powershell -ep bypass .\\script.ps1.
powershell -WindoStyle .\\script.ps1.
powershell -NoProfile .\\script.ps1. are essientially scripts that run when the powershell executable is launched and can interfere with our operations.
powershell -Version.
powershell -ec - Encodebase64
- PS:
get-help Get-Process -Full.
- PS:
get-help Get-Process -Examples.
- PS:
get-command -Name *Firewall*.
- PS:
Get-WmiObject -class win32_operationgsystem | select -Property *.
- PS:
Get-WmiObject -class win32_operationgsystem | fl *.
- PS:
Get-WmiObject -class win32_operationgsystem | fl * | Export-Csv C:\\host_info.csv.
- PS:
cd HKLM:\\- interact with registry directly.
- PS:
Select-String -Path C:\\users\\user\\documents\\*.txt -Pattern pass*.
- PS:
Get-Content.
- PS:
ls -r C:\\users\\user\\documents\\ -File .txt | % {sls -Path $_ -Pattern * }. % for each , $_ for current value in the pipe. sls for select-string.
- PS:
get-service 's*' | sort-object status -Descending
Powershell Modules.
- usually named after
.psm1 file extension.
- Can contains components like :
- any number of powershell script.
- Additional Assemblies, help files, scripts
- A module manifest file.
- A directory which is used to contain all the above.