Powering up on power shell avengercon - 2018

Editor's Notes

• #6: - Local instance of Posh-Hunter.com - Over 90 challenges Demos and a cheatsheet are on the site # Sysinternals gci hkcu:\software\sysinternals
• #8: http://www.insomniacsecurity.com/2017/08/27/phant0m.html
• #9: - Previously called monad - cmdlets == compiled dotnet - functions == reusable chunks of code
• #10: PowerShell sits directly on the Microsoft .NET Framework System.Management.Automation.dll is the dll enabling all the magic Run PowerShell via hosting application A runspace is created via the .NET framework for our specific application Within the runspace, we can run cmdlets, scripts, and or functions Our output is then passed to the hosting applications interface Which brings us to what we see
• #15: https://www.thewindowsclub.com/difference-powershell-powershell-core Microsoft Windows 7 SP1 and Windows Server 2008 R2 were the first versions of the operating system to include PowerShell (version 2.0) installed by default Versions of PowerShell have been included in every subsequent release of Windows, through PowerShell 5.0 on Windows Server 2016 and on Windows 10. https://redmondmag.com/articles/2017/07/17/windows-powershell-6.0-and-powershell-core.aspx https://4sysops.com/wiki/differences-between-powershell-versions/
• #25: Query local or remote systems Output of the queries can then be filtered, searched, consolidated and perhaps saved to a CSV file or HTML report Filtering with get-winevent is performed at the target computer, not locally, which is much faster than downloading an entire (possibly multi-gigabyte) log and filtering it locally afterwards. We want to push the query filtering work out to the remote computer whenever possible. - XPath Queries Queries with get-winevent can be defined using a simple hashtable, an XPath query, or an XML definition of one or more XPath queries performed simultaneously. The Xpath query syntax is complex, but we can use the graphical Event Viewer application to build these queries for us. Once Event Viewer constructs the XML for the query, that XML string can simply be pasted into our scripts. DEMO: # To see a list of all local event logs: get-winevent -listlog * # To see a list of logs that begin with "s" on the remote computer named "server47": get-winevent -listlog s* -computername "server47" # To see the details of just the Security log: get-winevent -listlog security | format-list * # To show the last 20 events from the System log: get-winevent -logname system -maxevents 20 # To get the last 20 events from each of the three classic logs: $events = get-winevent -logname system -maxevents 20 $events += get-winevent -logname application -maxevents 20 $events += get-winevent -logname security -maxevents 20 $events | sort-object -property TimeCreated | format-table TimeCreated,ID,Level,Message –auto - A hash table is an array of paired items in the form " <property> = <value>" , with each pairing separated from the other pairs with a semicolon. One way to filter query results is to give the target computer a hash table of filters, such that only the events which match the properties and values in the filters will be returned. Here is an example. # To only show events with ID number 4624 from the Security log: get-winevent -filterhashtable @fLogName="Security"; ID=4624} - Note: You cannot use wildcards in -FilterHashTable query values, with the exceptions of log names and provider names. Sorry. How would you know which properties can be used in a hash table filter? Unfortunately, not every property of an event entry displayed by get-member can be used in a hash table filter (unlike filtering with where-object). The help for get-winevent gives the ugly details, but these are the properties you will most likely wish to use in filters (they are not case sensitive): • LogName • ProviderName • ID • Level • StartTime • EndTime - The "StartTime" and "EndTime" properties will take datetime objects, like those created by the get-date cmdlet. Here is an example. # To only show Security log events between five and three days ago: $Day5Ago = (get-date).AddDays(-5) $Day3Ago = (get-date).AddDays(-3) get-winevent -filterhashtable @{LogName="Security"; StartTime=$Day5Ago; EndTime=$Day3Ago} # To only show Warning events from the Application log: get-winevent -FilterHashtable @{LogName="Application"; Leve1=3} # To only show 10 recent Critical, Error and Warning events from the System log on a remote computer named "server47.testing.local": get-winevent -FilterHashtable @{liogName="SYstem"; Level=@(1,2,3)) -MaxEvents 10 -ComputerName "server47.testing.local" # To list the last 10 user accounts created (notice the "+=" in the second command): $events = get-winevent –FilterHashtable @fLogName="Security"; ID=47201 –ErrorAction SilentlyContinue $events += get-winevent –FilterHashtable @fLogName="Security"; ID=6241 –ErrorAction SilentlyContinue $events | select-object -last 10 - SilentlyContinue is used to suppress the output of nothing being returned - Other EventLog cmdlets: Clear-EventLog Write-EventLog Limit-EventLog Show-EventLog New-EventLog Remove-EventLog # To clear the System and Application logs on a remote computer named Server57: Clear-eventlog –log system,application –computername Server57 The Get-WinEvent cmdlet gets events from event logs, including classic logs, such as the System and Application logs, and the event logs that are generated by the Windows Event Log technology introduced in Windows Vista. It also gets events in log files generated by Event Tracing for Windows (ETW).
• #26: # Writing EventLogs https://blogs.technet.microsoft.com/heyscriptingguy/2013/06/20/how-to-use-powershell-to-write-to-event-logs/
• #28: # Writing EventLogs https://blogs.technet.microsoft.com/heyscriptingguy/2013/06/20/how-to-use-powershell-to-write-to-event-logs/
• #30: Enable-remoting –force suppresses the user prompts. Session configurations are specifying what is actually above to the user. You can restrict cmdlets and commands
• #31: (for example, to a nondomain computer on TrustedHosts list)
• #32: # Writing EventLogs https://blogs.technet.microsoft.com/heyscriptingguy/2013/06/20/how-to-use-powershell-to-write-to-event-logs/
• #34: # Writing EventLogs https://blogs.technet.microsoft.com/heyscriptingguy/2013/06/20/how-to-use-powershell-to-write-to-event-logs/
• #36: https://sid-500.com/2017/08/01/powershell-check-open-ports-with-test-netconnection/ https://docs.microsoft.com/en-us/dotnet/api/system.net.sockets.tcplistener?view=netframework-4.7.2 https://stackoverflow.com/questions/12148666/send-and-receive-data-via-udp-in-powershell
• #38: When you execute a command without a full path to it, PowerShell searches for that command's name by trying to match it to one of these types of items, in this order: If two commands of the same type with the same name exist, such as two functions both named ”tasklist", whichever was added most recently is what is executed because the earlier one was replaced. https://www.computerperformance.co.uk/powershell/functions/ DEMO: # Add a ping alias PS:\> ping # Returns the correct menu for ping PS:\> new-alias ping notepad PS:\> ping # spawns notepad PS:\> c:\windows\system32\ping.exe # Works as it should
• #39: Change “CurrentUser” profile path https://stackoverflow.com/questions/5095509/is-it-possible-to-change-the-default-value-of-profile-to-a-new-value - If you are accessing the $profile variable from within the Windows PowerShell console, the AllUsersCurrentHost and the CurrentUserCurrentHost note properties refer to the Windows PowerShell console. If you access the $profile variable from within the Windows PowerShell ISE, the AllUsersCurrentHost and the CurrentUserCurrentHost note properties refer to the Windows PowerShell ISE profiles. CurrentUserCurrentHost = user logged in, the PowerShell host they are using (Console or ISE) Profiles are loaded in the order shown. So the most authoritative one is the user’s AllUsersAllHosts profile (microsoft.powershell[ise]_profile.ps1) AllUsersAllHosts AllUsersCurrentHost CurrentUserAllHost CurrentUserCurrentHost DEMO: # Test to see if profile script exists if (!(Test-Path -Path $PROFILE )) { New-Item -Type File -Path $PROFILE}