PowerSploit
PowerSploit - A PowerShell Post-Exploitation Framework
PowerSploit is an archived collection of PowerShell scripts for penetration testers covering code execution, Active Directory reconnaissance, credential extraction, privilege escalation, and persistence on Windows systems.
PowerSploit is a collection of PowerShell scripts designed for use during penetration tests, which are authorized security assessments where professionals attempt to find weaknesses in a system before attackers do. The README notes that the project is no longer actively supported or maintained.
The collection is organized into modules that correspond to different phases of a security assessment. The CodeExecution module contains tools for running code on a target machine in various ways, including loading software into memory without writing it to disk. The Recon module provides tools for scanning networks, looking up DNS records, and mapping out Windows domain environments. PowerView, included in the Recon module, is a set of functions for gathering information about Active Directory domains, which are the directory systems organizations use to manage computers, users, and permissions.
The Exfiltration module contains tools for extracting sensitive information from a compromised machine. This includes capturing keystrokes, taking periodic screenshots, recording microphone audio, and pulling stored passwords from various sources such as Windows credential vaults and Group Policy files. The Persistence module offers ways to make scripts run automatically when a system reboots, which is a technique used during authorized tests to simulate how a real attacker might maintain access.
The AntivirusBypass module includes a tool for locating the specific bytes in a file that antivirus software uses to flag it as malicious, which helps security researchers understand detection signatures. The Privesc module, primarily through a sub-tool called PowerUp, checks for common configuration weaknesses that could allow a user to gain higher levels of access than they should have.
To use PowerSploit, you drop the folder into a PowerShell module directory and import it with a standard PowerShell command. The project is licensed under the BSD 3-Clause license.
Where it fits
- Enumerate Active Directory users, groups, and permissions during an authorized penetration test using PowerView.
- Check a Windows machine for common privilege escalation misconfigurations using the PowerUp tool.
- Identify which bytes of a file trigger antivirus detection during authorized security research.
- Simulate attacker persistence by adding a scheduled auto-run mechanism in an authorized security assessment.