PowerOPS
PowerShell Runspace Portable Post Exploitation Tool aimed at making Penetration Testing with PowerShell “easier”
What is it:
PowerOPS is an application written in C# that does not rely on powershell.exe but runs PowerShell commands and functions within a powershell runspace environment (.NET). It intends to include multiple offensive PowerShell modules to make the process of Post Exploitation easier.
It tries to follow the KISS principle, being as simple as possible. The main goal is to make it easy to use PowerShell offensively and help to evade antivirus and other mitigations solutions. It does this by:
- Doesn’t rely on powershell.exe, it calls PowerShell directly through the .NET framework, which might help to bypass security controls like GPO, SRP and App Locker.
- The payloads are executed from memory and never touch the disk, evading most antivirus engines.
PowerOPS was inspired by . However, I was only interested in PowerShell modules and I was looking for more flexibility. Since PowerOPS offers basically an interactive PowerShell command prompt you are free to use the PowerShell tools included the way you want, and additionally, execute any valid PowerShell command.
What’s inside the runspace:
The following PowerShell tools/functions are included:
- Nishang
- Get-Information
- Get-PassHashes
- Port-Scan
- Empire
- Invoke-Psexec
- Invoke-SSHCommand
Additionally, you can run any valid PowerShell command.
Powershell functions within the Runspace are loaded into memory from Base64 Encoded Strings.
Download
git clone https://github.com/fdiskyou/PowerOPS.git
How to Compile it:
To compile PowerOPS you need to import this project within Microsoft Visual Studio or if you don’t have access to a Visual Studio installation, you can compile it as follows:
To Compile as x86 binary:
cd C:\Windows\Microsoft.NET\Framework64\v4.0.30319 (Or newer .NET version folder)
csc.exe /unsafe /reference:"C:\path\to\System.Management.Automation.dll" /reference:System.IO.Compression.dll /out:C:\users\username\PowerOPS_x86.exe /platform:x86 "C:\path\to\PowerOPS\PowerOPS\*.cs"To Compile as x64 binary:
cd C:\Windows\Microsoft.NET\Framework64\v4.0.30319 (Or newer .NET version folder)
csc.exe /unsafe /reference:"C:\path\to\System.Management.Automation.dll" /reference:System.IO.Compression.dll /out:C:\users\username\PowerOPS_x64.exe /platform:x64 "C:\path\to\PowerOPS\PowerOPS\*.cs"PowerOPS uses the System.Management.Automation namespace, so make sure you have the System.Management.Automation.dll within your source path when compiling outside of Visual Studio.
How to customize it:
Due to size restrictions, or other reasons, you might want to customize your own version of PowerOPS. If you need help just have a look at the gists bellow, as you won’t need anything else.
How to use it:
Just run the binary and type ‘show’ to list available modules.
PS > show
[-] This computer is not part of a Domain! Some functions will not work!
[+] Nishang
Get-Information Get-PassHashes Port-Scan
[+] PowerSploit
Get-KeyStrokes Invoke-DllInjection Invoke-Mimikatz Invoke-NinjaCopy
Invoke-Shellcode Invoke-TokenManipulation Invoke-WmiCommand Invoke-ReflectivePEInjection
PowerView PowerUp
[+] Empire
Invoke-PsExec Invoke-SSHCommand
[+] Others
Auto-GPPPassword Invoke-SMBAutoBrute Invoke-mimikittenz PowerCat
PowerUpSQL
PS >PowerUp and PowerView are loaded as modules, so Get-Command -module will show you all available functions.
PS > get-command -module powerup
CommandType Name ModuleName
----------- ---- ----------
Function Find-DLLHijack PowerUp
Function Find-PathHijack PowerUp
Function Get-ApplicationHost PowerUp
Function Get-ModifiableFile PowerUp
Function Get-RegAlwaysInstallElevated PowerUp
Function Get-RegAutoLogon PowerUp
Function Get-ServiceDetail PowerUp
Function Get-ServiceFilePermission PowerUp
Function Get-ServicePermission PowerUp
Function Get-ServiceUnquoted PowerUp
Function Get-UnattendedInstallFile PowerUp
Function Get-VulnAutoRun PowerUp
Function Get-VulnSchTask PowerUp
Function Get-Webconfig PowerUp
Function Install-ServiceBinary PowerUp
Function Invoke-AllChecks PowerUp
Function Invoke-ServiceAbuse PowerUp
Function Invoke-ServiceDisable PowerUp
Function Invoke-ServiceEnable PowerUp
Function Invoke-ServiceStart PowerUp
Function Invoke-ServiceStop PowerUp
Function Restore-ServiceBinary PowerUp
Function Test-ServiceDaclPermission PowerUp
Function Write-HijackDll PowerUp
Function Write-ServiceBinary PowerUp
Function Write-UserAddMSI PowerUp
PS >Tutorial
Source: https://github.com/fdiskyou/
Source
https://securityonline.info/powerops-powershell-runspace-portable-post-exploitation-tool/