• AV Bypass Stuff
  • Invoke-Obfuscation
    • Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator.
    • Presentation
    • Invoke-Obfuscation: PowerShell obFUsk8tion Techniques & How To (Try To) D""eTecT 'Th'+'em'
  • Pulling Back the Curtains on EncodedCommand PowerShell Attacks
  • Invoke-CradleCrafter: Moar PowerShell obFUsk8tion by Daniel Bohannon
  • Invoke-CradleCrafter v1.1
• Bypass Powershell Restrictions
  • Articles/Videos
    • AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It - Blogpost
    • AMSI: How Windows 10 Plans to Stop Script-Based Attaacks and How Well It Does It - BH US16
    • 15 Ways to bypass Powershell execution-policy settings
      • Does what it says on the tin. Overall, its clear that execution-policy was not meant as a security method. Or if it was, someone was drinking a bit too much.
    • PSAmsi - An offensive PowerShell module for interacting with the Anti-Malware Scan Interface in Windows 10
    • Bypassing AMSI via COM Server Hijacking
    • PowerShell ScriptBlock Logging Bypass
    • Powershell without Powershell to bypass app whitelist
    • Empire without PowerShell.exe
    • Exploiting PowerShell Code Injection Vulnerabilities to Bypass Constrained Language Mode
    • PSShell
      • PSShell is an application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET). It doesn't need to be "installed" so it's very portable.
  • Tools
    • DigitalSignature-Hijack.ps1
      • Hijack Digital Signatures – PowerShell Script - pentestlab
    • PoCSubjectInterfacePackage
      • A proof-of-concept subject interface package (SIP) used to demonstrate digital signature subversion attacks.
    • PSAmsi
      • PSAmsi is a tool for auditing and defeating AMSI signatures.
    • nps - Not PowerShell
      • Execute powershell without powershell.exe
    • nps_payload
      • This script will generate payloads for basic intrusion detection avoidance. It utilizes publicly demonstrated techniques from several different sources.
    • PowerShdll
      • Run PowerShell with rundll32. Bypass software restrictions.
    • p0wnedShell
      • p0wnedShell is an offensive PowerShell host application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET).
    • UnmanagedPowerShell
    • PowerOPS: PowerShell for Offensive Operations
      • PowerOPS Github page
      • PowerOPS is an application written in C# that does not rely on powershell.exe but runs PowerShell commands and functions within a powershell runspace environment (.NET). It intends to include multiple offensive PowerShell modules to make the process of Post Exploitation easier.
    • PowerLine
      • Presentation
• Dumping/Grabbing Creds
  • PShell Script: Extract All GPO Set Passwords From Domain
    • This script parses the domain’s Policies folder looking for Group.xml files. These files contain either a username change, password setting, or both. This gives you the raw data for local accounts and/or passwords enforced using Group Policy Preferences. Microsoft chose to use a static AES key for encrypting this password. How awesome is that!
  • mimikittenz
    • A post-exploitation powershell tool for extracting juicy info from memory.
  • Inveigh
    • Inveigh is a PowerShell LLMNR/mDNS/NBNS spoofer and man-in-the-middle tool designed to assist penetration testers/red teamers that find themselves limited to a Windows system.
  • PowerMemory
    • Exploit the credentials present in files and memory. PowerMemory levers Microsoft signed binaries to hack Microsoft operating systems.
  • Dump-Clear-Text-Password-after-KB2871997-installed
    • Auto start Wdigest Auth,Lock Screen,Detect User Logon and get clear password.
  • SessionGopher
    • SessionGopher is a PowerShell tool that finds and decrypts saved session information for remote access tools. It has WMI functionality built in so it can be run remotely. Its best use case is to identify systems that may connect to Unix systems, jump boxes, or point-of-sale terminals. SessionGopher works by querying the HKEY_USERS hive for all users who have logged onto a domain-joined box at some point. It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information. It automatically extracts and decrypts WinSCP, FileZilla, and SuperPuTTY saved passwords. When run in Thorough mode, it also searches all drives for PuTTY private key files (.ppk) and extracts all relevant private key information, including the key itself, as well as for Remote Desktop (.rdp) and RSA (.sdtid) files.
  • Invoke-WCMDump
    • PowerShell script to dump Windows credentials from the Credential Manager. Invoke-WCMDump enumerates Windows credentials in the Credential Manager and then extracts available information about each one. Passwords are retrieved for "Generic" type credentials, but can not be retrived by the same method for "Domain" type credentials. Credentials are only returned for the current user. Does not require admin privileges!
• Grabbing Useful files
  • BrowserGatherer
    • Fileless Extraction of Sensitive Browser Information with PowerShell
  • SessionGopher
    • SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.
  • CC_Checker
    • CC_Checker cracks credit card hashes with PowerShell.
  • BrowserGather
    • Fileless Extraction of Sensitive Browser Information with PowerShell. This project will include various cmdlets for extracting credential, history, and cookie/session data from the top 3 most popular web browsers (Chrome, Firefox, and IE). The goal is to perform this extraction entirely in-memory, without touching the disk of the victim. Currently Chrome credential and cookie extraction is supported.
• Malicious X (Document/Macro/whatever) Generation
  • ​psWar.py
  • Code that quickly generates a deployable .war for a PowerShell one-liner
• Priv Esc / Post Ex Scripts
  • PowerUp
    • PowerUp is a powershell tool to assist with local privilege escalation on Windows systems. It contains several methods to identify and abuse vulnerable services, as well as DLL hijacking opportunities, vulnerable registry settings, and escalation opportunities.
  • Sherlock
    • PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.
  • JSRat-Py
    • implementation of JSRat.ps1 in Python so you can now run the attack server from any OS instead of being limited to a Windows OS with Powershell enabled
  • ps1-toolkit
    • This is a set of PowerShell scripts that are used by many penetration testers released by multiple leading professionals. This is simply a collection of scripts that are prepared and obfuscated to reduce level of detectability and to slow down incident response from understanding the actions performed by an attacker.
• Recon
  • Invoke-ProcessScan
    • Gives context to a system. Uses EQGRP shadow broker leaked list to give some descriptions to processes.
  • Veil-PowerView
    • Veil-PowerView is a powershell tool to gain network situational awareness on Windows domains. It contains a set of pure-powershell replacements for various windows net * commands, which utilize powershell AD hooks and underlying Win32 API functions to perform useful Windows domain functionality.
  • PowerShell-AD-Recon
    • AD PowerShell Recon Scripts
• Miscellaneous Useful Things
  • Invoke-DCOM.ps1
  • PowerShell and Token Impersonation
  • Harness
    • Harness is remote access payload with the ability to provide a remote interactive PowerShell interface from a Windows system to virtually any TCP socket. The primary goal of the Harness Project is to provide a remote interface with the same capabilities and overall feel of the native PowerShell executable bundled with the Windows OS.
  • AutoRuns PowerShell Module
    • AutoRuns module was designed to help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
  • Dirty Powershell Webserver
  • 7Zip4Powershell * Powershell module for creating and extracting 7-Zip archives
  • Invoke-VNC
    • Powershell VNC injector
  • Nishang
    • Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.