(2 votes, average: 5.00 out of 5)
Loading...1 2 3 4 5 | 1..60 | ForEach-Object { $percent = $_ * 100 / $seconds Write-Progress -Activity Break -Status "$($seconds - $_) seconds remaining..." -PercentComplete $percent Start-Sleep -Seconds 1 } |
(1 votes, average: 5.00 out of 5)Loading...1 2 3 4 5 6 7 8 9 10 11 12 | $code = { Get-Process Get-Service $var2 = 12 } [System.Management.Automation.PSParser]::Tokenize($code,[ref]$null) | ForEach-Object { if ($_.Type -eq 'Command') { $_.content } } |
(3 votes, average: 5.00 out of 5)Loading...1 2 3 4 5 6 7 8 9 10 11 | # 4624: An account was successfully logged on Get-EventLog -LogName Security -InstanceId 4624 | ForEach-Object { # Convertir el contenido del log en un objeto [PSCustomObject]@{ Time = $_.TimeGenerated Usuario = "{0}\{1}" -f $_.ReplacementStrings[5], $_.ReplacementStrings[6] Type = $_.ReplacementStrings[10] Path = $_.ReplacementStrings[17] } } |
(1 votes, average: 5.00 out of 5)Loading...1 2 3 4 5 6 7 8 9 10 11 12 | $url = "https://www.jesusninoc.com/2017/06/22/encontrar-cmdlets-en-un-bloque-de-powershell/" $result = Invoke-WebRequest $url #La etiqueta que tenemos buscar es: class="crayon-plain-wrap" $code = $result.AllElements | Where Class -eq “crayon-plain-wrap” | %{$_.innerText} [System.Management.Automation.PSParser]::Tokenize($code,[ref]$null) | ForEach-Object { if (($_.Type -eq 'Command') -or ($_.Type -eq 'Variable')) { Write-Host $_.content,$_.type } } |
(No Ratings Yet)Loading...1 2 3 4 5 6 7 8 9 10 11 12 | $url = "https://www.jesusninoc.com/2017/06/22/encontrar-cmdlets-en-un-bloque-de-powershell/" $result = Invoke-WebRequest $url #La etiqueta que tenemos buscar es: class="crayon-plain-wrap" $code = $result.AllElements | Where Class -eq “crayon-plain-wrap” | %{$_.innerText} [System.Management.Automation.PSParser]::Tokenize($code,[ref]$null) | ForEach-Object { if ($_.Type -eq 'Command') { $_.content } } |
(No Ratings Yet)Loading...1 | (0..5 | ForEach-Object { '{0:x}{1:x}' -f (Get-Random -Minimum 0 -Maximum 15),(Get-Random -Minimum 0 -Maximum 15)}) -join ':' |
(No Ratings Yet)Loading...1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 | Alias % -> ForEach-Object Alias ? -> Where-Object Alias ac -> Add-Content Alias asnp -> Add-PSSnapin Alias cat -> Get-Content Alias cd -> Set-Location Alias CFS -> ConvertFrom-String Alias chdir -> Set-Location Alias clc -> Clear-Content Alias clear -> Clear-Host Alias clhy -> Clear-History Alias cli -> Clear-Item Alias clp -> Clear-ItemProperty Alias cls -> Clear-Host Alias clv -> Clear-Variable Alias cnsn -> Connect-PSSession Alias compare -> Compare-Object Alias copy -> Copy-Item Alias cp -> Copy-Item Alias cpi -> Copy-Item Alias cpp -> Copy-ItemProperty Alias curl -> Invoke-WebRequest Alias cvpa -> Convert-Path Alias dbp -> Disable-PSBreakpoint Alias del -> Remove-Item Alias diff -> Compare-Object Alias dir -> Get-ChildItem Alias dnsn -> Disconnect-PSSession Alias ebp -> Enable-PSBreakpoint Alias echo -> Write-Output Alias epal -> Export-Alias Alias epcsv -> Export-Csv Alias epsn -> Export-PSSession Alias erase -> Remove-Item Alias etsn -> Enter-PSSession Alias exsn -> Exit-PSSession Alias fc -> Format-Custom Alias fhx -> Format-Hex Alias fl -> Format-List Alias foreach -> ForEach-Object Alias ft -> Format-Table Alias fw -> Format-Wide Alias gal -> Get-Alias Alias gbp -> Get-PSBreakpoint Alias gc -> Get-Content Alias gci -> Get-ChildItem Alias gcm -> Get-Command Alias gcs -> Get-PSCallStack Alias gdr -> Get-PSDrive Alias ghy -> Get-History Alias gi -> Get-Item Alias gjb -> Get-Job Alias gl -> Get-Location Alias gm -> Get-Member Alias gmo -> Get-Module Alias gp -> Get-ItemProperty Alias gps -> Get-Process Alias gpv -> Get-ItemPropertyValue Alias group -> Group-Object Alias gsn -> Get-PSSession Alias gsnp -> Get-PSSnapin Alias gsv -> Get-Service Alias gu -> Get-Unique Alias gv -> Get-Variable Alias gwmi -> Get-WmiObject Alias h -> Get-History Alias history -> Get-History Alias icm -> Invoke-Command Alias iex -> Invoke-Expression Alias ihy -> Invoke-History Alias ii -> Invoke-Item Alias ipal -> Import-Alias Alias ipcsv -> Import-Csv Alias ipmo -> Import-Module Alias ipsn -> Import-PSSession Alias irm -> Invoke-RestMethod Alias ise -> powershell_ise.exe Alias iwmi -> Invoke-WMIMethod Alias iwr -> Invoke-WebRequest Alias kill -> Stop-Process Alias lp -> Out-Printer Alias ls -> Get-ChildItem Alias man -> help Alias md -> mkdir Alias measure -> Measure-Object Alias mi -> Move-Item Alias mount -> New-PSDrive Alias move -> Move-Item Alias mp -> Move-ItemProperty Alias mv -> Move-Item Alias nal -> New-Alias Alias ndr -> New-PSDrive Alias ni -> New-Item Alias nmo -> New-Module Alias npssc -> New-PSSessionConfigurationFile Alias nsn -> New-PSSession Alias nv -> New-Variable Alias ogv -> Out-GridView Alias oh -> Out-Host Alias popd -> Pop-Location Alias ps -> Get-Process Alias pushd -> Push-Location Alias pwd -> Get-Location Alias r -> Invoke-History Alias rbp -> Remove-PSBreakpoint Alias rcjb -> Receive-Job Alias rcsn -> Receive-PSSession Alias rd -> Remove-Item Alias rdr -> Remove-PSDrive Alias ren -> Rename-Item Alias ri -> Remove-Item Alias rjb -> Remove-Job Alias rm -> Remove-Item Alias rmdir -> Remove-Item Alias rmo -> Remove-Module Alias rni -> Rename-Item Alias rnp -> Rename-ItemProperty Alias rp -> Remove-ItemProperty Alias rsn -> Remove-PSSession Alias rsnp -> Remove-PSSnapin Alias rujb -> Resume-Job Alias rv -> Remove-Variable Alias rvpa -> Resolve-Path Alias rwmi -> Remove-WMIObject Alias sajb -> Start-Job Alias sal -> Set-Alias Alias saps -> Start-Process Alias sasv -> Start-Service Alias sbp -> Set-PSBreakpoint Alias sc -> Set-Content Alias select -> Select-Object Alias set -> Set-Variable Alias shcm -> Show-Command Alias si -> Set-Item Alias sl -> Set-Location Alias sleep -> Start-Sleep Alias sls -> Select-String Alias sort -> Sort-Object Alias sp -> Set-ItemProperty Alias spjb -> Stop-Job Alias spps -> Stop-Process Alias spsv -> Stop-Service Alias start -> Start-Process Alias sujb -> Suspend-Job Alias sv -> Set-Variable Alias swmi -> Set-WMIInstance Alias tee -> Tee-Object Alias trcm -> Trace-Command Alias type -> Get-Content Alias wget -> Invoke-WebRequest Alias where -> Where-Object Alias wjb -> Wait-Job Alias write -> Write-Output |
(No Ratings Yet)Loading...1 | Get-WmiObject Win32_PhysicalMemory | ForEach-Object {$_.capacity / 1GB} |
(10 votes, average: 4.70 out of 5)Loading...Procesos Información sobre procesos Tabla de procesos Estados de un proceso Crear procesos Parar procesos El procesador Hilos Comunicación entre […]
(6 votes, average: 4.33 out of 5)Loading...Discos Discos físicos Información sobre discos físicos Crear una partición Dar formato Discos virtuales Crear discos virtual Montar un disco […]
(3 votes, average: 4.00 out of 5)Loading...Procesador Memoria caché Memoria Acceso directo a memoria Discos duros Buses Conexiones E/S Dispositivos de entrada y salida Entrada Salida […]
(No Ratings Yet)Loading...1 | Resolve-Path -Path C:\users\*\Desktop -ErrorAction SilentlyContinue | ForEach-Object {$_.Path.Split('\')[-2]} |
(No Ratings Yet)Loading...1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | Function Combinaciones { Param( [Object[]]$Object, [String]$Seperator, [UInt32]$CurIndex = 0, [String]$Return = "" ) $MaxIndex = $Object.Count - 1 $Object[$CurIndex] | ForEach-Object { [Array]$NewReturn = "$($Return)$($Seperator)$($_)".Trim($Seperator) If ($CurIndex -lt $MaxIndex) { $NewReturn = Combinaciones $Object -CurIndex ($CurIndex + 1) -Return $NewReturn } $NewReturn } } $palabra='abcd' $arrayletras=@(0..($palabra.Length-1) | % {$palabra[$_]}) #-join "" $arrayletras #Combinar cuatro letras distintas en palabras de cuatro letras #(Combinaciones @($arrayletras,$arrayletras,$arrayletras,$arrayletras)).count Combinaciones @($arrayletras,$arrayletras,$arrayletras,$arrayletras) |
(No Ratings Yet)Loading...1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 | Function Combinaciones { Param( [Object[]]$Object, [String]$Seperator, [UInt32]$CurIndex = 0, [String]$Return = "" ) $MaxIndex = $Object.Count - 1 $Object[$CurIndex] | ForEach-Object { [Array]$NewReturn = "$($Return)$($Seperator)$($_)".Trim($Seperator) If ($CurIndex -lt $MaxIndex) { $NewReturn = Combinaciones $Object -CurIndex ($CurIndex + 1) -Return $NewReturn } $NewReturn } } #Realizar un criptoanálisis básico para descifrar un texto cifrado por transposición #Descifrar la cadena yube $descifrar="yube" #Añadir un diccionario a una ArrayList para ver si al resolver la transposición se encuentra la palabra en el diccionario #Inicializa una nueva instancia de la clase ArrayList que está vacía y tiene la capacidad inicial predeterminada [System.Collections.ArrayList] $arraylist = New-Object System.Collections.ArrayList ForEach ($elemento in gc .\diccionario.txt){ #Agrega un objeto al final de ArrayList [void]$arraylist.Add($elemento) } $arrayletras=@(0..($descifrar.Length-1) | % {$descifrar[$_]}) $arrayletras #Combinar cuatro letras distintas en palabras de cuatro letras #Para cada una de las palabras que se han obtenido comprobar si se encuentra en el diccionario Combinaciones @($arrayletras,$arrayletras,$arrayletras,$arrayletras) | %{ if($arraylist.IndexOf($_) -eq -1){"Elemento: $_ no encontrado"} else{"Elemento $_ encontrado en la posición " + $arraylist.IndexOf($_)} } |
(5 votes, average: 5.00 out of 5)Loading...Presence This section focuses on information gathering about the victim host and the network that it’s attached to. System
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 | #Shows all current environmental variables $env:ALLUSERSPROFILE $env:APPDATA $env:CommonProgramFiles ${env:CommonProgramFiles(x86)} $env:CommonProgramW6432 $env:COMPUTERNAME $env:ComSpec $env:FP_NO_HOST_CHECK $env:HOMEDRIVE $env:HOMEPATH $env:LOCALAPPDATA $env:LOGONSERVER $env:NUMBER_OF_PROCESSORS $env:OS $env:Path $env:PATHEXT $env:PROCESSOR_ARCHITECTURE $env:PROCESSOR_IDENTIFIER $env:PROCESSOR_LEVEL $env:PROCESSOR_REVISION $env:ProgramData $env:ProgramFiles ${env:ProgramFiles(x86)} $env:ProgramW6432 $env:PSModulePath $env:PUBLIC $env:SESSIONNAME $env:SystemRoot $env:TEMP $env:TMP $env:USERDOMAIN $env:USERDOMAIN_ROAMINGPROFILE $env:USERNAME $env:USERPROFILE $env:SystemDrive $env:windir #Shows all current environmental variables (macOS) $env:_ $env:LOGNAME $env:SHLVL $env:TERM_SESSION_ID $env:PATHEXT $env:__CF_USER_TEXT_ENCODING $env:PATH $env:SSH_AUTH_SOCK $env:TMPDIR $env:Apple_PubSub_Socket_Render $env:PSMODULEPATH $env:TERM $env:USER $env:HOME $env:PWD $env:TERM_PROGRAM $env:XPC_FLAGS $env:LC_CTYPE $env:SHELL $env:TERM_PROGRAM_VERSION $env:XPC_SERVICE_NAME #Information about disk Get-Disk #Retrieving Process Information Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime #Lists running threads for a specified process (Get-Process chrome | Select-Object Threads).Threads Get-Process | select -expand Threads #Last Boot Uptime Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime #Lists the current drivers on the system Get-Process -Module #Events and event logs on the local and remote Get-EventLog -LogName System -EntryType Error, Warning Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer |
[…]
(No Ratings Yet)Loading...1 2 3 4 5 6 7 8 9 10 11 12 13 | #Los permisos explícitos son aquellos que se establecen de forma predeterminada en objetos que no son secundarios cuando se crea el objeto, o los que crea el usuario en objetos secundarios, primarios o que no son secundarios. $Path = ‘F:\power\permisos’ $acl = Get-Acl -Path $path $acl.Access | Select-Object IdentityReference,IsInherited #Eliminar permisos explícitos #RemoveAccessRule quita todos permisos de la lista de control de acceso (ACL) Allow o Deny coincidentes del archivo o directorio actual. $acl.Access | Where-Object{!($_.isInherited)} | ForEach-Object {$acl.RemoveAccessRule($_)} $acl.Access | Select-Object IdentityReference,IsInherited #Asignar nuevos permisos $acl | Set-Acl -Path $path |
(2 votes, average: 5.00 out of 5)Loading...Introducción Confidencialidad
1 2 3 4 5 | #Habilitar BitLocker Enable-BitLocker -MountPoint "f:" -RecoveryPasswordProtector -UsedSpaceOnly -Verbose #Deshabilitar BitLocker Disable-BitLocker -MountPoint "f:" |
Integridad
1 2 3 4 5 6 7 | #Calcular hash para un archivo Get-FileHash D:\power\fichero.txt -Algorithm MD5 Get-FileHash D:\power\fichero.txt -Algorithm SHA1 Get-FileHash D:\power\fichero.txt -Algorithm SHA256 Get-FileHash D:\power\fichero.txt -Algorithm SHA384 Get-FileHash D:\power\fichero.txt -Algorithm SHA512 Get-FileHash D:\power\fichero.txt -Algorithm RIPEMD160 |
Seguridad física Analizar el hardware de los equipos de la empresa
1 2 3 4 5 6 7 8 9 10 11 | $credenciales=Get-Credential 1..254 | %{ (Get-WmiObject Win32_AutochkSetting -ComputerName ('192.168.1.'+$_) -Credential $credenciales).SettingID (Get-WmiObject Win32_BaseBoard -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Manufacturer (Get-WmiObject Win32_BIOS -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Version (Get-WmiObject Win32_Bus -ComputerName ('192.168.1.'+$_) -Credential $credenciales).DeviceID Get-WmiObject Win32_Processor -ComputerName ('192.168.1.'+$_) -Credential $credenciales Get-WmiObject Win32_SystemEnclosure -ComputerName ('192.168.1.'+$_) -Credential $credenciales Get-WmiObject Win32_Battery -ComputerName ('192.168.1.'+$_) -Credential $credenciales Get-WmiObject Win32_Printer -ComputerName ('192.168.1.'+$_) -Credential $credenciales } |
Ver dispositivos conectados […]
(No Ratings Yet)Loading...1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 | Alias % -> ForEach-Object Alias ? -> Where-Object Alias ac -> Add-Content Alias asnp -> Add-PSSnapIn Alias cat -> Get-Content Alias cd -> Set-Location Alias chdir -> Set-Location Alias clc -> Clear-Content Alias clear -> Clear-Host Alias clhy -> Clear-History Alias cli -> Clear-Item Alias clp -> Clear-ItemProperty Alias cls -> Clear-Host Alias clv -> Clear-Variable Alias cnsn -> Connect-PSSession Alias compare -> Compare-Object Alias copy -> Copy-Item Alias cp -> Copy-Item Alias cpi -> Copy-Item Alias cpp -> Copy-ItemProperty Alias curl -> Invoke-WebRequest Alias cvpa -> Convert-Path Alias dbp -> Disable-PSBreakpoint Alias del -> Remove-Item Alias diff -> Compare-Object Alias dir -> Get-ChildItem Alias dnsn -> Disconnect-PSSession Alias ebp -> Enable-PSBreakpoint Alias echo -> Write-Output Alias epal -> Export-Alias Alias epcsv -> Export-Csv Alias epsn -> Export-PSSession Alias erase -> Remove-Item Alias etsn -> Enter-PSSession Alias exsn -> Exit-PSSession Alias fc -> Format-Custom Alias fl -> Format-List Alias foreach -> ForEach-Object Alias ft -> Format-Table Alias fw -> Format-Wide Alias gal -> Get-Alias Alias gbp -> Get-PSBreakpoint Alias gc -> Get-Content Alias gci -> Get-ChildItem Alias gcm -> Get-Command Alias gcs -> Get-PSCallStack Alias gdr -> Get-PSDrive Alias ghy -> Get-History Alias gi -> Get-Item Alias gjb -> Get-Job Alias gl -> Get-Location Alias gm -> Get-Member Alias gmo -> Get-Module Alias gp -> Get-ItemProperty Alias gps -> Get-Process Alias gpv -> Get-ItemPropertyValue Alias group -> Group-Object Alias gsn -> Get-PSSession Alias gsnp -> Get-PSSnapIn Alias gsv -> Get-Service Alias gu -> Get-Unique Alias gv -> Get-Variable Alias gwmi -> Get-WmiObject Alias h -> Get-History Alias history -> Get-History Alias icm -> Invoke-Command Alias iex -> Invoke-Expression Alias ihy -> Invoke-History Alias ii -> Invoke-Item Alias ipal -> Import-Alias Alias ipcsv -> Import-Csv Alias ipmo -> Import-Module Alias ipsn -> Import-PSSession Alias irm -> Invoke-RestMethod Alias ise -> powershell_ise.exe Alias iwmi -> Invoke-WMIMethod Alias iwr -> Invoke-WebRequest Alias kill -> Stop-Process Alias lp -> Out-Printer Alias ls -> Get-ChildItem Alias man -> help Alias md -> mkdir Alias measure -> Measure-Object Alias mi -> Move-Item Alias mount -> New-PSDrive Alias move -> Move-Item Alias mp -> Move-ItemProperty Alias mv -> Move-Item Alias nal -> New-Alias Alias ndr -> New-PSDrive Alias ni -> New-Item Alias nmo -> New-Module Alias npssc -> New-PSSessionConfigurationFile Alias nsn -> New-PSSession Alias nv -> New-Variable Alias ogv -> Out-GridView Alias oh -> Out-Host Alias popd -> Pop-Location Alias ps -> Get-Process Alias pushd -> Push-Location Alias pwd -> Get-Location Alias r -> Invoke-History Alias rbp -> Remove-PSBreakpoint Alias rcjb -> Receive-Job Alias rcsn -> Receive-PSSession Alias rd -> Remove-Item Alias rdr -> Remove-PSDrive Alias ren -> Rename-Item Alias ri -> Remove-Item Alias rjb -> Remove-Job Alias rm -> Remove-Item Alias rmdir -> Remove-Item Alias rmo -> Remove-Module Alias rni -> Rename-Item Alias rnp -> Rename-ItemProperty Alias rp -> Remove-ItemProperty Alias rsn -> Remove-PSSession Alias rsnp -> Remove-PSSnapin Alias rujb -> Resume-Job Alias rv -> Remove-Variable Alias rvpa -> Resolve-Path Alias rwmi -> Remove-WMIObject Alias sajb -> Start-Job Alias sal -> Set-Alias Alias saps -> Start-Process Alias sasv -> Start-Service Alias sbp -> Set-PSBreakpoint Alias sc -> Set-Content Alias select -> Select-Object Alias set -> Set-Variable Alias shcm -> Show-Command Alias si -> Set-Item Alias sl -> Set-Location Alias sleep -> Start-Sleep Alias sls -> Select-String Alias sort -> Sort-Object Alias sp -> Set-ItemProperty Alias spjb -> Stop-Job Alias spps -> Stop-Process Alias spsv -> Stop-Service Alias start -> Start-Process Alias sujb -> Suspend-Job Alias sv -> Set-Variable Alias swmi -> Set-WMIInstance Alias tee -> Tee-Object Alias trcm -> Trace-Command Alias type -> Get-Content Alias wget -> Invoke-WebRequest Alias where -> Where-Object Alias wjb -> Wait-Job Alias write -> Write-Output |
(1 votes, average: 5.00 out of 5)Loading...Gestión del hardware Gestión de archivos Agregar/Eliminar software Actualizar Gestión de procesos Programación de tareas Gestión de usuarios Gestión del […]
(2 votes, average: 5.00 out of 5)Loading...Forma 1
1 | Get-Process -Name notepad | Stop-Process |
Forma 2
1 | Get-WmiObject -Class Win32_Process -Filter “name=’notepad.exe'” | Invoke-WmiMethod -Name Terminate |
Forma 3
1 | Get-Process -Name notepad | ForEach-Object -Process {$_.Kill()} |