Parameters Shorts Alias Example/Note
-algorithm -a
-name -n
-properties get-netuser -properties name,samaccounttype

Network Recon by echo and ping

Untitled

The first part of the command sets the range for the last octet. The second part generates and prints the IP address to be used and pipes it to the command line. Finally, the last part greps lines that include the “TTL” string.

A similar command can be built using the existing socket and TCP client functions. In the example below, we scan the first 1024 TCP ports of the target. Note that the “2>$null” sends any error to null, providing us with a cleaner output.

Untitled

Get-Process (gps) and Start-Process (sps)

Use of -name:

Untitled

Use of Export-csv with get-process:

Untitled

Get-Service (gsv) and use of $_ and ?

gsv | ? {$_.Status -eq “Running”} , $_.property returns a boolean indicating whether the current object is a directory or not. It must be in { }.

Untitled

gsv | % {if ($_.status -eq "running") {write-host $_.name -foregroundcolor "Green"} else {write-host $_.name -ForegroundColor "Red"}} - % allows you to perform an action against multiple objects when that action normally only works on one object at a time. It creates a loop where the action is performed against the first object in the list, and, upon completion, loops back up to perform it on the next object in the list until all objects in the list have been addressed.

Untitled

Get-LocalUser (glu)

This cmdlet gets default built-in user accounts, local user accounts that you created, and local accounts that you connected to Microsoft accounts.

Get-LocalUser | ft Name,Enabled,Description,LastLogon

Untitled

glu -SID "S-1-5-21-1394777289-3961777894-1791813945-501"

Untitled

glu | ? -Property PasswordRequired -Match false

Untitled