You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add your own cmdlets by submitting a pull request.
4
+
## Requirement
5
+
- Maintain .NET 2.0 compatibility in order to support the broadest range of operating systems
6
+
7
+
## Instructions
8
+
Use the TemplateCommand.cs file in the Commands folder to construct new cmdlets. The TemplateCommand cmdlet is hidden from the list of available cmdlets, but can be called in order to understand its workings. This command looks as follows: `Get-TemplateCommand [-MyFlag] -MyInteger [Int32] -MyString [Value]` and is also accessible via alias `gtc`.
9
+
10
+
### Example usages
11
+
| Action | Command |
12
+
| - | - |
13
+
| Simply run with default values |`gtc`|
14
+
| Run with the -MyFlag parameter which executes the 'else' statement |`gtc -MyFlag`|
15
+
| Run with the -MyInteger parameter which changes the number of iterations from its default number of 5 iterations to whatever number is provided |`gtc -MyInteger 10`|
16
+
| Run with the -MyString parameter which changes the text that is printed from its default value of 'Hello World' to whatever string is provided |`gtc -MyString "Bye PowerShell"`|
17
+
| Combination of parameters |`gtc -MyInteger 10 -MyString "Bye PowerShell"`|
18
+
| Combination of parameters - Using fact that MyString is the only mandatory parameter for this command |`gtc -MyInteger 10 "Bye PowerShell"`|
19
+
| Command in combination with a couple of data manipulators in the pipe |`gtc "Bye PowerShell" -MyInteger 30 \| ? Attribute2 -Like Line1* \| select Attribute2 \| fl`|
20
+
21
+
Execute the following steps to implement your own cmdlet:
22
+
1. Download Visual Studio Community from https://visualstudio.microsoft.com/downloads/
23
+
* In the installer select the **.NET desktop development** component.
24
+
* From this component no optional modules are required for developing NoPowerShell modules.
25
+
2. Make sure to have the .NET 2 framework installed: OptionalFeatures -> '.NET Framework 3.5 (includes .NET 2.0 and 3.0)'.
26
+
3. Clone this repository and create a copy of the **TemplateCommand.cs** file.
27
+
* In case you are implementing a native PowerShell command, place it in folder the corresponding to the _Source_ attribute when executing in PowerShell: `Get-Command My-Commandlet`.
28
+
* Moreover, use the name of the _Source_ attribute in the command's namespace.
29
+
* Example of a native command: `Get-Command Get-Process` -> Source: `Microsoft.PowerShell.Management` -> Place the .cs file in the **Management** subfolder and use `NoPowerShell.Commands.Management` namespace.
30
+
* In case it is a non-native command, place it in the **Additional** folder and use the `NoPowerShell.Commands.Additional` namespace.
31
+
4. Update the `TemplateCommand` classname and its constructor name.
32
+
5. Update the static **Aliases** variable to the command and aliases you want to use to call this cmdlet. For native PowerShell commands you can lookup the aliases using `Get-Alias | ? ResolvedCommandName -EQ My-Commandlet` to obtain the list of aliases. Always make sure the full command is the first "alias", for example: `Get-Alias | ? ResolvedCommandName -EQ Get-Process` -> Aliases are: `Get-Process`, `gps`, `ps`
33
+
6. Update the static **Synopsis** variable to a small text that describes the command. This will be shown in the help.
34
+
7. Update the arguments supported by the command by adding _StringArguments_, _BoolArguments_ and _IntegerArguments_ to the static **SupportedArguments** variable.
35
+
8. In the Execute function:
36
+
1. Fetch the values of the _StringArguments_, _BoolArguments_ and _IntegerArguments_ as shown in the examples;
37
+
2. Based on the parameters provided by the user, perform your actions;
38
+
3. Make sure all results are stored in the `_results` variable.
39
+
9. Remove all of the template sample code and comments from the file to keep the source tidy.
Copy file name to clipboardExpand all lines: README.md
+15-43Lines changed: 15 additions & 43 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,17 @@
1
1
# NoPowerShell
2
-
NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms. This .NET Framework 2 compatible binary can be loaded in Cobalt Strike to execute commands in-memory. No `System.Management.Automation.dll` is used; only native .NET libraries.
2
+
NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms. This .NET Framework 2 compatible binary can be loaded in Cobalt Strike to execute commands in-memory. No `System.Management.Automation.dll` is used; only native .NET libraries. An alternative usecase for NoPowerShell is to launch it as a DLL via rundll32.exe: `rundll32 NoPowerShell.dll,main`.
3
3
4
4
Moreover, this project makes it easy for everyone to extend its functionality using only a few lines of C# code.
5
5
6
-
Latest binary available from the [Releases](https://github.com/bitsadmin/nopowershell/releases) page.
6
+
Latest binaries available from the [Releases](https://github.com/bitsadmin/nopowershell/releases) page.
7
7
8
8
# Screenshots
9
9
## Running in Cobalt Strike
10
10
![NoPowerShell supported commands](https://raw.githubusercontent.com/bitsadmin/nopowershell/master/Pictures/CurrentlySupportedCommands.png"NoPowerShell in Cobalt Strike")
11
11
## Sample execution of commands
12
12
![NoPowerShell sample commands](https://raw.githubusercontent.com/bitsadmin/nopowershell/master/Pictures/SampleCommands.png"NoPowerShell in Cobalt Strike")
13
+
## Rundll32 version
14
+
![NoPowerShellDll via rundll32](https://raw.githubusercontent.com/bitsadmin/nopowershell/master/Pictures/NoPowerShellDll.png"NoPowerShellDll via rundll32")
13
15
14
16
# Usage
15
17
## Note
@@ -23,7 +25,7 @@ When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe
23
25
| - | - | - |
24
26
| List all commands supported by NoPowerShell |`Get-Command`||
25
27
| Get help for a command |`Get-Help -Name Get-Process`| Alternative: `man ps`|
26
-
| Show current user |`NoPowerShell.exe whoami`| Unofficial command |
28
+
| Show current user |`whoami`| Unofficial command |
27
29
| List SMB shares of MyServer |`Get-RemoteSmbShare \\MyServer`| Unofficial command |
28
30
| List all user groups in domain |`Get-ADGroup -Filter *`||
29
31
| List all administrative groups in domain |`Get-ADGroup -LDAPFilter "(admincount=1)" \| select Name`||
@@ -53,7 +55,7 @@ When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe
53
55
| List processes on remote host |`Get-Process -ComputerName dc01.corp.local -Username Administrator -Password P4ssw0rd!`||
| Kill all cmd.exe processes |`Get-Process cmd \| Stop-Process -Force`||
57
59
| Obtain data of Win32_Process class from a remote system and apply a filter on the output |`gwmi "Select ProcessId,Name,CommandLine From Win32_Process" -ComputerName dc01.corp.local \| ? Name -Like *PowerShell* \| select ProcessId,CommandLine`| Explicit credentials can be specified using the `-Username` and `-Password` parameters |
58
60
| View details about a certain service |`Get-WmiObject -Class Win32_Service -Filter "Name = 'WinRM'"`||
59
61
| Launch process using WMI |`Invoke-WmiMethod -Class Win32_Process -Name Create "cmd /c calc.exe"`| This can also be done on a remote system |
@@ -63,7 +65,7 @@ When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe
63
65
| Show the IP routing table |`Get-NetRoute`||
64
66
| Send 2 ICMP requests to IP address 1.1.1.1 with half a second of timeout |`Test-NetConnection -Count 2 -Timeout 500 1.1.1.1`||
65
67
| Perform a traceroute with a timeout of 1 second and a maximum of 20 hops |`Test-NetConnection -TraceRoute -Timeout 1000 -Hops 20 google.com`||
66
-
| List network shares on the local machine that are exposed to the network |`Get-NetSmbMapping`||
68
+
| List network shares on the local machine that are exposed to the network |`Get-SmbMapping`||
67
69
| Format output as a list |`Get-LocalUser \| fl`||
68
70
| Format output as a list showing only specific attributes |`Get-LocalUser \| fl Name,Description`||
69
71
| Format output as a table |`Get-Process \| ft`||
@@ -86,6 +88,12 @@ When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe
86
88
2. Launch Cobalt Strike and load the .cna script in the Script Manager
87
89
3. Interact with a beacon and execute commands using the `nps` command
88
90
91
+
## Launch via rundll32
92
+
1. Create a new shortcut to `NoPowerShell.dll` file (drag using right click -> Create shortcuts here)
93
+
2. Update the shortcut prefixing the filename with `rundll32` and appending `,main`
94
+
3. The shortcut will now look like `rundll32 C:\Path\to\NoPowerShell.dll,main`
95
+
4. Double click the shortcut
96
+
89
97
# Known issues
90
98
- Pipeline characters need to surrounded by spaces
91
99
- TLS 1.1+ is not supported by .NET Framework 2, so any site enforcing it will result in a connection error
@@ -98,43 +106,7 @@ When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe
98
106
- Add support for .NET code in commandline, i.e.: `[System.Security.Principal.WindowsIdentity]::GetCurrent().Name`
99
107
100
108
# Contributing
101
-
Add your own cmdlets by submitting a pull request.
102
-
## Requirement
103
-
- Maintain .NET 2.0 compatibility in order to support the broadest range of operating systems
104
-
105
-
## Instructions
106
-
Use the TemplateCommand.cs file in the Commands folder to construct new cmdlets. The TemplateCommand cmdlet is hidden from the list of available cmdlets, but can be called in order to understand its workings. This command looks as follows: `Get-TemplateCommand [-MyFlag] -MyInteger [Int32] -MyString [Value]` and is also accessible via alias `gtc`.
107
-
108
-
### Example usages
109
-
| Action | Command |
110
-
| - | - |
111
-
| Simply run with default values |`gtc`|
112
-
| Run with the -MyFlag parameter which executes the 'else' statement |`gtc -MyFlag`|
113
-
| Run with the -MyInteger parameter which changes the number of iterations from its default number of 5 iterations to whatever number is provided |`gtc -MyInteger 10`|
114
-
| Run with the -MyString parameter which changes the text that is printed from its default value of 'Hello World' to whatever string is provided |`gtc -MyString "Bye PowerShell"`|
115
-
| Combination of parameters |`gtc -MyInteger 10 -MyString "Bye PowerShell"`|
116
-
| Combination of parameters - Using fact that MyString is the only mandatory parameter for this command |`gtc -MyInteger 10 "Bye PowerShell"`|
117
-
| Command in combination with a couple of data manipulators in the pipe |`gtc "Bye PowerShell" -MyInteger 30 \| ? Attribute2 -Like Line1* \| select Attribute2 \| fl`|
118
-
119
-
Execute the following steps to implement your own cmdlet:
120
-
1. Download Visual Studio Community from https://visualstudio.microsoft.com/downloads/
121
-
* In the installer select the **.NET desktop development** component.
122
-
* From this component no optional modules are required for developing NoPowerShell modules.
123
-
2. Make sure to have the .NET 2 framework installed: OptionalFeatures -> '.NET Framework 3.5 (includes .NET 2.0 and 3.0)'.
124
-
3. Clone this repository and create a copy of the **TemplateCommand.cs** file.
125
-
* In case you are implementing a native PowerShell command, place it in folder the corresponding to the _Source_ attribute when executing in PowerShell: `Get-Command My-Commandlet`.
126
-
* Moreover, use the name of the _Source_ attribute in the command's namespace.
127
-
* Example of a native command: `Get-Command Get-Process` -> Source: `Microsoft.PowerShell.Management` -> Place the .cs file in the **Management** subfolder and use `NoPowerShell.Commands.Management` namespace.
128
-
* In case it is a non-native command, place it in the **Additional** folder and use the `NoPowerShell.Commands.Additional` namespace.
129
-
4. Update the `TemplateCommand` classname and its constructor name.
130
-
5. Update the static **Aliases** variable to the command and aliases you want to use to call this cmdlet. For native PowerShell commands you can lookup the aliases using `Get-Alias | ? ResolvedCommandName -EQ My-Commandlet` to obtain the list of aliases. Always make sure the full command is the first "alias", for example: `Get-Alias | ? ResolvedCommandName -EQ Get-Process` -> Aliases are: `Get-Process`, `gps`, `ps`
131
-
6. Update the static **Synopsis** variable to a small text that describes the command. This will be shown in the help.
132
-
7. Update the arguments supported by the command by adding _StringArguments_, _BoolArguments_ and _IntegerArguments_ to the static **SupportedArguments** variable.
133
-
8. In the Execute function:
134
-
1. Fetch the values of the _StringArguments_, _BoolArguments_ and _IntegerArguments_ as shown in the examples;
135
-
2. Based on the parameters provided by the user, perform your actions;
136
-
3. Make sure all results are stored in the `_results` variable.
137
-
9. Remove all of the template sample code and comments from the file to keep the source tidy.
109
+
See [CONTRIBUTING.md](https://github.com/bitsadmin/nopowershell/blob/master/CONTRIBUTING.md).
138
110
139
111
# Requested NoPowerShell cmdlets
140
112
| Cmdlet | Description |
@@ -191,4 +163,4 @@ Authors of additional NoPowerShell cmdlets are added to the table below. Moreove
191
163
| Measure-Object | Utility |
192
164
| Select-Object | Utility |
193
165
194
-
**Authored by Arris Huijgen ([@bitsadmin](https://twitter.com/bitsadmin/) - https://github.com/bitsadmin/)**
166
+
**Authored by Arris Huijgen ([@bitsadmin](https://twitter.com/bitsadmin/) - https://github.com/bitsadmin/)**
0 commit comments