gci / Get-ChildItem — PowerShell File Enumeration
What is gci?
gci is the default alias for Get-ChildItem — PowerShell’s ls / dir. Lists files, directories, registry keys, and certificates in a path.
OSCP use: Hunt configs, scripts, and creds;
-Forceshows hidden and system files;-Recursewalks entire trees (likedir /sbut more flexible).
Works in: PowerShell, evil-winrm, WinRM, RDP.
Syntax
Get-ChildItem [[-Path] <path>] [options]
gci [[-Path] <path>] [options]
# Path is positional — these are equivalent:
gci C:\Users
gci -Path C:\Users
ls C:\Users
dir C:\Users📌 1) Essential Parameters
| Parameter | Alias | Description |
|---|---|---|
-Path | none | Path to container (default: current location) |
-Force | none | Include hidden, system, and read-only items |
-Recurse | -r | Recurse subdirectories |
-Depth | none | Recursion depth (PS 5+) — -Depth 3 |
-Filter | none | Wildcard filter — -Filter *.txt |
-Include | none | Include pattern (needs -Recurse or trailing *) |
-Exclude | none | Exclude pattern |
-File | none | Files only (no directories) |
-Directory | none | Directories only |
-Hidden | none | Hidden items only |
-System | none | System items only |
-ReadOnly | none | Read-only items only |
-Name | none | Return names only (strings) |
-LiteralPath | none | Exact path (no wildcard expansion) |
-Attributes | none | Filter by attributes bitmask |
-ErrorAction | -ea | SilentlyContinue suppresses access errors |
📌 2) -Force — Hidden & System Files
Without -Force, PowerShell hides hidden and system files (like default dir).
# Normal — misses hidden
gci C:\Users\Public
# Show hidden + system
gci C:\Users\Public -Force
gci -Force C:\Users\Administrator\Desktop
gci -Force -Hidden C:\ # Hidden onlyOSCP targets with -Force:
gci -Force C:\Users\*\Desktop
gci -Force C:\Users\*\Documents
gci -Force "C:\ProgramData"
gci -Force C:\Windows\Temp
gci -Force -Recurse C:\inetpub\wwwroot -Include *.config,*.xml,web.config -ErrorAction SilentlyContinueCompare CMD:
dir /a C:\Users\Public REM /a = all attributes
dir /a:h /s /b C:\*.txt REM hidden recursively📌 3) Recursion & Filters
# All .txt under C:\ (slow — narrow path when possible)
gci C:\ -Recurse -Filter *.txt -ErrorAction SilentlyContinue
# Include multiple extensions (trailing * on path required)
gci C:\Users\* -Recurse -Include *.config,*.xml,*.ini,*.ps1,*.bat,*.kdbx -ErrorAction SilentlyContinue
# Depth-limited (faster)
gci C:\Users -Recurse -Depth 2 -Force
# Files only, no directories
gci C:\Temp -File -Force
# Directories only
gci C:\ -Directory -Force📌 4) Select Properties & Sort
gci C:\Windows\System32 -Force | Select-Object Name, Length, LastWriteTime
gci C:\ -Recurse -Include *.exe -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object FullName, Length -First 20
gci -Force | Format-Table Name, Mode, LastWriteTime -AutoSize
gci -Force | Format-List *| Property | Use |
|---|---|
FullName | Full path for piping |
Length | File size |
LastWriteTime | Recently modified |
Mode | -a-h-s- attribute string |
Attributes | Hidden, System, ReadOnly flags |
📌 5) Cred / Keyword Hunting
# Search file contents for passwords (PowerShell 3+)
gci C:\ -Recurse -Include *.txt,*.ini,*.config,*.xml,*.ps1 -ErrorAction SilentlyContinue |
Select-String -Pattern "password","passw","cred","connectionString" -ErrorAction SilentlyContinue
# Unattend / install files
gci -Path C:\Windows\Panther,C:\Windows\System32\Sysprep -Recurse -Force -Include *.xml,*.ini -ErrorAction SilentlyContinue
# User home sweep
gci C:\Users\* -Recurse -Force -Include *.kdbx,*.txt,*.rdp,*.config -Depth 4 -ErrorAction SilentlyContinueSee evil-winrm, Windows PrivEsc.
📌 6) Other Providers (Advanced)
Get-ChildItem works on other PSDrives:
gci HKLM:\Software -ErrorAction SilentlyContinue
gci Cert:\LocalMachine\My
gci Env:
gci Alias:Registry enum for autologon / stored creds — pair with reg query.
📌 7) gci vs CMD vs Other Aliases
| Alias | Cmdlet | Notes |
|---|---|---|
gci | Get-ChildItem | Most common |
ls | Get-ChildItem | Unix habit |
dir | Get-ChildItem | CMD habit |
where.exe | — | Different — find exe in PATH (CMD) |
dir /s /b | — | CMD recursive bare paths |
# Bare paths (like dir /s /b)
gci C:\Users -Recurse -Force -File | Select-Object -ExpandProperty FullName📌 8) Common -ErrorAction Patterns
Long recursive searches hit access denied constantly:
gci C:\ -Recurse -Force -ErrorAction SilentlyContinue
# Shorthand:
gci C:\ -Recurse -Force -ea 0📌 9) OSCP Workflow
whoami /all
gci -Force
gci C:\Users -Force
gci C:\Users\*\Desktop -Force -Recurse -ErrorAction SilentlyContinue
gci C:\inetpub -Recurse -Force -Include web.config,*.config -ErrorAction SilentlyContinue
gci C:\ -Recurse -Include *.config,*.xml,*.ini -ErrorAction SilentlyContinue | Select-String -Pattern "password" -ErrorAction SilentlyContinue📌 Quick Cheat Sheet
gci -Force # Current dir, show hidden
gci C:\Users\Public -Force -Recurse
gci C:\ -Recurse -Filter *.config -ea 0
gci C:\Users\* -Recurse -Include *.txt,*.xml,*.ps1 -Force -ea 0 | Select-String "password"
gci -Path C:\Windows\Panther -Recurse -Force -Include *.xml
gci C:\ -Recurse -File -Depth 3 -Force | Sort-Object LastWriteTime -Descending | Select FullName -First 30