nishang - Nishang - Offensive PowerShell for red team, penet

项目说明

Nishang

Nishang is a 框架 and collection of scripts and payloads which enables usage of PowerShell for offensi, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.

By Nikhil Mittal
Founder of Altered Security - Hands-on red team and enterprise security training!
#### Usage

Import all the scripts in the current PowerShell session (PowerShell v3 onwards).

Use the indi scripts with dot sourcing.

To get help about any script or function, use:

Note that the help is a for the function loaded after running the script and not the script itself since 0.3.8. In all cases, the function name is same as the script name.

For example, to see the help about Get-WLAN-Keys.ps1, use

#### Anti Virus
Nishang scripts are flagged by many Anti as malicious. The scrripts on a target are meant to be used in memory which is very easy to do with PowerShell. Two basic methods to execute PowerShell scripts in memory:

Method 1. Use the in-memory dowload and execute:
Use below command to execute a PowerShell script from a remote shell, meterpreter nati, a web shell etc. and the function exported by it. All the scripts in Nishang export a function with same name in the current PowerShell session.

Method 2. Use the -encodedcommand (or -e) parameter of PowerShell
All the scripts in Nishang export a function with same name in the current PowerShell session. Therefore, make sure the function call is made in the script itself while using encodedcommand parameter from a non-PowerShell shell. For abo, add a function call (without quotes) "In -Reverse -IPAddress [IP] -Port [PortNo.]".

Encode the scrript using In from Nishang:

Encoded data written to .\encoded.txt

Encoded command written to .\encodedcommand.txt

From above, use the encoded script from encodedcommand.txt and run it on a target where commands could be executed (a remote shell, meterpreter nati, a web shell etc.). Use it like below:

If the scripts still get detected changing the function and parameter names and removing the help content will help.

In case Windows 10's AMSI is still blocking script execution, see this blog:

#### Scripts
Nishang currently contains the following scripts and payloads.

#### Acti
Set-DCShadowPermissions

Modify AD objects to provide minimal permissions required for DCShadow.

#### Antak - the Webshell
Antak

Execute PowerShell scripts in memory, run commands, and download and upload files using this webshell.

#### Backdoors
HTTP-Backdoor

A backdoor which can recei from third party websites and execute PowerShell scripts in memory.

DNS_TXT_Pwnage

A backdoor which can recei and PowerShell scripts from DNS TXT queries, execute them on a target, and be remotely controlled using the queries.

Execute-OnTime

A backdoor which can execute PowerShell scripts at a given time on a target.

Gupt-Backdoor

A backdoor which can recei and scripts from a WLAN SSID without connecting to it.

Add-ScrnSa

A backdoor which can use Windows screen saver for remote command and script execution.

In

A backdoor which can use alternate data streams and Windows Registry to achie.

Add-RegBackdoor

A backdoor which uses well known Debugger trick to execute payload with Sticky keys and Utilman (Windows key + U).

Set-RemoteWMI

Modify permissions of DCOM and WMI namespaces to allow access to a non-admin user.

Set-RemotePSRemoting

Modify permissions of PowerShell remoting to allow access to a non-admin user.

#### Bypass
In

Implementation of publicly known methods to bypass/avoid AMSI.

#### Client
Out-CHM

Create infected CHM files which can execute PowerShell commands and scripts.

Out-Word

Create Word files and infect existing ones to run PowerShell commands and scripts.

Out-Excel

Create Excel files and infect existing ones to run PowerShell commands and scripts.

Out-HTA

Create a HTA file which can be deployed on a web 服务端 and used in phishing campaigns.

Out-Java

Create signed JAR files which can be used with applets for script and command execution.

Out-Shortcut

Create shortcut files capable of executing PowerShell commands and scripts.

Out-WebQuery

Create IQY files for phishing credentials and SMB hashes.

Out-JS

Create JS files capable of executing PowerShell commands and scripts.

Out-SCT

Create SCT files capable of executing PowerShell commands and scripts.

Out-SCF

Create a SCF file which can be used for capturing NTLM hash challenges.

#### Escalation
Enable-DuplicateToken

When SYSTEM pri are required.

Remo

Introduce by removing patches.

In

Bypass UAC.

#### Execution
Download-Execute-PS

Download and execute a PowerShell script in memory.

Download_Execute

Download an executable in text format, convert it to an executable, and execute.

Execute-Command-MSSQL

Run PowerShell commands, nati, or SQL commands on a MSSQL 服务端 with sufficient pri.

Execute-DNSTXT-Code

Execute shellcode in memory using DNS TXT queries.

Out-RundllCommand

Execute PowerShell commands and scripts or a reverse PowerShell session using rundll32.exe.

#### Gather
Check-VM

Check for a machine.

Copy-VSS

Copy the SAM file using Shadow Copy Service.

In

Trick a user into giving credentials in plain text.

FireBuster
FireListener

A pair of scripts for egress testing

Get-Information

Get juicy information from a target.

Get-LSASecret

Get LSA Secret from a target.

Get-PassHashes

Get password hashes from a target.

Get-WLAN-Keys

Get WLAN keys in plain text from a target.

Keylogger

Log keystrokes from a target.

Ingrade

Dump user passwords in plain on Windows 8.1 and 服务端 2012

Get-PassHints

Get password hints of Windows users from a target.

Show-TargetScreen

Connect back and Stream target screen using MJPEG.

In

Load mimikatz in memory. Updated and with some customisation.

In

Extract juicy information from target process (like browsers) memory using regex.

In

Exfiltrate information like user credentials, using WLAN SSID.

In

Identify admin jump-boxes and/or computers used to access Unix machines.

#### MITM
In

A local HTTPS proxy for MITM attacks.

#### Pivot
Create-MultipleSessions

Check credentials on multiple computers and create PSSessions.

Run-EXEonRemote
Copy and execute an executable on multiple machines.

In
Create 网络 relays between computers.

#### Prasadhak
Prasadhak

Check running hashes of running process against the 数据库.

#### Scan
Brute-Force

Brute force FTP, Acti, MSSQL, and Sharepoint.

Port-Scan

A handy port scanner.

#### Powerpreter
Powerpreter

All the functionality of nishang in a single script module.

#### Shells
In

Send commands and scripts to specifed Gmail account to be executed by In

In

Execute commands and scripts sent by In.

In

An interacti reverse connect or bind shell

Ine

Stripped down of In. Also contains, a skeleton which could fit in two tweets.

IneBind

Bind of Ine.

In

An interacti reverse connect or bind shell over UDP

Ine

Stripped down of In.

In

Reverse interacti o.

In

Reverse interacti over HTTP.

Remo

Clean the system after using In

In

Interacti using WMI.

In

An interacti reverse shell over ICMP.

In

An interacti reverse shell over HTTP using rundll32.exe.

In

An interacti reverse shell over HTTP using regsvr32.exe.

#### Utility
Add-Exfiltration

Add data exfiltration capability to Gmail, Pastebin, a web 服务端, and DNS to any script.

Add-Persistence

Add reboot persistence capability to a script.

Remo

Remote persistence added by the Add-Persistence script.

Do-Exfiltration

Pipe (|) this to any script to exfiltrate the output.

Download

Transfer a file to the target.

Parse_Keys

Parse keys logged by the keylogger.

In

Encode and compress a script or string.

In

Decode and decompress a script or string from In.

Start-CaptureServer

Run a web ser logs Basic authentication and SMB hashes.

Con

Encode a string to ROT13 or decode a ROT13 string.

Out-DnsTxt

Generate DNS TXT records which could be used with other scripts.

[Base64ToString]

[StringToBase64]

[ExetoText]

[TexttoExe]

Updates

Updates about Nishang can be found at my blog and my Twitter feed .

Bugs, Feedback and Feature Requests

Please raise an issue if you encounter a bug or have a feature request. You can email me at nikhil [dot] uitrgpv at gmail.com

#### Mailing List
For feedback, discussions, and feature requests, join:

#### Contributing
I am always looking for contributors to Nishang. Please submit requests or drop me an email.

#### Blog Posts

Some helpful blog posts to check out for beginners:

All posts about Nishang:

项目信息

开发语言：PowerShell

Star 数：10131

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Nishang - Offensive PowerShell for red team, penetration testing and offensive security. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。