Now that we learned how to use PowerShell to collect the data
manually, let's put everything together and create a script that
will do all the enumeration for us.
Alright, we're back to our lab environment. Now that we saw how to
manually enumerate information about the local machine, let's put
everything together and create an automated enumeration script. In
here, to make things easier, I will be using the PowerShell Integrated
Scripting Environment, or ISE.
This is basically a platform that helps us to write and run PowerShell scripts.
So, let's open the PowerShell ISE. In here, I'm clicking
the New button to create a new script.
Perfect.
I like the ISE, because it helps us to search for features and find comments.
For example, do you remember the environment variable called env? So, yeah,
if we just type $env and then comma, we'll see all the options in here.
For example,
if I want to see the hostname, I just need to select the option
COMPUTERNAME. And to run this command, it's pretty simple.
I just have to click on the Run button here and the result
will be displayed on the bottom part. If you never used
the ISE before, don't worry.
It's a really straightforward tool.
You type the command in here on the top and it presents
the result on the bottom. So, okay,
let's get started with our enumeration script. First, to make things
prettier, I'll create a little banner for our script.
I'll use Write‑Host to display a message on the terminal. On the first line, I
will just print a header, and in the second line I will print the name of my
localhost name. And note here that I'm using an environment variable to my
header, and once I run this, we can see that PowerShell retrieved the hostname
and added it to my header.
Pretty cool, right? Now,
let me just add one more line to our banner, and we can start the script.
The first thing I will do here is use the command Get‑ComputerInfo to
retrieve the exact information I want from this local server.
And remember, you can add any fields you find available. In
here, in my case, I will use the same fields as the ones
that we saw in the previous demo.
Perfect, now let's quickly test this.
Amazing, it works.
We have here the first information for our script.
Now let's enumerate the installed software.
I will print a line here just to separate the output, and
then I will use the command Get‑WmiObject to retrieve
everything that is installed.
And, again, this is the same command that we saw in our demo.
Perfect, now let's test this.
Amazing, it works.
It printed a list of the installed software. But personally, I would rather
have this information in a table. For that, it is really easy.
I will just have to pipe this command and add Format‑Table. Then
let's just run this to make sure it works.
Perfect, here you go.
The software is listed in a table format. If you want, you can
customize any of the commands we are using here to present the
data you need in the format you want.
Now, last thing we need is get information about the
anti‑virus installed in the machine.
First, I'll use the Get‑CimInstance to list all the anti‑virus tools installed
on this machine, and then after that I will add the command
Get‑MpComputerStatus to gather information about the Windows Defender on the
machine. If we want, we can even include Windows native commands to get even
more information. Like, we could use the command net users to list out the
local users in the machine and the command net localgroup to list out the local
groups in the machine. Again,
you can mix both PowerShell and Windows native commands in
the same script. And that's about it.
Let me just print a line on the end of the script.
Perfect, now we can test if this worked.
Let's cross our fingers and run the script.
Amazing, it works.
We got all the information that we wanted, and the cool thing is that
we can easily export the script and really use this in other machines.
For that, I will click on the Save button,
add a name to the file, which in my case I will put at
local‑nm.ps1, and click Save. Now, whenever I want to execute the
script, I can just open my PowerShell terminal,
go to the folder that I saved the file, and execute
this ps1 script that I have in here.
Perfect, it works. Pretty cool, right? Now we have an automated script that
collects all the information that we need in just a few seconds.
Amazing! I hope you enjoyed this first module.
Before we go, let's take a moment to review what you learned in here.
First, we discussed why using PowerShell in offensive security.
Remember, using Windows native features can reduce your chances of
being detected by the defense team. And also, we can create scripts
tailored to exactly what we wants.
We also discussed in this module how to enumerate host
information and installed software.
Actually, we had to really cool demos showing you how to use PowerShell to
enumerate pretty much everything you need from a localhost. And last, we put
all our knowledge together to create an automated script that enumerates a lot
of information about the local machine.
If you enjoyed this module, I'm sure you'll love the next one, in which
you'll use PowerShell to scan the network for active hosts and even perform
port scans using PowerShell. So, I hope you're ready.
I will see you in the next module.