Windows PowerShell [02] Output & File Operations

hello everybody my name is John Hammond and welcome back from the YouTube video and man it's been a while it's been a while since I posted a video it's been a while since I posted a PowerShell video and I have heard you I've read your letters you haven't sent me any letters but I've read the comments and I know you guys were really wanting this so hopefully I'll be back at it back on the saddle and here we go this is PowerShell video number two so we are gonna talk about output and some file system operations so without further ado let's get to it we know how to open up PowerShell you can simply open up your little start button there and search PowerShell it'll fire right up for you so here we are at our prompt we know the command let's now get child item and that will display the current directory listing or what's in our current directory and we know that's from our prompt visible where we are currently if we were to move with anything within that we are using an relative path if we use a period forward slash and anything that needs an absolute path includes the entire file structure.c colon backslash or we are firming the route of what we're working with so simple recap right that was the get child item command lift we know that that is aliased as something that powershell lets us do with the LS kind of alias here and we've seen dir so LS if you're more linux kind oriented dir for more old-school windows cmd.exe some dos days and that's our output nice and easy super small we've done that before now we do want to learn how we're actually gonna interact with the file system how we can do those copy file move file those regular things you would do in a GUI or in the file browser and Explorer so let's dive into that but before we do I want to chime in how we can actually output some of this output in a different way the things that PowerShell lets us do so let's get started with that I will get child item again and we know through the pipeline that vertical bar just kind of the shift form on the back slash in your keyboard above the enter key that will allow you to transfer some of the c-sharp dotnet objects that we've seen as the resultant of that previous command into something else something new so I want to show you this kind of family of commandlets format - and then whatever you want to format that output in so it's pretty simple it's pretty easy if you're to type format - and I just figured this out I don't know if this is maybe my updated version of Windows - the powershell version i'm on right now but if you hit ctrl spacebar it'll show you some of the options or the things that you can actually use it'll help autocomplete what you're trying to work with it'll even show you a little bit of the help information what parameters or arguments you want to pass to it what you can pass to it and you can use your arrow keys to just kind of move around and navigate this little quick on-the-fly help system inside a powershell so by default the output that for that power show will give you is format tables so if I were to pipe this to form a table you see the exact same results we had earlier that's kind of boring in lame you can change I think how you actually have PowerShell default to show you information but the other options that we have are format wide and that will showcase some of the output and just kind of a tabulated way but now if the actual kind of headers the rows and columns there you can see it's just giving us the name of the entry not any of the other properties that we might like but if we wanted to see a lot more of the properties one cool thing we could use is format list and you can see that here of the other arguments that it might take maybe zooming in a specific property but format list works well for us because it will return each entry each object that kind of our command lit finds for us and give us a little bit more of the properties you can see link type and target and maybe we didn't see that by default when we ran get child item yeah we didn't see the target and even it had a last write time kind of by default this will show us last access time in creation time and maybe some other interesting information this is a neat trick that I really want to show you because with format list you can actually get more properties that you may not have even known that that object might carry with it let me show you this if you run get child item with format - list and then add an asterisk at the end suddenly you get a ton of information for those objects the attributes that might come with it I guess a parent directory a base name everything that might be relative and pertinent to that object this is just kind of specific to this file system that we're looking at right now you can see that PS provider what we're really looking at but if we were to scroll through that we can see there's a lot of stuff that maybe you hadn't seen before so that's a good way to kind of track down some properties maybe you hadn't seen before if you want to do a quick shorthand way to do that get child items the alias for format list is just FL and then FL star here's all of the cool things you can do you can assume format wide is FW and that does that just as well and remember if you don't know any of these aliases you can check out get alias and that will return all the information for you funny thing the alias for get alias is gal GL and remember the powershell is case insensitive so it doesn't matter if you were to run get - alias in all caps so whatever the case may be gay al I don't know that's something that you can keep in the back of your mind PowerShell does not care about what semantics you're using case sensitive case insensitive doesn't matter caps or lower case so because we can use get alias and we can track down some of these maybe commands that you might use in another language other language is not the right word but if you're on another operating system you're kind of used to that old-school CMB dot exe style or the Linux style LS dir maybe some of those file system commands that you're used to or anything that you would just normally type in out of habit like echo like echo literally just lets display some output on the screen echo the classic right we've just done that but what did echo come from you can gal echo just as an argument and you can see that that is alias to write output so if we were to simply write output it has the exact same effect because it's simply an alias kind of a recap on what we talked about in the last video but it helps me segue into a new topic and conversation because output is something that you can control in the way that you're using and interacting with PowerShell right now we're working with PowerShell in just the console PowerShell dot exe or this program that we have open in the command line but how PowerShell is ran or invoked its host environment might differ we might get into PowerShell ISE as we will in later videos or maybe it's running in a web browser because you've done it with some DLL magic output will allow us to kind of change up what we're working with and how we can see things so let me actually dive into that if we were working with our LS output or our Python purist away let's run get child item we can pipe that two out and out is what we can use to kind of modify this and I'll use that control spacebar to get some kind of suggested Auto completions for us we could out host just as we've seen before regular default output but it comes with some other things we can output if you want to get it as just a string now we're not seeing the C sharp object anymore but we're actually having them converted to a string we'll just regular kind of double quotes as you would expect in any other programming language or more of a text-based console standard output standard input kind of the Linux way or this has other great stuff to us out know that's kind of like redirecting to /dev forward slash null or kind of squelching the output so you don't get to see it that's might that might be handy for you later down the road additionally we have out file so we've seen before and maybe some old-school dos days or CMB XE you can use the greater than symbol or the kind of redirection here let's call this directory dot txt right now if I were to check that out we've created a file directory dot txt and we just read a racket that output or the commandlets kind of results here let's actually check out the information or the content inside of that directory dot txt I'll tap complete here and there is our output interest enough though it's toward it when directory had no value to that's kind of a little funny Easter Egg you can see the length of that file is zero at the time of getting reading the file but if you actually check out on the file system it's filled with the contents of that file so interesting thing maybe maybe you'll get a kick out of that I did anyway so that's using the regular old school redirection powershell lets you do that just as easily with piping it - out - file and you will of course need to supply a parameter write that path following it so let's call it again directory dot txt check out what we're working with and it's the exact same file size it's the exact same file so we can open it up in notepad directory dot txt and you'll notice we have still the headers and everything that we would have expected in a regular powershell output because it's format table if we wanted to see format list or format wide we could use just that or select to move kind of our properties out as needed that those are other things you could do with it but those are the ways you can format your results in powershell and how you can output to some of them before I kind of close off on that I do want to show you out grid view because you guys might like this that might come in handy this will give you kind of a quick GUI interface where you can actually scroll through some of the things that you're working with click on them and do interesting things with them or if you had a ton of results that were just taking up a lot of space you have a little filter up here where you can search for things like okay I only want the entries that contain the letter O or whatever the case may be or a or anything that you might like you can especially add criteria for some of these properties and you can verify whether or not they contain something or do not contain or start with or equal something and that will help you kind of narrow down your results if you have a huge data set but you're working with so that's out grid view I think that's kind of handy okay we talked about right host we talked about how we can help put into a file or a grid view or any of those other out solutions and formatting them in a different way now let's work with that directory dot txt file that we've created so if you are again more linux minded kind of like myself you're used to the move command MV powershell calls that move item and if you didn't know that again because you're used to that kind of structure and syntax you could just check out that alias gal MV and you'll see it tells you that is in fact move item same thing with CP 2 copy right check out the alias for CP that command is copy item so if we wanted to kind of move this item of the directory dot txt we can bring it into our desktop I'm just simply running that command has the effect if I were to minimize you can see my directory dot text is just there get PowerShell back open run LS or our get child item you can see obviously it's not in this director anymore but we'll use our relative path dot forward slash or dot backslash check it out now it's in our desktop because we just move that if we wanted to copy item super simple right let's take a directory and again using a relative path the symbols two periods for the parent directory let's just move it up in the filesystem now if I were to move back I can LS and I have a copy of that directory dot txt right there if I didn't want that file anymore though maybe you're used to the RM command if you're Linux minded or used to the del command if you're a Windows minded you can run remove - item in that PowerShell pure way let's run remove item on directory dot txt and now that's gone we don't have that entry anymore we don't have that file some of these directories that Windows likes have put here kind of by default I think are stupid and I never really use so we could remove some of those if we wanted to and you might be used to rmdir in powershell there is no difference between a directory that we're trying to remove or a file that we're trying to remove it all just calls it an item so we can simply remove item what does that one called savegames let's do that this might ask us hey that actually has some contents inside of that there are files in folders that are inside of that directory or that item that we're working with are you sure you want to remove all of it and you can supply yes or enter why and work with it or any of these other options that PowerShell will give to you if you wanted to figure out how can I just get it to shut up like stop asking me that check out the help for it it'll show you the aliases that we're working with and I'll try and scroll up here one of these options is tap confirm where it says I don't care do it do it all and same thing with attack recurse and tack force if it says like hey we're not able to do this whatever just ignore it we can try some of those out so let's remove item tack confirm hope we still need to work through it okay let's just use recurse instead nope can you some of those I guess I'm not the administrator I'm not able to remove some of the sensitive ini files whatever again that is the command that we're using though remove - item that'll take the place of RM dl and rmdir so those are the commandlets that I wanted to show to you in this video again super simple stuff we're just kind of navigating around the file system we're checking out how we can output and format our information within PowerShell next we'll move on to some of the good stuff we'll get into scripting we're getting two profiles variables execution policy stuff like that but we got to get this beginning stuff out of the way so thank you guys for watching I hope you enjoyed this if you did please do like comment and subscribe there is a discord server that you can hang out and all of us are trying to learn trying to get better just jump in the cyber security scene please do click that link join the discord server it's a great community so many smart people and they're so much smarter than me so I'd like to see you guys in the next video love to see you on patreon I'll see you on PayPal all the other things I'm really bad at outros thanks for watching

Channel: John Hammond

Views: 81,781

Keywords: windows, powershell, microsoft, powershell core, .net framework, c#, object oriented programming, cyber security, computer science, empire, pentesting, blue team, red team, cmdlet, alias, functions, scripting, linux, python, powersploit, powerup, dll, exe, offensive powershell, defensive powershell, server hardening, wmi, remote desktop, registry, john hammond, hammond ctf, cyber, jhdigital, capture the flag, mimikatz, sherlock, watson, windows 10, windows vista, hacking, tutorial, beginners, noobs

Id: vO0P3JuItcM

Length: 15min 19sec (919 seconds)

Published: Wed Nov 20 2019