Powershell

Help

Get-Command : gets all the cmdlets installed
Get-Help : information about a cmdlet

Get-Command Verb-*
Get-Command *-Noun

General Format:

Verb-Noun
Verbs:
• Get
• Start
• Stop
• Read
• Write
• New
• Out

Show all properties of cmdlet

[cmdlet] | Get-Member
Show Member types of the cmdlet
[cmdlet] | Get-Member -MemberType [member]

Display specific properties
[cmdlet] | Select-Object -Property [property1], [property2]
Flags:
• first - gets the first x object
• last - gets the last x object
• unique - shows the unique objects
• skip - skips x objects

Filtering content

Verb-Noun | Where-Object -Property PropertyName -operator Value
Where -operator is a list of the following operators:
-Contains : if any item in the property value is an exact match for the specified value
-eq : if the property value is the same as the specified value
-gt : if the property value is greater than the specified value

Sorting content :

Sort-Object

Location of file and if file exists

Get-ChildItem -Path C:\ -Filter "[file_name]" -Recurse
put * before and after of file_name if unsure about exact name.
Test-Path -Path "[C:\Path\To\Item]"
File: -PathType leaf
Directory: -PathTye container

Print contents of file

Get-ChildItem -Path "[full_path]"

Hash value

Get-FileHash -Path "[full_path]" -Algorithm [algorithm]

Current working directory

Get-Location

Request a webserver

Invoke-WebRequest -Uri "[website_address]"

Base64 encode and decode

File:
[System.Convert]::ToBase64String([System.IO.File]::ReadAllBytes("[full_path_of_file]"))
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([System.IO.File]::ReadAllText("[full_path_of_file]")))
String:
[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("[string]"))
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("[string]"))

Number of users in a system

Get-LocalUser | Measure-Object

Identify user from known property value

Get-LocalUser -SID "S-1-5-21-1394777289-3961777894-1791813945-501"

Check local groups

Get-LocalGroup | Measure-Object

IP Address info

Get-NetIPAddress

Ports info

Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'}