Listar puertos abiertos en Windows 10 con PowerShell

Get-NetUDPEndpoint | Select-Object LocalPort
Get-NetTCPConnection | Select-Object LocalPort

1 2	Get-NetUDPEndpoint \| Select-Object LocalPort Get-NetTCPConnection \| Select-Object LocalPort

How to use PowerShell for WannaCry

#How to use PowerShell to check if a hotfix is installed
Get-HotFix | Select-Object hotfixid | Select-String "KB4013429"

#PowerShell Port Checking
Test-NetConnection -ComputerName 127.0.0.1 -Port 445

#Testing if a domain resolves with PowerShell
Resolve-DnsName www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

#How to disable SMBv1 with PowerShell
#On Windows 8 and Windows Server 2012
Set-SmbServerConfiguration -EnableSMB1Protocol $false

#How to use PowerShell to check if a hotfix is installed

Get-HotFix | Select-Object hotfixid | Select-String "KB4013429"

#PowerShell Port Checking

Test-NetConnection -ComputerName 127.0.0.1 -Port 445

#Testing if a domain resolves with PowerShell

Resolve-DnsName www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

#How to disable SMBv1 with PowerShell

#On Windows 8 and Windows Server 2012

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Analizar información de red (protocolo TCP)

#Relación entre IP, puertos y procesos
Get-NetTCPConnection | %{Write-Host $_.LocalAddress,$_.LocalPort,$_.RemoteAddress,$_.RemotePort,$_.OwningProcess,(Get-Process -id $_.OwningProcess).Name}

#Agrupar IP
((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name

#Agrupar IP y quitar las que no son necesarias
(((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name) | Where-Object {$_ -notcontains "::" -and $_ -notcontains "0.0.0.0"}

#Relación entre IP, puertos y procesos

Get-NetTCPConnection | %{Write-Host $_.LocalAddress,$_.LocalPort,$_.RemoteAddress,$_.RemotePort,$_.OwningProcess,(Get-Process -id $_.OwningProcess).Name}

#Agrupar IP

((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name

#Agrupar IP y quitar las que no son necesarias

(((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name) | Where-Object {$_ -notcontains "::" -and $_ -notcontains "0.0.0.0"}

Füllstand der Laufwerke

Get-Wmiobject Win32_logicaldisk | Select-Object deviceid,size,freespace

1	Get-Wmiobject Win32_logicaldisk \| Select-Object deviceid,size,freespace

Localizar geográficamente una IP

$ip = "8.8.8.8"
Invoke-RestMethod -Uri "http://geoip.nekudo.com/api/$ip" | Select-Object -ExpandProperty Country

1 2	$ip = "8.8.8.8" Invoke-RestMethod -Uri "http://geoip.nekudo.com/api/$ip" \| Select-Object -ExpandProperty Country

Mostrar información avanzada de los procesos que se están ejecutando en relación con los servicios y los puertos abiertos UDP (Get-NetUDPEndpoint)

#Mostrar información avanzada de los procesos (Path, ExecutablePath, CommandLine) que se están ejecutando en relación con los servicios y los puertos abiertos UDP
(Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{
#Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId | Select-Object name, Path, ExecutablePath, CommandLine)
Write-Host $_.Name,$_.ProcessId,$_.State,(Get-WmiObject -Class win32_process | Where-Object ProcessId -EQ  $_.ProcessId | select name, Path, ExecutablePath, CommandLine)
Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId).Name,(Get-NetUDPEndpoint | where OwningProcess -EQ $_.ProcessId | select LocalPort,RemoteAddress,RemotePort,OwningProcess)
Write-Host "##################################################"
}

#Mostrar información avanzada de los procesos (Path, ExecutablePath, CommandLine) que se están ejecutando en relación con los servicios y los puertos abiertos UDP

(Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{

#Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId | Select-Object name, Path, ExecutablePath, CommandLine)

Write-Host $_.Name,$_.ProcessId,$_.State,(Get-WmiObject -Class win32_process | Where-Object ProcessId -EQ $_.ProcessId | select name, Path, ExecutablePath, CommandLine)

Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId).Name,(Get-NetUDPEndpoint | where OwningProcess -EQ $_.ProcessId | select LocalPort,RemoteAddress,RemotePort,OwningProcess)

Write-Host "##################################################"

}

Mostrar información avanzada de los procesos que se están ejecutando en relación con los servicios y los puertos abiertos TCP (Get-NetTCPConnection)

#Mostrar información avanzada de los procesos (Path, ExecutablePath, CommandLine) que se están ejecutando en relación con los servicios y los puertos abiertos TCP
(Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{
#Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId | Select-Object name, Path, ExecutablePath, CommandLine)
Write-Host $_.Name,$_.ProcessId,$_.State,(Get-WmiObject -Class win32_process | Where-Object ProcessId -EQ  $_.ProcessId | select name, Path, ExecutablePath, CommandLine)
Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId).Name,(Get-NetTCPConnection | where OwningProcess -EQ $_.ProcessId | select LocalPort,RemoteAddress,RemotePort,OwningProcess)
Write-Host "##################################################"
}

#Mostrar información avanzada de los procesos (Path, ExecutablePath, CommandLine) que se están ejecutando en relación con los servicios y los puertos abiertos TCP

(Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{

#Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId | Select-Object name, Path, ExecutablePath, CommandLine)

Write-Host $_.Name,$_.ProcessId,$_.State,(Get-WmiObject -Class win32_process | Where-Object ProcessId -EQ $_.ProcessId | select name, Path, ExecutablePath, CommandLine)

Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId).Name,(Get-NetTCPConnection | where OwningProcess -EQ $_.ProcessId | select LocalPort,RemoteAddress,RemotePort,OwningProcess)

Write-Host "##################################################"

}

WQL-Datenabfrage: Ermitteln der Seriennummer des Betriebssystems

Get-Wmiobject Win32_OperatingSystem | Select-Object SerialNumber

1	Get-Wmiobject Win32_OperatingSystem \| Select-Object SerialNumber