PowerShell Commands for Pentesters.
PowerShell Commands for Pentesters. • В продолжении к вчерашней публикации поделюсь с Вами полезными командами, которые будут полезны пентестерам и специалистам в области информационной безопасности: + Locating files with sensitive information: - Find potentially interesting files; - Find credentials in Sysprep or Unattend files; - Find configuration files containing “password” string; - Find database credentials in configuration files; - Locate web server configuration files; + Extracting credentials: - Get stored passwords from Windows PasswordVault; - Get stored passwords from Windows Credential Manager; - Dump passwords from Google Chrome browser; - Get stored Wi-Fi passwords from Wireless Profiles; - Search for SNMP community string in registry; - Search for string pattern in registry; + Privilege escalation: - Search registry for auto-logon credentials; - Check if AlwaysInstallElevated is enabled; - Find unquoted service paths; - Check for LSASS WDigest caching; - Credentials in SYSVOL and Group Policy Preferences (GPP); + Network related commands: - Set MAC address from command-line; - Allow Remote Desktop connections; - Host discovery using mass DNS reverse lookup; - Port scan a host for interesting ports; - Port scan a network for a single port (port-sweep); - Create a guest SMB shared drive; - Whitelist an IP address in Windows firewall; + Other useful commands: - File-less download and execute; - Get SID of the current user; - Check if we are running with elevated (admin) privileges; - Disable PowerShell command logging; - List installed antivirus (AV) products. https://www.infosecmatter.com/ #PowerShell