This document introduces PowerShell and explains why hackers should learn it. PowerShell can be used for tasks like port scanning, brute forcing RDP/SQL, dumping password hashes, and quickly setting up backdoors. It comes preinstalled on many modern Windows systems and provides an unchecked environment for accessing and controlling the operating system through commands and scripting. The document demonstrates various hacking techniques that can be accomplished using PowerShell, such as poking the system, checking for open ports, and gaining complete control over servers after initial access.

1. PowerShell – what every
haXor needs to know
Jameel
Haffejee
/
RC1140

2. What is PowerShell
Its awesome

3. Why Should you care ?
 Its installed by default on a growing number of MS OS’s
 Windows 7
 Windows Server 2K8R2
 Optional On Windows XP SP 3
 Its an alternate scriptable way to access the OS
 It’s a unchecked environment at the moment

4. Accessing PowerShell
• Can be accessed via the Start Menu or Run
• Can be called from within batch files
• Accessed via its hostable core in any supported language

5. Execution Policies
• Restricted (Default)
• Signed
• Remote Signed
• Unrestricted
• Bypass
• PowerShell Does not require admin privileges to run and
most commands work without the need for admin access.

6. PowerShell Trinity
 Where it all begins and ends, Get-Help , Get-Command ,Get-
member

7. Hello World
• Variables
• String Types
• Loops
• Running a script
• ISE , Yes is comes with a ISE :P

8. Poking the System with
PowerShell
 One Liners – Because everyone has to count their
keystrokes till doom
 Accessing windows through WMI and COM
 Making use of Active Directory to index machines on the
network
 What can we do with more than one line

9. Knock Knock – Is that port open
 No direct PowerShell interfaces so we have to resort to .Net
 Making socket connections in PowerShell
 $tcpclient = new-Object system.Net.Sockets.TcpClient
 $tcpclient.Connect('localhost','80')
 Creating and using a Port Scanner in PowerShell
 Finally setting up a basic bind interface to listen on our port of
choice i.e Basic netcat

10. Breaking Down the front door
 Brute Forcing RDP/SQL with PowerShell

11. Popped The Cork
 So now that you have access to a PC/Server
what can you do ?
 Dumping Hashes
 Complete control over IIS from the command
line
 Setting up a bot with PowerShell
 Setting up backdoor access in 60 seconds,
Assuming you have physical access (Still
possible without physical access as well )

12. Questions and Contact Info
Twi3er
:
h3p://twi3er.com/RC1140
Mail
:
jameel@superuser.co.za
IRC
:
#ZaCon
(On
Atrum)
#PowerShell
(On
FreeNode)
Code
:
h3p://github.com/rc1140/zacon