eCPPTv3-PTP-Notes
HomeGitHubPortfolioTwitter/XMediumCont@ct
  • 📝eCPPT / PTP - Notes
    • eCPPTv3
      • 1️⃣1 - Resource Development & Initial Access
        • 1.1 - PowerShell for Pentesters
        • 1.2 - Client-Side Attacks
          • 1.2.1 - System/Host Based Attacks
            • 1.2.1.1 Windows Vulnerabilities
          • 1.2.2 - The Metasploit Framework (MSF)
            • 1.2.2.1 MSF Introduction
            • 1.2.2.2 Information Gathering & Enumeration
            • 1.2.2.3 Vulnerability Scanning
            • 1.2.2.4 Client-Side Attacks
            • 1.2.2.5 Post Exploitation
            • 1.2.2.6 Armitage
          • 1.2.3 Exploitation
          • 1.2.4 Social Engineering
      • 2️⃣2 - Web Application Penetration Testing
        • 2.1 - Web App Concepts
          • 2.1.1 HTTP/S Protocol
          • 2.1.2 Encoding
          • 2.1.3 Same Origin
          • 2.1.4 Cookies
          • 2.1.5 Session
          • 2.1.6 Web App Proxies
        • 2.2 - Information Gathering
          • 2.2.1 Gathering Information on Your Targets
          • 2.2.2 Infrastructure
          • 2.2.3 Fingerprinting Frameworks and Applications
          • 2.2.4 Fingerprinting Custom Applications
          • 2.2.5 Enumerating Resources
          • 2.2.6 Information Disclosure Through Misconfiguration
          • 2.2.7 Google Hacking
          • 2.2.8 Shodan HQ
        • 2.3 - Cross Site Scripting
          • 2.3.1 XSS Anatomy
          • 2.3.2 Reflected XSS
          • 2.3.3 Stored XSS
          • 2.3.4 DOM-Based XSS
          • 2.3.5 Identifying & Exploiting XSS with XSSer
        • 2.4 - SQL Injection
          • 2.4.1 Introduction to SQL Injection
          • 2.4.2 Finding SQL Injection
          • 2.4.3 Exploiting In-Band SQL Injection
          • 2.4.4 Exploiting Error-Based SQL Injection
          • 2.4.5 Exploiting Blind SQL Injection
          • 2.4.6 SQLMap
          • 2.4.7 Mitigation Strategies
          • 2.4.8 From SQLi to Server Takeover
        • 2.5 - Other Common Web Attacks
          • 2.5.1 Session Attacks
          • 2.5.2 CSRF
          • 2.5.3 File and Resource Attacks
      • 3️⃣3 - Network Security
        • 3.1 Network Based Attacks
        • 3.2 Linux Vulnerabilities
        • 3.3 - Exploitation
          • 3.3.1 Linux Exploitation
      • 4️⃣4 - Exploit Development
        • 4.1 Architecture Foundamentals
        • 4.2 Assemblers and Tools
        • 4.3 Buffer Overflow
        • 4.4 Cryptography
        • 4.5 Malware
        • 4.6 Shellcoding
      • 5️⃣5 - Post-Exploitation
        • 5.1 Linux Post-Exploitation
        • 5.2 - Linux Privilege Escalation
          • 5.2.1 Kernel Exploitation
          • 5.2.2 SUID Exploitation
          • 5.2.3 CronJobs
        • 5.3 - Post Expolitation / Pivoting
          • 5.3.1 Pivoting Guidelines
          • 5.3.2 Pivoting Example (3 Targets)
      • 6️⃣6 - ​Red Teaming
        • 6.1 - Active Directory Penetration Testing
          • 6.1.1 Introduction to Active Directory (AD)
            • 6.1.1.1 Users, Groups & Computers
            • 6.1.1.2 Organizational Units (OUs)
            • 6.1.1.3 Trees, Forest & Trust
          • 6.1.2 AD Authentication
          • 6.1.3 AD Penetration Testing Methodology
        • 6.1.4 AD Enumeration
        • 6.1.5 AD Privilege Escalation
        • 6.1.6 AD Lateral Movement
        • 6.1.7 AD Persistence
        • 6.2 - Command & Control (C2/C&C)
    • eCPPTv2
      • 1️⃣1 - ​System Security
        • 1.1 Architecture Foundamentals
        • 1.2 Assemblers and Tools
        • 1.3 Buffer Overflow
        • 1.4 Cryptography
        • 1.5 Malware
        • 1.6 Shellcoding
      • 2️⃣2 - Network Security
        • 2.1 System/Host Based Attacks
          • 2.1.1 Windows Vulnerabilities
        • 2.2 Network Based Attacks
        • 2.3 The Metasploit Framework (MSF)
          • MSF Introduction
          • Information Gathering & Enumeration
          • Vulnerability Scanning
          • Client-Side Attacks
          • Post Exploitation
          • Armitage
        • 2.4 Exploitation
        • 2.5 - Post Expolitation / Pivoting
          • 2.5.1 Pivoting Guidelines
          • 2.5.2 Pivoting Example (3 Targets)
        • 2.6 Social Engineering
      • 3️⃣3 - PowerShell for PT
        • 3.1 PowerShell
      • 4️⃣4 - Linux Exploitation
        • 4.1 Linux Vulnerabilities
        • 4.2 Linux Exploitation
        • 4.3 Linux Post-Exploitation
        • 4.4 Linux Privilege Escalation
          • 4.4.1 Kernel Exploitation
          • 4.4.2 SUID Exploitation
          • 4.4.3 CronJobs
      • 5️⃣5 - Web App Security
        • 5.1 - Web App Concepts
          • 5.1.1 HTTP/S Protocol
          • 5.1.2 Encoding
          • 5.1.3 Same Origin
          • 5.1.4 Cookies
          • 5.1.5 Session
          • 5.1.6 Web App Proxies
        • 5.2 - Information Gathering
          • 5.2.1 Gathering Information on Your Targets
          • 5.2.2 Infrastructure
          • 5.2.3 Fingerprinting Frameworks and Applications
          • 5.2.4 Fingerprinting Custom Applications
          • 5.2.5 Enumerating Resources
          • 5.2.6 Information Disclosure Through Misconfiguration
          • 5.2.7 Google Hacking
          • 5.2.8 Shodan HQ
        • 5.3 - Cross Site Scripting
          • 5.3.1 XSS Anatomy
          • 5.3.2 Reflected XSS
          • 5.3.3 Stored XSS
          • 5.3.4 DOM-Based XSS
          • 5.3.5 Identifying & Exploiting XSS with XSSer
        • 5.4 - SQL Injection
          • 5.4.1 Introduction to SQL Injection
          • 5.4.2 Finding SQL Injection
          • 5.4.3 Exploiting In-Band SQL Injection
          • 5.4.4 Exploiting Error-Based SQL Injection
          • 5.4.5 Exploiting Blind SQL Injection
          • 5.4.6 SQLMap
          • 5.4.7 Mitigation Strategies
          • 5.4.8 From SQLi to Server Takeover
        • 5.5 - Other Common Web Attacks
          • 5.5.1 Session Attacks
          • 5.5.2 CSRF
      • 6️⃣6 - ​Wi-Fi Security
        • 6.1 Traffic Analysis
      • 7️⃣7 - ​Metasploit & Ruby
        • 7.1 Metasploit
      • 📄Report
        • How to write a PT Report
  • 🛣️RoadMap & My Experience
  • 📔eCPPT Cheat Sheet
Powered by GitBook
On this page
  • What is a PowerShell?
  • PowerShell and IDE
  • PowerShell Commands
  • Cmdlet
  1. eCPPT / PTP - Notes
  2. eCPPTv3

1 - Resource Development & Initial Access

PreviouseCPPTv3Next1.1 - PowerShell for Pentesters

Topics

What is a PowerShell?

PowerShell and IDE

Powershell.exe and IDE

PowerShell is typically available in two main executable forms: powershell.exe and powershell_ise.exe. Each serves a different purpose in the PowerShell ecosystem.

  1. powershell.exe:

    • This is the standard PowerShell command-line interface (CLI) executable. When you open a regular PowerShell console or run PowerShell commands from the command prompt, you are interacting with powershell.exe.

    • You can use powershell.exe to execute individual commands, run scripts, and perform various administrative tasks using PowerShell.

    Example usage in the command prompt:

    arduinoCopy codepowershell.exe -Command "Get-Process"
  2. powershell_ise.exe:

    • This is the executable for the PowerShell Integrated Scripting Environment (ISE). The ISE is an interactive development environment for PowerShell scripting. It provides a graphical user interface (GUI) for writing, testing, and debugging PowerShell scripts.

    • The ISE includes features such as a script editor, a command pane, and a script output pane, making it easier for users to work with PowerShell scripts and functions.

    Example usage in the command prompt:

    Copy codepowershell_ise.exe

    When you run the powershell_ise.exe command, it opens the PowerShell ISE window.

In summary, powershell.exe is the standard command-line interface for executing PowerShell commands, while powershell_ise.exe is used to open the PowerShell Integrated Scripting Environment for script development and testing in a more interactive and visual manner. Users often choose between these executables based on their specific needs and preferences for working with PowerShell.

PowerShell Commands

PowerShell Commands

In PowerShell, there are several types of commands, each serving a specific purpose and role in scripting and automation. Here's an overview of PowerShell cmdlets, functions, scripts, and native commands:

  1. Cmdlets (Commandlets):

    • Cmdlets are lightweight commands in PowerShell. They are .NET classes with methods that perform specific tasks. Cmdlets follow a Verb-Noun naming convention (e.g., Get-Process, New-Item).

    • Cmdlets are the primary building blocks for PowerShell commands, and they are designed to be easily discoverable and consistent.

  2. Functions:

    • Functions in PowerShell allow you to group a series of PowerShell statements into a reusable unit. You can define functions to perform specific tasks, and they can accept parameters and return values.

    • Functions are useful for modularizing your code and avoiding code duplication. They can be defined within scripts or loaded from modules.

    Example of a simple function:

    powershellCopy codefunction Get-Square {
        param (
            [int]$Number
        )
        $Square = $Number * $Number
        return $Square
    }

    Usage:

    powershellCopy codeGet-Square -Number 5
  3. Scripts:

    • PowerShell scripts are sequences of PowerShell commands saved in a text file with a .ps1 extension. Scripts can contain a series of cmdlets, functions, logic, and control flow statements.

    • Running a script is a way to execute a sequence of PowerShell commands as a single unit.

    Example script (MyScript.ps1):

    powershellCopy code# MyScript.ps1
    Get-Process

    Running the script:

    powershellCopy code.\MyScript.ps1
  4. Native Commands (External Commands):

    • PowerShell can also interact with external commands, executables, or scripts written in other languages (e.g., batch files, executable programs). These are referred to as native commands.

    • You can call native commands using the & operator or the Invoke-Expression cmdlet.

    Example of calling a native command:

    powershellCopy code& "C:\Path\To\Your\Executable.exe" -Parameter1 Value1

    Keep in mind that while native commands can be called from PowerShell, the preferred and more PowerShell-centric approach is to use cmdlets and functions whenever possible for better consistency and integration with the PowerShell environment.

Cmdlet

❗ Disclaimer

  • Never use tools and techniques on real IP addresses, hosts or networks without proper authorization!

📝
1️⃣
PowerShell for Pentesters
Client-Side Attacks
What is PowerShell? - PowerShellMicrosoftLearn
GitHub - PowerShell/PowerShell: PowerShell for every system!GitHub
Logo
Cmdlet Overview - PowerShellMicrosoftLearn
Logo
Logo