PowerShell.md

PowerShell.md

PowerShell commandline history

Get-PSReadlineOption | Select-Object -ExpandProperty HistorySavePath | Get-ChildItem | Get-Content

Screenshot

Note: use psinject with Cobalt Strike

function Get-Screenshot {
    [CmdletBinding()]
    Param(
        [string]
        $Path = "$PWD\$(Get-date -Format 'yyyy-MM-dd HH-MM-ss').jpg"
    )
    
    Add-Type -Assembly System.Windows.Forms

    $Width = [System.Windows.Forms.Screen]::PrimaryScreen.WorkingArea.Width
    $Height = [System.Windows.Forms.Screen]::PrimaryScreen.WorkingArea.Height

    <#
    $VideoController = Get-WmiObject -Query 'SELECT VideoModeDescription FROM Win32_VideoController'

    if ($VideoController.VideoModeDescription -and $VideoController.VideoModeDescription -match '(?<ScreenWidth>^\d+) x (?<ScreenHeight>\d+) x .*$') {
        $Width = [Int] $Matches['ScreenWidth']
        $Height = [Int] $Matches['ScreenHeight']
    } else {
        $ScreenBounds = [Windows.Forms.SystemInformation]::VirtualScreen

        $Width = $ScreenBounds.Width
        $Height = $ScreenBounds.Height
    }
    #>

    $Size = New-Object System.Drawing.Size($Width, $Height)
    $Point = New-Object System.Drawing.Point(0, 0)

    #$Codec = [System.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() | Where-Object { $_.FormatDescription -eq 'JPEG'}

    #$Encoder = [System.Drawing.Imaging.Encoder]::Compression
    #$EncoderParams = New-Object System.Drawing.Imaging.EncoderParameters
    #$EncoderParams.Param[0] = New-Object System.Drawing.Imaging.EncoderParameter ($Encoder, [long][System.Drawing.Imaging.EncoderValue]::CompressionLZW);

    $ScreenshotObject = New-Object Drawing.Bitmap $Width, $Height
    $DrawingGraphics = [Drawing.Graphics]::FromImage($ScreenshotObject)
    $DrawingGraphics.CopyFromScreen($Point, [Drawing.Point]::Empty, $Size)
    $DrawingGraphics.Dispose()
    $ScreenshotObject.Save($Path)
    $ScreenshotObject.Dispose()
}