nopowershell - PowerShell rebuilt in C# for Red Teaming purposes

项目说明

NoPowerShell

NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining in to any PowerShell logging mechanisms. This .NET Framework 2 compatible binary can be loaded in Cobalt Strike to execute commands in-memory. No System.Management.Automation.dll is used; only native .NET libraries. An alternati for NoPowerShell is to launch it as a DLL via rundll32.exe in a restricted en: rundll32 NoPowerShell.dll,main.

This project makes it easy for e to extend its functionality using only a few lines of C# code. For more info, see CONTRIBUTING.md.

Latest binaries a from the Releases page. The MASTER branch is not updated very regularly; the latest code and cmdlets are a in the DEV branch. To kickstart your NoPowerShell skills, make sure to also check out the cmdlet Cheatsheet.

Screenshots

Running in Cobalt Strike

!NoPowerShell supported commands

Sample execution of commands

!NoPowerShell sample commands

Rundll32

!NoPowerShellDll

Why NoPowerShell

NoPowerShell is de to be used with the execute-assembly command of Cobalt Strike or in a restricted en using rundll32.exe.
Reasons to use NoPowerShell:

Executes pretty stealthy

Powerful functionality

Provides the cmdlets you are already familiar with in PowerShell, so no need to learn yet another tool

If you are not yet very familiar with PowerShell, the cmd.exe aliases are a as well (e.g. ping instead of Test-NetConnection)

In case via powerpick or powershell cmdlets are not a, they _are_ a in nps (e.g. cmdlets from the Acti module)

Easily extensible with only a few lines of C#

Usage

Examples

See CHEATSHEET.md.

Use in Cobalt Strike

Use Cobalt Strike's execute-assembly command to launch the NoPowerShell.exe. For example execute-assembly /path/to/NoPowerShell.exe Get-Command.
Optionally NoPowerShell.cna can be used to add the nps alias to Cobalt Strike.

Use in Cobalt Strike via BOF.NET

1. Install the BOF.NET BOF from
2. Load the BOF.NET runtime: bofnet_init
3. Load the NoPowerShell module: bofnet_load /path/to/NoPowerShell.dll
4. Execute NoPowerShell cmdlets: bofnet_execute NoPowerShell.Program Get-Command

Use in Cobalt Strike using fork of BOF.NET

This fork allows running regular .NET executables
1. Obtain and compile ' fork of the BOF.NET from
2. Load the BOF.NET runtime: bofnet_init
3. Load the NoPowerShell module: bofnet_load /path/to/NoPowerShell.exe
4. Execute NoPowerShell cmdlets: bofnet_executeassembly NoPowerShell Get-Command

Launch

1. Create a new shortcut to NoPowerShell.dll file (drag using right click -> Create shortcuts here)
2. Update the shortcut prefixing the filename with rundll32 and appending ,main
3. The shortcut will now look like rundll32 C:\Path\to\NoPowerShell.dll,main
4. Double click the shortcut

Note

When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe character (|) with respectively a caret (^) or a backtick (` `), e.g.:

cmd.exe: ls ^| select Name

PowerShell:

Known issues

Pipeline characters need to be surrounded by spaces

TLS 1.1+ is not supported by .NET Framework 2, so any site enforcing it will result in a connection error

Impro

Fix abo

Support for parameter groups

Add support for .NET code in commandline, e.g.: [System.Security.Principal.WindowsIdentity]::GetCurrent().Name

Requested NoPowerShell cmdlets


| Cmdlet | Description |
| - | - |
| In | Using PSRemoting execute a command on a remote machine (which in that case will of course be logged) |
| * | More \*-Item\* commands |
| Search-ADAccount | |
| Get-ADPrincipalGroupMembership | |
| Get-ADOrganizationalUnits | |
| * | More commands from the Acti PowerShell module |
| * | Sysinternals utilities like pipelist and sdelete` |

Contributed NoPowerShell cmdlets

Authors of additional NoPowerShell cmdlets are added to the table below. Moreover, the table lists commands that are requested by the community to add. Together we can develop a powerful NoPowerShell toolkit!

| Cmdlet | Contributed by | GitHub | Twitter | Description |
| - | - | - | - | - |
| | | | | |

Included NoPowerShell cmdlets

| Cmdlet | Module | Notes |
| - | - | - |
| Get-ADUser | Acti | |
| Get-ADObject | Acti | |
| Get-ADReplicationSubnet | Acti | |
| Get-ADGroup | Acti | |
| Get-ADGroupMember | Acti | |
| Get-ADComputer | Acti | |
| Get-ADDomainController | Acti | |
| Get-ADTrust | Acti | |
| Copy-Acl | Additional | |
| Get-RemoteSmbShare | Additional | |
| Resol | Additional | |
| Get-Whoami | Additional | |
| Get-WinStation | Additional | |
| Compress-Archive | Archive | Requires .NET 4.5+ |
| Expand-Archive | Archive | Requires .NET 4.5+ |
| Get-Help | Core | |
| Get-Command | Core | |
| Where-Object | Core | |
| Resol | DnsClient | |
| Get-LocalGroupMember | LocalAccounts | |
| Get-LocalGroup | LocalAccounts | |
| Set-Clipboard | Management | |
| Get-PSDrive | Management | |
| Get-HotFix | Management | |
| Stop-Process | Management | |
| Get-ChildItem | Management | |
| Copy-Item | Management | |
| In | Management | |
| Remo | Management | |
| Get-ItemPropertyValue | Management | |
| Get-ItemProperty | Management | |
| Get-ComputerInfo | Management | |
| Get-DnsClientCache | Management | |
| Get-Process | Management | |
| Get-WmiObject | Management | |
| Get-Clipboard | Management | |
| Get-Content | Management | |
| Test-NetConnection | NetTCPIP | |
| Get-NetTCPConnection | NetTCPIP | |
| Get-NetNeighbor | NetTCPIP | No support for IPv6 yet |
| Get-NetRoute | NetTCPIP | |
| Get-NetIPAddress | NetTCPIP | |
| Get-Service | NoPowerShell.Commands | |
| Get-LocalUser | NoPowerShell.Commands | |
| Get-WinEvent | NoPowerShell.Commands | |
| New-Shortcut | NoPowerShell.Commands | |
| Get-Acl | Security | |
| Get-SmbMapping | SmbShare | |
| Get-SmbShare | SmbShare | |
| In | SQLPS | |
| Get-FileHash | Utility | |
| Con | Utility | |
| Sort-Object | Utility | |
| Measure-Object | Utility | |
| In | Utility | |
| Select-Object | Utility | |
| Out-File | Utility | |
| Format-Table | Utility | |
| Format-List | Utility | |
| Export-Cs | |
| Con | Utility | |
| Write-Output | Utility | |

Also make sure to check out the Cheatsheet for examples on how to use these cmdlets.

Acknowledgements

NoPowerShell cmdlets and NoPowerShell DLL include code created by other de.

| Who | Website | Notes |
| - | - | - |
| Contributors of pinvoke.net | | cmdlets use snippets from pinvoke |
| Michael Conrad | | Parts of the Resol cmdlet are based on the code of the DnsClient.Net project |
| Rex Logan | | Most code of the Get-NetNeighbor cmdlet originates from his StackO post |
| PowerShell de | | Code of NoPowerShell DLL is largely based on the code handling the console input of PowerShell |
| Benjamin Delpy | | Code of Get-WinStation is inspired by the code of Mimikatz' ts::sessions command |
| Dan Ports | | Marshalling code of Get-Winstation is partially copied from the Cassia project |
| Mazdak | | Nati calls for the Get-LocalGroupMember cmdlet |
| Rex Logan | | Code of Get-NetNeighbor cmdlet |

Authored by Arris Huijgen ( - )

项目信息

开发语言：C#

Star 数：1056

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PowerShell rebuilt in C# for Red Teaming purposes展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。