DEV: list powershell profiles

[p0w3rsh3ll]

Steps to reproduce

$profile | fl -Force

Expected behavior

List the following if these files exist using a new category named PSProfiles

AllUsersAllHosts       : C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1
AllUsersCurrentHost    : C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1
CurrentUserAllHosts    : C:\Users\local-user\Documents\WindowsPowerShell\profile.ps1
CurrentUserCurrentHost : C:\Users\local-user\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Actual behavior

They are not considered as a persistence mechanism...

Environment data

> $PSVersionTable
Name                           Value
----                           -----
PSVersion                      5.1.16299.248
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.16299.248
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[p0w3rsh3ll]

It may not be exhaustive because it depends on the host. It's currently better than nothing.

[p0w3rsh3ll]

http://www.exploit-monday.com/2015/11/investigating-subversive-powershell.html