Optimal | Scripting and security

4. Gestión del sistema de archivos en PowerShell (nivel intermedio)

(6 votes, average: 4.33 out of 5)

La memoria que maneja el sistema operativo tiene limitaciones importantes, dos de ellas son la escasa cantidad de información que […]

Windows Post Exploitation Cmdlets Execution (PowerShell)

(5 votes, average: 5.00 out of 5)

Presence This section focuses on information gathering about the victim host and the network that it’s attached to. System

#Shows all current environmental variables
$env:ALLUSERSPROFILE
$env:APPDATA
$env:CommonProgramFiles
${env:CommonProgramFiles(x86)}
$env:CommonProgramW6432
$env:COMPUTERNAME
$env:ComSpec
$env:FP_NO_HOST_CHECK
$env:HOMEDRIVE
$env:HOMEPATH
$env:LOCALAPPDATA
$env:LOGONSERVER
$env:NUMBER_OF_PROCESSORS
$env:OS
$env:Path
$env:PATHEXT
$env:PROCESSOR_ARCHITECTURE
$env:PROCESSOR_IDENTIFIER
$env:PROCESSOR_LEVEL
$env:PROCESSOR_REVISION
$env:ProgramData
$env:ProgramFiles
${env:ProgramFiles(x86)}
$env:ProgramW6432
$env:PSModulePath
$env:PUBLIC
$env:SESSIONNAME
$env:SystemRoot
$env:TEMP
$env:TMP
$env:USERDOMAIN
$env:USERDOMAIN_ROAMINGPROFILE
$env:USERNAME
$env:USERPROFILE
$env:SystemDrive
$env:windir

#Shows all current environmental variables (macOS)
$env:_ 
$env:LOGNAME
$env:SHLVL
$env:TERM_SESSION_ID
$env:PATHEXT
$env:__CF_USER_TEXT_ENCODING
$env:PATH
$env:SSH_AUTH_SOCK
$env:TMPDIR
$env:Apple_PubSub_Socket_Render
$env:PSMODULEPATH
$env:TERM
$env:USER
$env:HOME
$env:PWD
$env:TERM_PROGRAM
$env:XPC_FLAGS
$env:LC_CTYPE
$env:SHELL
$env:TERM_PROGRAM_VERSION
$env:XPC_SERVICE_NAME

#Information about disk
Get-Disk

#Retrieving Process Information
Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Lists running threads for a specified process
(Get-Process chrome | Select-Object Threads).Threads
Get-Process | select -expand Threads

#Last Boot Uptime
Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

#Lists the current drivers on the system
Get-Process -Module

#Events and event logs on the local and remote
Get-EventLog -LogName System -EntryType Error, Warning
Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer

#Shows all current environmental variables

$env:ALLUSERSPROFILE

$env:APPDATA

$env:CommonProgramFiles

${env:CommonProgramFiles(x86)}

$env:CommonProgramW6432

$env:COMPUTERNAME

$env:ComSpec

$env:FP_NO_HOST_CHECK

$env:HOMEDRIVE

$env:HOMEPATH

$env:LOCALAPPDATA

$env:LOGONSERVER

$env:NUMBER_OF_PROCESSORS

$env:OS

$env:Path

$env:PATHEXT

$env:PROCESSOR_ARCHITECTURE

$env:PROCESSOR_IDENTIFIER

$env:PROCESSOR_LEVEL

$env:PROCESSOR_REVISION

$env:ProgramData

$env:ProgramFiles

${env:ProgramFiles(x86)}

$env:ProgramW6432

$env:PSModulePath

$env:PUBLIC

$env:SESSIONNAME

$env:SystemRoot

$env:TEMP

$env:TMP

$env:USERDOMAIN

$env:USERDOMAIN_ROAMINGPROFILE

$env:USERNAME

$env:USERPROFILE

$env:SystemDrive

$env:windir

#Shows all current environmental variables (macOS)

$env:_

$env:LOGNAME

$env:SHLVL

$env:TERM_SESSION_ID

$env:PATHEXT

$env:__CF_USER_TEXT_ENCODING

$env:PATH

$env:SSH_AUTH_SOCK

$env:TMPDIR

$env:Apple_PubSub_Socket_Render

$env:PSMODULEPATH

$env:TERM

$env:USER

$env:HOME

$env:PWD

$env:TERM_PROGRAM

$env:XPC_FLAGS

$env:LC_CTYPE

$env:SHELL

$env:TERM_PROGRAM_VERSION

$env:XPC_SERVICE_NAME

#Information about disk

Get-Disk

#Retrieving Process Information

Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Lists running threads for a specified process

(Get-Process chrome | Select-Object Threads).Threads

Get-Process | select -expand Threads

#Last Boot Uptime

Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

#Lists the current drivers on the system

Get-Process -Module

#Events and event logs on the local and remote

Get-EventLog -LogName System -EntryType Error, Warning

Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer

[…]

Leer los ficheros que hay dentro de un directorio, cifrarlos, almacenarlos en un directorio, comprimir el directorio y enviarlo por mail utilizando un servidor con SMTP

(No Ratings Yet)

#Para descrifrar ver: https://www.jesusninoc.com/2015/02/12/algoritmo-de-descifrado-sencillo/ (Algoritmo de descifrado sencillo)

foreach ($fichero in ls F:\power\ficheros)
{
$e=''
foreach ($line in gc F:\power\ficheros\$fichero) {
$n=''
$n+= foreach ($word in ($line.Split()))
{
$chars = for ($i=0;$i -lt $word.length;$i++)
{
$x=$word[$i]
$x=[char]::ConvertToUtf32(“$x”,0)
[int]$y=$x+8
[char]::ConvertFromUtf32($y)
}
$chars -join ''
}
$e+=$n
}
$e | out-file F:\power\ficherosconvertidos\$fichero
$ficherodestino='C:\powershell\comprimidoconvertido.zip'
Compress-Archive -LiteralPathF:\power\ficherosconvertidos\$fichero –CompressionLevel Optimal -DestinationPath $ficherodestino

Send-MailMessage -To 'user2@gmail.com' -From 'user1@example.com' -Subject 'Fichero comprimido' -Attachments $ficherodestino <strong>-SmtpServer</strong> localhost
}

#Para descrifrar ver: https://www.jesusninoc.com/2015/02/12/algoritmo-de-descifrado-sencillo/ (Algoritmo de descifrado sencillo)

foreach ($fichero in ls F:\power\ficheros)

{

$e=''

foreach ($line in gc F:\power\ficheros\$fichero) {

$n=''

$n+= foreach ($word in ($line.Split()))

{

$chars = for ($i=0;$i -lt $word.length;$i++)

{

$x=$word[$i]

$x=[char]::ConvertToUtf32(“$x”,0)

[int]$y=$x+8

[char]::ConvertFromUtf32($y)

}

$chars -join ''

}

$e+=$n

}

$e | out-file F:\power\ficherosconvertidos\$fichero

$ficherodestino='C:\powershell\comprimidoconvertido.zip'

Compress-Archive -LiteralPathF:\power\ficherosconvertidos\$fichero –CompressionLevel Optimal -DestinationPath $ficherodestino

Send-MailMessage -To 'user2@gmail.com' -From 'user1@example.com' -Subject 'Fichero comprimido' -Attachments $ficherodestino <strong>-SmtpServer</strong> localhost

}

Leer los ficheros que hay dentro de un directorio, cifrarlos, almacenarlos en un directorio, comprimir el directorio y enviarlo por mail utilizando Outlook

(No Ratings Yet)

#Para descrifrar ver: https://www.jesusninoc.com/2015/02/12/algoritmo-de-descifrado-sencillo/ (Algoritmo de descifrado sencillo)

foreach ($fichero in ls F:\power\ficheros)
{
$e=''
foreach ($line in gc F:\power\ficheros\$fichero) {
$n=''
$n+= foreach ($word in ($line.Split()))
{
$chars = for ($i=0;$i -lt $word.length;$i++)
{
$x=$word[$i]
$x=[char]::ConvertToUtf32(“$x”,0)
[int]$y=$x+8
[char]::ConvertFromUtf32($y)
}
$chars -join ''
}
$e+=$n
}
$e | out-file F:\power\ficherosconvertidos\$fichero
$ficherodestino='C:\powershell\comprimidoconvertido.zip'
Compress-Archive -LiteralPathF:\power\ficherosconvertidos\$fichero –CompressionLevel Optimal -DestinationPath $ficherodestino

Start-Process Outlook
$o = New-Object -com Outlook.Application
$mail = $o.CreateItem(0)
$mail.subject = 'Fichero comprimido'
$mail.To = 'user1@gmail.com'
$mail.Attachments.Add($ficherodestino)
$mail.Send()
$o.Quit()
}

#Para descrifrar ver: https://www.jesusninoc.com/2015/02/12/algoritmo-de-descifrado-sencillo/ (Algoritmo de descifrado sencillo)

foreach ($fichero in ls F:\power\ficheros)

{

$e=''

foreach ($line in gc F:\power\ficheros\$fichero) {

$n=''

$n+= foreach ($word in ($line.Split()))

{

$chars = for ($i=0;$i -lt $word.length;$i++)

{

$x=$word[$i]

$x=[char]::ConvertToUtf32(“$x”,0)

[int]$y=$x+8

[char]::ConvertFromUtf32($y)

}

$chars -join ''

}

$e+=$n

}

$e | out-file F:\power\ficherosconvertidos\$fichero

$ficherodestino='C:\powershell\comprimidoconvertido.zip'

Compress-Archive -LiteralPathF:\power\ficherosconvertidos\$fichero –CompressionLevel Optimal -DestinationPath $ficherodestino

Start-Process Outlook

$o = New-Object -com Outlook.Application

$mail = $o.CreateItem(0)

$mail.subject = 'Fichero comprimido'

$mail.To = 'user1@gmail.com'

$mail.Attachments.Add($ficherodestino)

$mail.Send()

$o.Quit()

}

Cmdlets relacionados con tareas básicas y de administración en el sistema operativo Windows

(1 votes, average: 5.00 out of 5)

Gestión del hardware Gestión de archivos Agregar/Eliminar software Actualizar Gestión de procesos Programación de tareas Gestión de usuarios Gestión del […]

Leer los ficheros que hay dentro de un directorio, cifrarlos, almacenarlos en un directorio y comprimir el directorio

(No Ratings Yet)

#Para descrifrar ver: https://www.jesusninoc.com/2015/02/12/algoritmo-de-descifrado-sencillo/ (Algoritmo de descifrado sencillo)

foreach ($fichero in ls F:\power\ficheros)
{
$e=''
foreach ($line in gc F:\power\ficheros\$fichero) {
$n=''
$n+= foreach ($word in ($line.Split()))
{
$chars = for ($i=0;$i -lt $word.length;$i++)
{
$x=$word[$i]
$x=[char]::ConvertToUtf32(“$x”,0)
[int]$y=$x+8
[char]::ConvertFromUtf32($y)
}
$chars -join ''
}
$e+=$n
}
$e | out-file F:\power\ficherosconvertidos\$fichero
Compress-Archive -LiteralPathF:\power\ficherosconvertidos\$fichero –CompressionLevel Optimal -DestinationPath C:\powershell\comprimidoconvertido.zip
}

#Para descrifrar ver: https://www.jesusninoc.com/2015/02/12/algoritmo-de-descifrado-sencillo/ (Algoritmo de descifrado sencillo)

foreach ($fichero in ls F:\power\ficheros)

{

$e=''

foreach ($line in gc F:\power\ficheros\$fichero) {

$n=''

$n+= foreach ($word in ($line.Split()))

{

$chars = for ($i=0;$i -lt $word.length;$i++)

{

$x=$word[$i]

$x=[char]::ConvertToUtf32(“$x”,0)

[int]$y=$x+8

[char]::ConvertFromUtf32($y)

}

$chars -join ''

}

$e+=$n

}

$e | out-file F:\power\ficherosconvertidos\$fichero

Compress-Archive -LiteralPathF:\power\ficherosconvertidos\$fichero –CompressionLevel Optimal -DestinationPath C:\powershell\comprimidoconvertido.zip

}

Create a new compress archive file

(No Ratings Yet)

Compress-Archive -LiteralPath C:\powershell\example.txt –CompressionLevel Optimal -DestinationPath C:\powershell\comprimido.zip

1	Compress-Archive -LiteralPath C:\powershell\example.txt –CompressionLevel Optimal -DestinationPath C:\powershell\comprimido.zip

Comprimir archivo

(1 votes, average: 5.00 out of 5)

Compress-Archive -LiteralPath C:\powershell\example.txt –CompressionLevel Optimal -DestinationPath C:\powershell\comprimido.zip

1	Compress-Archive -LiteralPath C:\powershell\example.txt –CompressionLevel Optimal -DestinationPath C:\powershell\comprimido.zip