powershell -ep bypass .\\script.ps1
.
powershell -WindoStyle .\\script.ps1
.
powershell -NoProfile .\\script.ps1
. are essientially scripts that run when the powershell executable is launched and can interfere with our operations.
powershell -Version
.
powershell -ec
- Encodebase64
- PS:
get-help Get-Process -Full
.
- PS:
get-help Get-Process -Examples
.
- PS:
get-command -Name *Firewall*
.
- PS:
Get-WmiObject -class win32_operationgsystem | select -Property *
.
- PS:
Get-WmiObject -class win32_operationgsystem | fl *
.
- PS:
Get-WmiObject -class win32_operationgsystem | fl * | Export-Csv C:\\host_info.csv
.
- PS:
cd HKLM:\\
- interact with registry directly.
- PS:
Select-String -Path C:\\users\\user\\documents\\*.txt -Pattern pass*
.
- PS:
Get-Content
.
- PS:
ls -r C:\\users\\user\\documents\\ -File .txt | % {sls -Path $_ -Pattern * }
. % for each , $_ for current value in the pipe. sls for select-string.
- PS:
get-service 's*' | sort-object status -Descending
Powershell Modules.
- usually named after
.psm1
file extension.
- Can contains components like :
- any number of powershell script.
- Additional Assemblies, help files, scripts
- A module manifest file.
- A directory which is used to contain all the above.