ps | Scripting and security

Crear un trabajo (Start-Job) en PowerShell 7 y recibirlo (Receive-Job) cambiando el directorio de trabajo (WorkingDirectory)

(No Ratings Yet)

Start-Job -ScriptBlock { ps } -WorkingDirectory .\directorio2\

1	Start-Job -ScriptBlock { ps } -WorkingDirectory .\directorio2\

Crear un trabajo (Start-Job) en PowerShell y recibirlo (Receive-Job)

(No Ratings Yet)

Start-Job -ScriptBlock { ps }
Get-Job -id 1 | Receive-Job

1 2	Start-Job -ScriptBlock { ps } Get-Job -id 1 \| Receive-Job

Crear una conexión SSH, subir un fichero y ejecutar un script que utilice el fichero subido, realizar la conexión desde PowerShell

(3 votes, average: 4.67 out of 5)

$credenciales = Get-Credential

Set-SCPFile -LocalFile .\posts5.xml -ComputerName ftp.cluster.hosting.ovh.net -RemotePath ./www/wordpress -Credential $credenciales

$oSessionSSH = New-SSHSession -ComputerName ftp.cluster.hosting.ovh.net -Credential $credenciales

#Crear canal de comunicación entre PowerShell y Linux

$stream = $oSessionSSH.Session.CreateShellStream("PS-SSH", 0, 0, 0, 0, 1000)

$stream.WriteLine("cd ./www/wordpress")
$stream.Read()
$stream.WriteLine("pwd")
$stream.Read()
$stream.WriteLine("../../wp import posts5.xml --authors=map.csv")
$stream.Read()

$credenciales = Get-Credential

Set-SCPFile -LocalFile .\posts5.xml -ComputerName ftp.cluster.hosting.ovh.net -RemotePath ./www/wordpress -Credential $credenciales

$oSessionSSH = New-SSHSession -ComputerName ftp.cluster.hosting.ovh.net -Credential $credenciales

#Crear canal de comunicación entre PowerShell y Linux

$stream = $oSessionSSH.Session.CreateShellStream("PS-SSH", 0, 0, 0, 0, 1000)

$stream.WriteLine("cd ./www/wordpress")

$stream.Read()

$stream.WriteLine("pwd")

$stream.Read()

$stream.WriteLine("../../wp import posts5.xml --authors=map.csv")

$stream.Read()

Analizar las conexiones que tiene abiertas el proceso que más CPU consume en Windows con PowerShell mediante una función

(3 votes, average: 5.00 out of 5)

function monitorizar
{
  param()
  begin
  {
  }
  process
  {
    foreach($conex in @(netstat -ano))
    {
        foreach($proceso in ps | where id -EQ ((Get-Process -name chrome | sort cpu -Descending | select -First 1).id))
        {
            if($conex -match $proceso.Id -and $proceso.Id -ne 4 -and $proceso.Id -ne 0)
            {
                write-host $conex “-PROCESO->” $proceso.Name $proceso.Id
            }
        }
    }
  }
  end
  {
  }
}

monitorizar

function monitorizar

{

param()

begin

{

}

process

{

foreach($conex in @(netstat -ano))

{

foreach($proceso in ps | where id -EQ ((Get-Process -name chrome | sort cpu -Descending | select -First 1).id))

{

if($conex -match $proceso.Id -and $proceso.Id -ne 4 -and $proceso.Id -ne 0)

{

write-host $conex “-PROCESO->” $proceso.Name $proceso.Id

}

end

{

}

monitorizar

Crear, compilar y ejecutar una DLL con Microsoft Visual C# que crear un usuario desde PowerShell

(1 votes, average: 5.00 out of 5)

Crear un proyecto en Visual C# Biblioteca de Clase (.NET Framework) Importar desde Microsoft Visual C# la referencia al ensamblado System.Management.Automation (C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll) Añadir el siguiente código en PowerShell a Visual Studio C# y compilar la solución

using System;
using System.Management.Automation;  // Windows PowerShell namespace.
 
namespace PowerSh
{
    public class PowerSh
    {
        public static void CrearUsuario()
        {

            //Create a PowerShell object.
            PowerShell ps = PowerShell.Create();

            //New-LocalUser usuario -Password (ConvertTo-SecureString "11234aaadsf" -asplaintext -force)
            ps.AddScript("New-LocalUser usuario -Password (ConvertTo-SecureString '11234aaadsf' -asplaintext -force)");

            IAsyncResult result = ps.BeginInvoke();

            // do something else until execution has completed.
            // this could be sleep/wait, or perhaps some other work
            while (result.IsCompleted == false)
            {
            }

        } // End Main.
    } // End HostPs1.
}

using System;

using System.Management.Automation; // Windows PowerShell namespace.

namespace PowerSh

{

public class PowerSh

{

public static void CrearUsuario()

{

//Create a PowerShell object.

PowerShell ps = PowerShell.Create();

//New-LocalUser usuario -Password (ConvertTo-SecureString "11234aaadsf" -asplaintext -force)

ps.AddScript("New-LocalUser usuario -Password (ConvertTo-SecureString '11234aaadsf' -asplaintext -force)");

IAsyncResult result = ps.BeginInvoke();

// do something else until execution has completed.

// this could be sleep/wait, or perhaps some other work

while (result.IsCompleted == false)

{

}

} // End Main.

} // End HostPs1.

}

La dll compilada se encuentra en la carpeta bin Llamar a la dll creada desde PowerShell

[Reflection.Assembly]::LoadFile("C:\Users\juan\source\repos\ClassLibrary1\ClassLibrary1\bin\Debug\ClassLibrary1.dll")
[PowerSh.PowerSh]::CrearUsuario()

1 2	[Reflection.Assembly]::LoadFile("C:\Users\juan\source\repos\ClassLibrary1\ClassLibrary1\bin\Debug\ClassLibrary1.dll") [PowerSh.PowerSh]::CrearUsuario()

Crear, compilar y ejecutar una DLL con Microsoft Visual C# que abre Notepad desde PowerShell

(2 votes, average: 5.00 out of 5)

using System.Management.Automation;  // Windows PowerShell namespace.

namespace PowerSh
{
    public class PowerSh
    {
        public static void AbrirNotepad()
        {

            //Create a PowerShell object.
            PowerShell ps = PowerShell.Create();
            //Add the command that you want to execute.
            ps.AddCommand("Start-Process");
            //Add the argument
            ps.AddArgument("notepad");
            //Invoke the command.
            ps.Invoke();

        } // End Main.
    } // End HostPs1.
}

using System.Management.Automation; // Windows PowerShell namespace.

namespace PowerSh

{

public class PowerSh

{

public static void AbrirNotepad()

{

//Create a PowerShell object.

PowerShell ps = PowerShell.Create();

//Add the command that you want to execute.

ps.AddCommand("Start-Process");

//Add the argument

ps.AddArgument("notepad");

//Invoke the command.

ps.Invoke();

} // End Main.

} // End HostPs1.

}

La dll compilada se encuentra en la carpeta bin Llamar a la dll creada desde PowerShell

Crear, compilar y ejecutar una DLL con Microsoft Visual C# que ejecute un cmdlet de PowerShell

(7 votes, average: 5.00 out of 5)

Crear un proyecto en Visual C# Biblioteca de Clase (.NET Framework) Buscar e instalar en NuGet System.Management.Automation Importar desde Microsoft Visual C# la referencia al ensamblado System.Management.Automation (C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll) Añadir el siguiente código en PowerShell a Visual Studio C# y compilar la solución

using System;
using System.Management.Automation;  // Windows PowerShell namespace.

namespace PowerSh
{
    public class PowerSh
    {
        public static void Main()
        {

            //Create a PowerShell object.
            PowerShell ps = PowerShell.Create();
            //Add the command that you want to execute.
            ps.AddCommand("Get-Process");
            //Add the command that you want to execute.
            ps.AddCommand("out-file");
            //Add the argument
            ps.AddArgument("out.txt");
            //Invoke the command.
            ps.Invoke();

        } // End Main.
    } // End HostPs1.
}

using System;

using System.Management.Automation; // Windows PowerShell namespace.

namespace PowerSh

{

public class PowerSh

{

public static void Main()

{

//Create a PowerShell object.

PowerShell ps = PowerShell.Create();

//Add the command that you want to execute.

ps.AddCommand("Get-Process");

//Add the command that you want to execute.

ps.AddCommand("out-file");

//Add the argument

ps.AddArgument("out.txt");

//Invoke the command.

ps.Invoke();

} // End Main.

} // End HostPs1.

}

La dll compilada se encuentra en la carpeta bin Llamar a la dll creada desde PowerShell

Mostrar la descripción de los procesos que se están ejecutando desde PowerShell con Node-PowerShell (Node.JS) y mostrarlos en una web con Express

(7 votes, average: 4.43 out of 5)

Es necesario instalar: Node-powershell

npm i -S node-powershell

1	npm i -S node-powershell

Express

npm install --save express

1	npm install --save express

Código para listar procesos de PowerShell con Node-PowerShell (Node.JS) y mostrarlos en una web con Express:

const shell = require('node-powershell');
const express = require('express')
const app = express()

let ps = new shell({
  executionPolicy: 'Bypass',
  noProfile: true
});
 
ps.addCommand('Get-Process | select Name,Product,Description | ConvertTo-Html')
ps.invoke()
.then(output => {
  console.log(output);
  app.get('/', function (req, res) {
    res.send(output);
  })  
})
.catch(err => {
  console.log(err);
  ps.dispose();
});

app.listen(3000, function () {
  console.log('Example app listening on port 3000!')
})

const shell = require('node-powershell');

const express = require('express')

const app = express()

let ps = new shell({

executionPolicy: 'Bypass',

noProfile: true

});

ps.addCommand('Get-Process | select Name,Product,Description | ConvertTo-Html')

ps.invoke()

.then(output => {

console.log(output);

app.get('/', function (req, res) {

res.send(output);

})

.catch(err => {

console.log(err);

ps.dispose();

});

app.listen(3000, function () {

console.log('Example app listening on port 3000!')

})

Listar procesos de PowerShell con Node-PowerShell (Node.JS) y mostrarlos en una web con Express

(3 votes, average: 2.33 out of 5)

Es necesario instalar: Node-powershell

npm i -S node-powershell

1	npm i -S node-powershell

Express

npm install --save express

1	npm install --save express

Código para listar procesos de PowerShell con Node-PowerShell (Node.JS) y mostrarlos en una web con Express:

const shell = require('node-powershell');
const express = require('express')
const app = express()

let ps = new shell({
  executionPolicy: 'Bypass',
  noProfile: true
});
 
ps.addCommand('Get-Process | ConvertTo-Html -Property Name, Path, Company')
ps.invoke()
.then(output => {
  console.log(output);
  app.get('/', function (req, res) {
    res.send(output);
  })  
})
.catch(err => {
  console.log(err);
  ps.dispose();
});

app.listen(3000, function () {
  console.log('Example app listening on port 3000!')
})

const shell = require('node-powershell');

const express = require('express')

const app = express()

let ps = new shell({

executionPolicy: 'Bypass',

noProfile: true

});

ps.addCommand('Get-Process | ConvertTo-Html -Property Name, Path, Company')

ps.invoke()

.then(output => {

console.log(output);

app.get('/', function (req, res) {

res.send(output);

})

.catch(err => {

console.log(err);

ps.dispose();

});

app.listen(3000, function () {

console.log('Example app listening on port 3000!')

})

forkstat

(2 votes, average: 5.00 out of 5)

Forkstat is a program that logs process fork(), exec() and exit() activity. It is useful for monitoring system behaviour and to track down rogue processes that are spawning off processes and potentially abusing the system. Note that forkstat uses the Linux netlink connector to gather process activity and this may miss events if the system is overly busy. Netlink connector also requires root privilege. forkstat command line options: -d strip off the directory path from the process name -D specify run duration in seconds. -e select which events to monitor. -h show brief help summary -l set stdout to line-buffered […]

Older Posts