• Provides access to almost everything in a Windows platform and Active Directory Environment which could be useful for an attacker.
• Provides the capability of running powerful scripts completely from memory making it ideal for foothold shells/boxes.
• Based on .NET framework and is tightly integrated with Windows
• Cmdlets are used to perform an action and a .NET object is returned as the output.
• PowerShell is NOT powershell.exe. It is the System.Management.Automation.dll

Importing scripts and module

Use cmdlets, native commands, functions, .NET, DLLs, Windows API and much more in a single “program”

Load a PowerShell script using dot sourcing:

. . C:\Tools\PowerView.ps1

A module (or a script) can be imported with:

Import-module c:\Tools\ADModule-Master\ActiveDirectory\ActiveDirectory.psd1

All the commands in a module can be listed with:

Get-Command -module <modulename>

Execution Policy

It’s NOT a security measure, it is present to prevent user from accidently executing scripts.

There are several ways to bypass:

powershell -ExecutionPolicy bypass

$env:PSExecutionPolicyPreference="bypass"