Practical PowerShell Programming for Professional People - DerbyCon 4

Practical PowerShell Programming for Professional People Ben Ten (@Ben0xA) Slides: http://www.slideshare.net/BenTen0xA DerbyCon 2014

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) About Me Ben Ten (0xA) @Ben0xA - twitter Chicago - #burbsec Vice President Security Officer Developer PoshSec Framework Developer / Creator Gamer Geek

SecurityFail Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Overview ●Languages and Development ●PowerShell Scripting ●Resources ●Q&A ●PSA: This is mostly live code scripting in PowerShell. Please code along with me!

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Overview Feel free to interrupt and ask questions!

Languages and Development Before we begin, a bit of a primer! Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) ●Styles of Coding ●Syntax ●Getting Help ●Starting Out

Languages and Development Styles of Coding/Scripting/Development Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) ●Novice ●Avid Scripter ●Full Time Developer ●Code Monkey

Languages and Development Syntax syn•tax (sĭnˈtăksˌ) – the rules that govern how a script, or program, is developed in a given language. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Languages and Development Syntax White Space, parens (), commas, periods, quotes (“ vs '), tabs, braces [], curly brackets {}, colons :, semi-colons ;, all play an integral part in the syntax of a language! Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Languages and Development Getting Help! RTF Manual/Docs/Reference Often times, the documentation will have an answer for what you are trying to accomplish. *NOT ALWAYS THOUGH* Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Languages and Development Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Getting Help! Interactive Help ● ? ●F1 ●Intellisense (Ctrl+Space) ●Get-Help

Languages and Development Getting Help! Search Engines FTW! Google is not the end all in searches. For Development I prefer DuckDuckGo! https://duckduckgo.com Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Languages and Development Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Languages and Development @JimmyVo – DuckDuckVo! Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Overview PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and associated scripting language built on the .NET Framework. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Overview PowerShell was designed by : ● Jeffrey Snover (@jsnover) ●Bruce Payette (@BrucePayette) ● James Truher Initial release was November 14, 2006 Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Overview PowerShell is a part of the Windows Management Framework. WMF 5.0 was released on April 3, 2014. For today's scripting we will be using WMF 3.0. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) You will need: ●Windows Management Framework 3.0 ●Microsoft .NET Framework 4.5 ●Text Editor (your choice) ●Sublime Text http://www.sublimetext.com/ ●Komodo Edit http://komodoide.com/komodo-edit/ ●PowerShell ISE (comes with WMF)

PowerShell File Name Extensions .ps1 – Script Files .psm1 – Script Module Files .psd1 – Script Manifest Files .ps1xml – Formatting and Type Files .dll - Cmdlet and Provider Assemblies Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Cmdlets, Functions, and Scripts Oh My! From a functional standpoint, cmdlets, functions, and scripts are practically the same. They are a way to call a specific block of code. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Cmdlet: Written in a compiled .NET language. Easier to deploy. Help files are easier to write. Has support for parameter validation. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Function: Written in a PowerShell language. Has to be deployed with a library. Help is written inside the function. Parameter validation has to be done in the function itself. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Script: Written in a PowerShell language. Is invoked by calling the .ps1 file. Deployed by itself or in a manifest file. Can contain functions. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Set-ExecutionPolicy Before you can run your custom scripts you have to set the ExecutionPolicy to RemoteSigned. In PowerShell type: Set-ExecutionPolicy RemoteSigned Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

PowerShell HelloWorld.ps1 Enough of the primer! Let's get coding! This is where you code along with me if you can! Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

HelloWorld.ps1 Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

HelloWorld.ps1 Variable(s): a symbolic name associated with a value and whose associated value may be changed. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

HelloWorld.ps1 Hard-Coded: Typing the value directly into your script. Our “Hello World” text was hard-coded. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

HelloWorld.ps1 PowerShell Variables: A PowerShell variable is defined with the dollar sign $ followed by the name of the variable. For example: $message is a variable. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

HelloWorld.ps1 PowerShell Variables: Let's rewrite our HelloWorld.ps1 to use a variable $message with our text “Hello World”. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

HelloWorld.ps1 Quotes! Single vs Double Double Quotes (“) will attempt to resolve any variables before anything is printed to the screen. Single Quotes (') will print exactly what is typed between the quotes. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

HelloWorld.ps1 Backtick ` The backtick, or grave accent, is a special escape character. This means that you want the next character to be printed and not interpreted in anyway. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Getting Input Write-Output is great. But how do you get information from a user? Read-Host Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Getting Input Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Conditional Logic A Condition is: a feature of a programming language which perform a different set of computations or actions depending on whether a programmer-specified boolean condition evaluates to true or false. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Conditional Logic A Condition is: Is the stop light is green? Keep going. Is the stop light is red? Stop. Is the stop light is yellow? Floor it!!!! Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Conditional Logic A Condition expressed: ● If - Beginning of the condition. ●Else - Evaluates only if preceding condition(s) is(are) false. ●ElseIf – Evaluates if preceding condition(s) is(are) false with a new condition. ●Switch – Multiple conditions for a single variable or object. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Conditional Logic A Conditional Operator: -and = both conditions must be true. -or = only one of the conditions must be true. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Conditional Logic Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) A Conditional Operator: -eq = Equals -lt = Less Than -gt = Greater Than -ne = Not Equal -ge = Great Than or Equal -le = Less Than or Equal

Conditional Logic Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) A Conditional Operator: -Like -NotLike -Match -NotMatch -Contains -NotContains -In -NotIn -Replace

Conditional Logic Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Conditional Logic Operator Precedence: When operators have equal precedence, Windows PowerShell evaluates them from left to right. The exceptions are the assignment operators, the cast operators, and the negation operators (!, -not, -bnot), which are evaluated from right to left. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Conditional Logic Operator Precedence: You can use enclosures, such as parentheses, to override the standard precedence order and force Windows PowerShell to evaluate the enclosed part of an expression before an unenclosed part. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Parameters A Parameter is: A variable that allows you to pass an object to a Cmdlet, Function, or Script. Get-ChildItem Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Parameters Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Parameters Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Get-Help Get-ChildItem Get-ChildItem [[-Path] <String[]>] [[-Filter] <String>] [-Exclude <String[]> [-Name] [-Recurse] [-UseTransaction [<SwitchParameter>]] [<CommonParameters> Get-ChildItem [[-Filter] <String>] [-Exclude <String[]>] [-Force] [-Include -LiteralPath <String[]> [-UseTransaction [<SwitchParameter>]] [<CommonParame Get-ChildItem [-Attributes <FileAttributes]>] [-Directory] [-File] [-Force] [-UseTransaction] [<CommonParameters>]

Objects vs Text PowerShell is Object Based. Even if you see text on the screen, that text is actually a “String” object. You can access the members of the object using the . operator after the variable name. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Objects vs Text Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Piping Piping is: a way of moving something, unchanged, from one place to another.

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Piping Piping is represented by the | (pipe) character. A pipe takes the object from the left side and passes it to the right side. Note: When passing to another cmdlet, $_ is used to reference the passed object.

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Piping

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Loops Loops: A way to perform the same block of code for a specific number of times, until a specific condition is met, or while a specific condition exists.

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Loops Loops: ●ForEach ●ForEach-Object ●For ●While ●Do While ●Do Until

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Loops

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Comments Comments are defined by the # symbol. Block comments are enclosed with <# and #>. .SYNOPSIS .DESCRIPTION .PARAMETER .EXAMPLE

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Comments

Putting it all Together The final program! Requirements: ●Search all files. ●Find the ones that were modified in a specific date range. ●Create a list of those files and display them. Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Pitfalls Don't overuse the Pipe! Not everything has to be done in a single line. It's more important that you understand the code before you try to condense it to a single line.

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Pitfalls With Loops, start small then open the valve all the way! You can get more than you wanted, or get stuck in an endless loop. Especially true when doing File operations!

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Resources Freenode (irc.freenode.net) #PowerShell, #pssec, #poshsec channels. Learn Windows PowerShell in a Month of Lunches ~ Don Jones Carlos Perez – PowerShell Workshop at DerbyCon.

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Resources PoshSec – https://github.com/PoshSec PoshSec Framework PowerSploit – https://github.com/mattifestation/ Posh-SecMod – https://github.com/DarkOperator/

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Resources http://www.slideshare.net/BenTen0xA/ practical-powershell-programming-for-professional- people

Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) Thanks! @securitymoey @jaysonstreet @DerbyCon @tonikjdk @darkoperator @mattifestation @obscuresec @harmj0y

Contact - Q&A Ben Ten (0xA) @Ben0xA - twitter http://ben0xa.com https://poshsec.org web@ben0xa.com Ben0xA – LinkedIn, Github, keybase, etc. irc.freenode.net #burbsec, #poshsec, #pssec http://www.slideshare.net/BenTen0xA Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA) QUESTIONS?!

Thank You! Practical Powe rShell Programming for Professional People DerbyCon - Ben Ten (@Ben0xA)

Practical PowerShell Programming for Professional People - DerbyCon 4

More Related Content

What's hot

Viewers also liked

Similar to Practical PowerShell Programming for Professional People - DerbyCon 4

Recently uploaded

Practical PowerShell Programming for Professional People - DerbyCon 4