- So John, what is actually Powershell?
- So Powershell is a scripting language and modern
command line shell for Windows system administration.
You could use it to manage the registry,
perform WMI commands, search for files,
you could query domain users and groups,
and really so much more.
- Oh excellent.
Is it something that is only Windows specific
or can you run this in other operating systems?
- That's a great question, actually in 2016 Microsoft
released Powershell Core, an open source
and cross platform version that runs on top of .net core.
So now individuals can run Powershell commands
on Linux and Mac in addition to Windows,
whereas before it was just Windows.
- Oh wow, okay.
- So we do have an entire section coming out dedicated
to Powershell security, why would we dedicate
an entire section to Powershell?
- Absolutely.
So one, Powershell is actually getting a lot of attention
from a lot of security folks out there and the reason
for that is because Powershell allows you to
actually do a lot of things in the system
that traditionally you actually have done
with other tools and other mechanisms.
There's even a joke between security professionals
saying that, "I don't need an expert anymore
"I just have Powershell."
And the reason for that is because you can actually
invoke a lot of these actually commands and do a lot
of things in the Windows environment, and now as you mention
in other environments as well, without triggering a lot
of alarms that actually can be setup by actually
end point protections, things like antivirus,
host based firewalls, and host based
intrusion prevention systems.
Since it also become kind of a factor in the Windows
installations, it's a Swiss army knife for a lot of
security professionals nowadays, and that's the reason
that we want to actually dedicate a section for it.
- Powershell sounds like it can do a lot but it sounds
like it might be complicated, do you need
to be an expert in order to use it?
- Not at all and I think actually-
You do have to have some familiarity
of course with Powershell,
you have to know a little bit of actually the command line
in Windows, how to actually execute some of
those commands and everything.
You do not have to have a PhD in Powershell.
So what I urge you is if you're just
getting started of course to play with it.
That's one of the things that you're gonna do now right,
you're gonna do a demo on how to use Powershell
from a high level perspective and then in other
lessons you're actually gonna deep dive
into the attack tools right?
- Yep exactly, so we'll start off with regular
Powershell in Windows and then we'll start using
Powershell for ethical hacking purposes.
- Excellent.
- Okay, let's have a look at how Powershell
works on a Windows machine.
So right from any Windows command line,
you can type in Powershell and it goes into
the Powershell command prompt.
You can see that it's changed to Powershell
because on the left side it now has a capital PS next to it.
So now we can type in various commands,
if you wanna get help at any time you can type in
get-help and it tells you exactly how the help page works.
So you type get-help and then a process name
and it'll tell you how to get help on that process.
Now if you type in get-help x*
then it pops up all the different processes
that you can get help on.
So we could just pick a random one from the list,
let's pick registry and we can type get-help registry
and it pops up a list of examples and ways you can
use Powershell to interact with the Windows registry.
So we want to pull some groups from the system,
we can type in get-wmyobject win32_group
and you can actually find all the different groups
that are on the particular system
so you can see there's an administrators group
which would be the obvious target for any attacker.
There's also the users group, guest group.
If we want to invoke certain commands,
we can even run certain legacy commands as well
so the net local group administrators command
that you run in a non-Powershell environment,
it works here as long as you put it through the
invoke-command in parentheses you can actually put in
that command and it will run inside a Powershell command.
You may ask why would you run a simple command
within the more complicated Powershell command
and really because you can do additional functionality
with that so in a Powershell command you could also
run that particular command on other machines
on your network as well.
But at least working on a local machine
for demo purposes you can see
that it popped up a couple administrators.
There was an administrator set training
and a Zoro user on the system.
Let's look at other commands that we can run.
There is a take screenshot command which is
not something that's built in to Powershell
but it is something that we can take
advantage of other people's scripts.
If you go to Microsoft's website, they have a list of
Powershell scripts that you can run.
We're gonna download their take screenshot command.
You can see they have the .ps1 extension,
we're just looking at, we downloaded the file
onto our desktop and we can see that it is
take-screenshot.ps1 and now we want
to run this on our system.
This is the full command we're gonna run
basically saying Powershell execution policy
remote sign which basically says we're going to
allow execution for this particular command.
Some commands will not let you execute without
additional permissions, we are basically saying,
"Allow this command to run."
And then the command is the take-screenshot.ps1
which is running that script that we just downloaded
and some of the command line switches within that task
is screen which basically says we're taking a picture
of the entire screen and then the -file which is
asking which file to put the screenshot into.
So we're dumping this into a test.bmp file.
So if we run that, we can see that it took a
screenshot of our desktop and put it into this file.