Home

Awesome

NoPowerShell

NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms. This .NET Framework 2 compatible binary can be loaded in Cobalt Strike to execute commands in-memory. No System.Management.Automation.dll is used; only native .NET libraries. An alternative usecase for NoPowerShell is to launch it as a DLL via rundll32.exe in a restricted environment: rundll32 NoPowerShell.dll,main.

This project makes it easy for everyone to extend its functionality using only a few lines of C# code. For more info, see CONTRIBUTING.md.

Latest binaries available from the Releases page. Bleeding edge code available in the DEV branch. To kickstart your NoPowerShell skills, make sure to also check out the cmdlet Cheatsheet.

Screenshots

Running in Cobalt Strike

NoPowerShell supported commands

Sample execution of commands

NoPowerShell sample commands

Rundll32 version

NoPowerShellDll via rundll32

Why NoPowerShell

NoPowerShell is developed to be used with the execute-assembly command of Cobalt Strike or in a restricted environment using rundll32. Reasons to use NoPowerShell:

Usage

Examples

See CHEATSHEET.md.

Use in Cobalt Strike via execute-assembly

Use Cobalt Strike's execute-assembly command to launch the NoPowerShell.exe. For example execute-assembly /path/to/NoPowerShell.exe Get-Command. Optionally NoPowerShell.cna can be used to add the nps alias to Cobalt Strike.

Use in Cobalt Strike via BOF.NET

  1. Install the BOF.NET BOF from https://github.com/CCob/BOF.NET
  2. Load the BOF.NET runtime: bofnet_init
  3. Load the NoPowerShell module: bofnet_load /path/to/NoPowerShell.dll
  4. Execute NoPowerShell cmdlets: bofnet_execute NoPowerShell.Program Get-Command

Use in Cobalt Strike using @williamknows fork of BOF.NET

This fork allows running regular .NET executables

  1. Obtain and compile @williamknows' fork of the BOF.NET from https://github.com/CCob/BOF.NET
  2. Load the BOF.NET runtime: bofnet_init
  3. Load the NoPowerShell module: bofnet_load /path/to/NoPowerShell.exe
  4. Execute NoPowerShell cmdlets: bofnet_executeassembly NoPowerShell Get-Command

Launch via rundll32

  1. Create a new shortcut to NoPowerShell.dll file (drag using right click -> Create shortcuts here)
  2. Update the shortcut prefixing the filename with rundll32 and appending ,main
  3. The shortcut will now look like rundll32 C:\Path\to\NoPowerShell.dll,main
  4. Double click the shortcut

Note

When using NoPowerShell from cmd.exe or PowerShell, you need to escape the pipe character (|) with respectively a caret (^) or a backtick (`), e.g.:

Known issues

Improvements

Requested NoPowerShell cmdlets

CmdletDescription
Invoke-CommandUsing PSRemoting execute a command on a remote machine (which in that case will of course be logged)
Get-ServiceInclude option to also show service paths like in sc qc
*More *-Item* commands
Search-ADAccount
Get-ADPrincipalGroupMembership
Get-ADOrganizationalUnits
*More commands from the ActiveDirectory PowerShell module
*Sysinternals utilities like pipelist and sdelete

Contributed NoPowerShell cmdlets

Authors of additional NoPowerShell cmdlets are added to the table below. Moreover, the table lists commands that are requested by the community to add. Together we can develop a powerful NoPowerShell toolkit!

CmdletContributed byGitHubTwitterDescription

Included NoPowerShell cmdlets

CmdletModuleNotes
Get-ADGroupActiveDirectory
Get-ADGroupMemberActiveDirectory
Get-ADComputerActiveDirectory
Get-ADObjectActiveDirectory
Get-ADUserActiveDirectory
Get-ADTrustActiveDirectory
Get-WinStationAdditional
Get-RemoteSmbShareAdditional
Get-WhoamiAdditionalwhoami.exe /ALL is not implemented yet
Expand-ArchiveArchiveRequires .NET 4.5+
Compress-ArchiveArchiveRequires .NET 4.5+
Where-ObjectCore
Get-HelpCore
Get-CommandCore
Resolve-DnsNameDnsClient
Get-LocalGroupLocalAccounts
Get-LocalGroupMemberLocalAccounts
Get-LocalUserLocalAccounts
Get-ItemPropertyManagement
Invoke-WmiMethodManagement
Remove-ItemManagement
Copy-ItemManagement
Get-ContentManagement
Get-ChildItemManagement
Get-WmiObjectManagement
Get-ProcessManagement
Stop-ProcessManagement
Get-HotFixManagement
Get-PSDriveManagement
Get-ItemPropertyValueManagement
Set-ClipboardManagement
Get-DnsClientCacheManagement
Get-ComputerInfoManagement
Get-ClipboardManagement
Get-NetRouteNetTCPIP
Get-NetIPAddressNetTCPIP
Get-NetNeighborNetTCPIPNo support for IPv6 yet
Test-NetConnectionNetTCPIP
Get-GetNetTCPConnectionNetTCPIP
Get-SmbShareSmbShare
Get-SmbMappingSmbShare
Format-TableUtility
Sort-ObjectUtility
Export-CsvUtility
Format-ListUtility
Select-ObjectUtility
Out-FileUtility
Write-OutputUtility
Invoke-WebRequestUtility
Measure-ObjectUtility

Also make sure to check out the Cheatsheet for examples on how to use these cmdlets.

Acknowledgements

Various NoPowerShell cmdlets and NoPowerShell DLL include code created by other developers.

WhoWebsiteNotes
Contributors of pinvoke.nethttps://www.pinvoke.net/Various cmdlets use snippets from pinvoke
Michael Conradhttps://github.com/MichaCo/Parts of the Resolve-Dns cmdlet are based on the code of the DnsClient.Net project
Rex Loganhttps://stackoverflow.com/a/1148861Most code of the Get-NetNeighbor cmdlet originates from his StackOverflow post
PowerShell developershttps://github.com/PowerShell/Code of NoPowerShell DLL is largely based on the code handling the console input of PowerShell
Benjamin Delpyhttps://github.com/gentilkiwi/Code of Get-WinStation is inspired by the code of Mimikatz' ts::sessions command
Dan Portshttps://github.com/danports/Marshalling code of Get-Winstation is partially copied from the Cassia project
Mazdakhttps://www.codeproject.com/Articles/2937/Getting-local-groups-and-member-names-in-CNative function calls for the Get-LocalGroupMember cmdlet
Rex Loganhttps://stackoverflow.com/a/1148861Code of Get-NetNeighbor cmdlet

Authored by Arris Huijgen (@bitsadmin - https://github.com/bitsadmin/)