explaingit

powershellmafia/powersploit

12,982PowerShellAudience · ops devopsComplexity · 3/5LicenseSetup · moderate

TLDR

PowerSploit is an archived collection of PowerShell scripts for penetration testers covering code execution, Active Directory reconnaissance, credential extraction, privilege escalation, and persistence on Windows systems.

Mindmap

mindmap
  root((powersploit))
    Modules
      CodeExecution
      Recon
      Exfiltration
    Recon Tools
      PowerView
      AD enumeration
    Privilege Escalation
      PowerUp
      Config checks
    Persistence
      Auto-run scripts
      Reboot survival
Click or tap to explore — scroll the page freely

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Things people build with this

USE CASE 1

Enumerate Active Directory users, groups, and permissions during an authorized penetration test using PowerView.

USE CASE 2

Check a Windows machine for common privilege escalation misconfigurations using the PowerUp tool.

USE CASE 3

Identify which bytes of a file trigger antivirus detection during authorized security research.

USE CASE 4

Simulate attacker persistence by adding a scheduled auto-run mechanism in an authorized security assessment.

Tech stack

PowerShell

Getting it running

Difficulty · moderate Time to first run · 30min

Drop the folder into a PowerShell module directory and import with Import-Module, PowerShell execution policy may need adjustment on the target system.

BSD 3-Clause license, use freely including commercially, keep the copyright notice, and do not use the project name for endorsement.

In plain English

PowerSploit is a collection of PowerShell scripts designed for use during penetration tests, which are authorized security assessments where professionals attempt to find weaknesses in a system before attackers do. The README notes that the project is no longer actively supported or maintained. The collection is organized into modules that correspond to different phases of a security assessment. The CodeExecution module contains tools for running code on a target machine in various ways, including loading software into memory without writing it to disk. The Recon module provides tools for scanning networks, looking up DNS records, and mapping out Windows domain environments. PowerView, included in the Recon module, is a set of functions for gathering information about Active Directory domains, which are the directory systems organizations use to manage computers, users, and permissions. The Exfiltration module contains tools for extracting sensitive information from a compromised machine. This includes capturing keystrokes, taking periodic screenshots, recording microphone audio, and pulling stored passwords from various sources such as Windows credential vaults and Group Policy files. The Persistence module offers ways to make scripts run automatically when a system reboots, which is a technique used during authorized tests to simulate how a real attacker might maintain access. The AntivirusBypass module includes a tool for locating the specific bytes in a file that antivirus software uses to flag it as malicious, which helps security researchers understand detection signatures. The Privesc module, primarily through a sub-tool called PowerUp, checks for common configuration weaknesses that could allow a user to gain higher levels of access than they should have. To use PowerSploit, you drop the folder into a PowerShell module directory and import it with a standard PowerShell command. The project is licensed under the BSD 3-Clause license.

Copy-paste prompts

Prompt 1
Using PowerSploit's PowerView, how do I enumerate all user accounts and their group memberships in an Active Directory domain?
Prompt 2
Show me how to use PowerUp from PowerSploit to check a Windows machine for privilege escalation vulnerabilities during an authorized pentest.
Prompt 3
How do I import PowerSploit modules in PowerShell and run the Recon module to map out a target network?
Prompt 4
Using PowerSploit, how does a penetration tester identify which antivirus signatures are flagging a specific file?
Open on GitHub → Explain another repo

← powershellmafia on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.