# Powershell

<figure><img src="https://3194248079-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRDc44tPNsBhsf--dD%2Fuploads%2FRRGciCpIRgEhNtorPCPO%2Fpowershell.png?alt=media&#x26;token=d442fb37-0d00-45ed-8956-1277a1d9f949" alt=""><figcaption></figcaption></figure>

Powershell is a task automation and configuration management program from Microsoft, consisting of a command-line shell and the associated scripting language. Tasks are generally performed via *cmdlets* which are specialized .NET classes implementing a particular operation. Cmdlets work in tandem with the .NET API. Powershell is a non-case sensitive language.

## Basic Powershell Commands

**Get-Help**: Displays information about a cmdlet.&#x20;

{% code overflow="wrap" %}

```powershell
Get-Help $CMD 
Get-Help $CMD -Examples # Shows examples
```

{% endcode %}

**Get-Command**: Gets all the cmdlets installed on the current computer. Allows for pattern matching with the \[\*] symbol.

**Get-Alias**: Lists all aliases available

```powershell
Get-Command $PATTERN-*
```

**Get-ChildItem**: Gets the items and child items in one of more specified locations.

**Get-Content**: Retrieves the content of a file and displays it in the console.

```powershell
Get-ChildItem "*$PATTERN*" -Path C:\ -Recurse -ErrorAction SilentlyContinue
gci $PATTERN | Get-Content
gci $PATTERN | Get-FileHash -Algorithm MD5
```

**New-Item**: Creates a new item.

**Remove-Item**: Removes both directories and files.

**Copy-Item**: Equivalent to `copy`, it can copy files and directories alike to a new destination.

```powershell
New-Item -Path "$PATH" -ItemType "$FILE_OR_DIR"
Remove-Item -Path "$PATH$"
Copy-Item -Path $PATH -Destination $TO_PATH
```

**Get-Location**: Gets information about the current working location or a location stack

**Set-Location**: Sets the current working location to a specified location.

```powershell
Get-Location
Set-Location -Path "HKLM:\"
Set-Location -Path "Env:\" -PassThru
Set-Location C:
```

**Invoke-WebRequest**: Gets content from a web page on the internet.

```powershell
Invoke-WebRequest -URI $URL
Invoke-WebRequest $URL -OutFile $PATH
```

**Find-Module**: Searches for modules in online repositories.

**Install-Module**: Downloads a module from an online repository and installs it, making it available for use.

```powershell
Find-Modue -Name "$PATTERN"
Install-Module -Name "$PATTERN"
```

## Useful Commands for Information Gathering

Basic Information:

```powershell
# Get user information
Get-LocalUser
# Number of users
(Get-LocalUser).Name.Count
# Groups
Get-LocalGroup
# IP Address info
Get-NetIPAddress
# Get listening ports
Get-NetTCPConnection | Where-Object {$_.State eq "Listen"}
# Patches
Get-HotFix
# List running processes
Get-Process
# List scheduled tasks
Get-ScheduledTask
```

Find users with password required value set to False:

{% code overflow="wrap" %}

```powershell
Get-LocalUser | Select-Object * | Where-Object {$_.PasswordRequired -eq “$False”}
```

{% endcode %}

Find files with a specified pattern in the content:

{% code overflow="wrap" %}

```powershell
gci -Path C:\ -Recurse -ErrorAction SilentlyContinue | Select-String "$PATTERN"
```

{% endcode %}
