Alright, we're at PowerShell.
This is a PowerShell script example.
For all of my people who love Windows,
this one's for you.
So PowerShell is used as a command scripting language
inside of Windows.
What do you think this script here is going to do for us?
Well, we're going to access = Get-Date,
we're going to get the date.
We're going to write the output you ran this script on,
whatever the access date was,
and we're going to put that to our output.
Next, we have ComputerName = environmentcomputername.
OS = Get-WniObject of the class
Win32 OperatingSystem - ComputerName,
dollar sign, ComputerName,
select the caption, select the string windows,
split that, replace it, and select the string windows.
That's a lot of words, right?
And then it goes into this IF statement,
if this, if this, if this, if this, right?
So what does that look like it's doing to you?
Well, to me, what that looks like
is that we are getting the computer name
and then we're trying to determine
what operating system this computer is running.
So if it matches 10, then you're running OS10.
If you're matching 8, you're running 8.
If you're matching 7, you're matching 7, right?
And it's going to tell you
what operating system this person is running.
Next, we're going to use a right output
the following users are currently logged in.
And then it's going to do,
if it matches Version 7, Windows 7,
we are going to query the user using that command.
If we're using Windows 10, we're going to use this
other thing.
So else, do this, if this, then that.
Then we have the next thing,
we're going to write our output.
And it's going to go to PS Drive, PowerShell Drive,
select the object, exclude used, free, provider,
credential, and current location.
What is this doing?
Well, this is trying to list out
any share drives that person has.
And finally, we have SMBCheck = Get-ItemProperty -Path,
HKLM, which is a registry key, that long registry key,
Name SMB1, Select-Object SMB1.
If SMBCheck -match 0
Write-Host SMBv1 is currently disabled.
Otherwise, write SMBv1 is enabled.
So putting all that together,
what did this PowerShell script do?
Well, it's an enumeration script,
and this is only a small piece of it.
This comes from a much larger script
of about 4 or 500 lines that you can run on a victim
once you've exploited a Windows machine and get access,
you can run this PowerShell script
and it will enumerate that system.
It'll tell you which users are logged in,
what version of Windows it is,
it's going to tell you what shares there are,
what printers are hooked up to it.
If it's running SMBv1, if it's missing patches,
all of that information can be run from this one script.
And this is just a small piece of that script.
So that's all this is, it's an enumeration script.
We're finding out information
about a machine that we've just exploited.
Now, how do you know this is PowerShell?
Well, for one, it talks a lot about Windows.
Other thing I notice
is that there's these get things, right?
Get this, select that.
That is very common in PowerShell,
they use a lot of words that have two or three
or four words strung together with dashes
as part of their operations.
You can start seeing what PowerShell looks like
the more you look at these type of scripts.
PowerShell is very, very distinctive
and much different than Python, Bash, or Ruby,
and so it's pretty easy to identify
if they give you a PowerShell script.