A collection of powershell tools
Deobfuscation
- ohjeongwook/PowerShellRunBox - Dynamic PowerShell analysis framework - 调试器，有点用
- R3MRUM/PSDecode - PowerShell script for deobfuscating encoded PowerShell scripts
- danielbohannon/Revoke-Obfuscation - PowerShell Obfuscation Detection Framework
- R3MRUM/PSDecode - PowerShell script for deobfuscating encoded PowerShell scripts
- JohnLaTwC/PyPowerShellXray - Python script to decode common encoded PowerShell scripts
- Analysis tools
Post exploitation
- MScholtes/PS2EXE - Module to compile powershell scripts to executables
- homjxi0e/PowerAvails - PowerAvails Powershell .NET System Operating
- Cn33liz/p0wnedShell - PowerShell Runspace Post Exploitation Toolkit
- fridgehead/Powershell-SSHTools - A bunch of useful SSH tools for powershell
- samratashok/nishang - Offensive PowerShell for red team, penetration testing and offensive security
- besimorhino/Pause-Process - PowerShell script which allows pausing/unpausing Win32/64 exes
- giuliano108/SeBackupPrivilege - Use SE_BACKUP_NAME/SeBackupPrivilege to access objects you shouldn't have access to - DLL 实现的，得导入
Misc scripts collections
- xorrior/RandomPS-Scripts
- FuzzySecurity/PowerShell-Suite
- Mr-Un1k0d3r/RedTeamPowershellScripts
- SadProcessor/SomeStuff
- HarmJ0y/Misc-PowerShell
- NetSPI/PowerShell
- tobor88/PowerShell-Red-Team - Collection of PowerShell functions a Red Teamer may use to collect data from a machine
Uncategorized
- S3cur3Th1sSh1t/Invoke-SharpLoader - Load encrypted and compressed C# Code from a remote Webserver or from a local file straight to memory and execute it there
- Flangvik/AMSI.fail - C# Azure Function with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process
- jcwalker/WiFiProfileManagement - Module used for management of wireless profiles - 能获取wifi明文密码，不依赖netsh
- mikemaccana/powershell-profile - Mike's Powershell Profile (and how to set up Windows console if you've been using nix for 20 years)
- FuzzySecurity/PSKernel-Primitives - Exploit primitives for PowerShell
- mattifestation/PowerShellArsenal - A PowerShell Module Dedicated to Reverse Engineering
- p3nt4/Invoke-TmpDavFS - In Memory Powershell WebDav Server
- rvrsh3ll/Misc-Powershell-Scripts
- Parses signature data from the db and dbx UEFI variables
- gist: Checks the %USERPROFILE% directory for any file with library-ms extension and extract the CLSID. In particular, the element with shell command
- felixweyne/ProcessSpawnControl - a Powershell tool which aims to help in the behavioral (process) analysis of malware. PsC suspends newly launched processes, and gives the analyst the option to either keep the process suspended, or to resume it
- tyranid/DotNetInteropDemos - A set of demos and a PowerShell module to interact with DotNetInterop