pondělí 27. února 2012
Prepnuti browseru
Možnost čislo jedna ps1
script -noexit,je možny změnit
s tim že by se scriptem
spouštěl powershell s
-windowstyle hidden a na
konec se přidalo stop procesu
powershell.
stop-process -processname
firefox
[diagnostics.process]::start
(”C:\Users\Doma\AppData
\Local\Chromium\Application
\chrome.exe”)
Varianta dvě Powershell ise a
addon menu creator dejme
tomu auložit do profilu nebo
v addon menu a prepinat
napsanim prepni nebo
nadefinovanou zkratkou
uloženou v addon menu
creator powershell ise
function prepni
{stop-process -processname
firefox
[diagnostics.process]::start
(”C:\Users\Doma\AppData
\Local\Chromium\Application
\chrome.exe”).
Start()
}
úterý 24. ledna 2012
Bad device
neděle 1. ledna 2012
Základni info html výstup
#### HTML Output Formatting #######
$a = "<style>"
$a = $a + "BODY{background-color:Lavender ;}"
$a = $a + "TABLE{border-width: 1px;border-style: solid;border-color: black;border-collapse: collapse;}"
$a = $a + "TH{border-width: 1px;padding: 0px;border-style: solid;border-color: black;background-color:thistle}"
$a = $a + "TD{border-width: 1px;padding: 0px;border-style: solid;border-color: black;background-color:PaleGoldenrod}"
$a = $a + "</style>"
################################################################################################
###### Global variables ####
$vUserName = (Get-Item env:\username).Value ## This will get username using environment variable
$vComputerName = (Get-Item env:\Computername).Value ## this is computer name using environment variable
$filepath = (Get-ChildItem env:\userprofile).value ## this is user profile using environment variable
ConvertTo-Html -Title "System Information for $vComputerName" -Body "<h1> Computer Name : $vComputerName </h1>" > "$filepath\$vComputerName.html"
################################################
# Hardware Information
#################################################
ConvertTo-Html -Body "<H1>HARDWARE INFORMATION </H1>" >> "$filepath\$vComputerName.html"
Get-WmiObject win32_bios -ComputerName $vComputerName | select Status,Version,PrimaryBIOS,Manufacturer,ReleaseDate,SerialNumber `
| ConvertTo-html -Body "<H2> BIOS Information</H2>" >> "$filepath\$vComputerName.html"
Get-WmiObject win32_DiskDrive -ComputerName $vComputerName | Select Model,SerialNumber,Description,MediaType,FirmwareRevision |ConvertTo-html -Body "<H2> Physical DISK Drives </H2>" >> "$filepath\$vComputerName.html"
get-WmiObject win32_networkadapter -ComputerName $vComputerName | Select Name,Manufacturer,Description ,AdapterType,Speed,MACAddress,NetConnectionID `
| ConvertTo-html -Body "<H2> Network Adapters</H2>" >> "$filepath\$vComputerName.html"
################################################
# OS Information
#################################################
ConvertTo-Html -Body "<H1>OS INFORMATION </H1>" >> "$filepath\$name.html"
get-WmiObject win32_operatingsystem -ComputerName $vComputerName | select Caption,Organization,InstallDate,OSArchitecture,Version,SerialNumber,BootDevice,WindowsDirectory,CountryCode `
| ConvertTo-html -Body "<H2> Operating System Information</H2>" >> "$filepath\$vComputerName.html"
Get-WmiObject win32_logicalDisk -ComputerName $vComputerName | select DeviceID,VolumeName,@{Expression={$_.Size /1Gb -as [int]};Label="Total Size(GB)"},@{Expression={$_.Freespace / 1Gb -as [int]};Label="Free Size (GB)"} `
| ConvertTo-html -Body "<H2> Logical DISK Drives </H2>" >> "$filepath\$vComputerName.html"
Get-WmiObject Win32_NetworkAdapterConfiguration -ComputerName $vComputerName |
Select-Object Description, DHCPServer,
@{Name='IpAddress';Expression={$_.IpAddress -join '; '}},
@{Name='IpSubnet';Expression={$_.IpSubnet -join '; '}},
@{Name='DefaultIPgateway';Expression={$_.DefaultIPgateway -join '; '}},
@{Name='DNSServerSearchOrder';Expression={$_.DNSServerSearchOrder -join '; '}},
WinsPrimaryServer, WINSSecondaryServer| ConvertTo-html -Body "<H2>IP Address </H2>" >> "$filepath\$vComputerName.html"
################################################
# OS Information
#################################################
ConvertTo-Html -Body "<H1>SOFTWARE INFORMATION </H1>" >> "$filepath\$vComputerName.html"
Get-WmiObject win32_startupCommand -ComputerName $vComputerName | select Name,Location,Command,User,caption `
| ConvertTo-html -Body "<H2>Startup Softwares</H2>" >> "$filepath\$vComputerName.html"
Get-WmiObject win32_process -ComputerName $vComputerName | select Caption,ProcessId,@{Expression={$_.Vm /1mb -as [Int]};Label="VM (MB)"},@{Expression={$_.Ws /1Mb -as [Int]};Label="WS (MB)"} |sort "Vm (MB)" -Descending `
| ConvertTo-html -Head $a -Body "<H2> Running Processes</H2>" >> "$filepath\$vComputerName.html"
Get-WmiObject win32_Service | where {$_.StartMode -eq "Auto" -and $_.State -eq "stopped"} | Select Name,StartMode,State | ConvertTo-html -Head $a -Body "<H2> Services </H2>" >> "$filepath\$vComputerName.html"
$Report = "The Report is generated On $(get-date) by $((Get-Item env:\username).Value) on computer $((Get-Item env:\Computername).Value)"
$Report >> "$filepath\$vComputerName.html"
invoke-Expression "$filepath\$vComputerName.html"
#################### END of SCRIPT ####################################
Autor:Aman Dhally
sobota 31. prosince 2011
Zabij neodpovidajici proces
$notresponding.Kill()
úterý 1. listopadu 2011
Chyby za předchozí den
$start = $end.AddDays(-1)
Get-EventLog -LogName System -EntryType Error -Before $end -After $start
neděle 16. října 2011
Primarní networkadapter
nebo
get-wmiobject win32_networkadapter -filter "netenabled=’true’"
get-wmiobject win32_networkadapterconfiguration -filter "IPEnabled=’True’"
pátek 16. září 2011
Seznam fontů
[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Drawing")
$objFonts = New-Object System.Drawing.Text.InstalledFontCollection
$colFonts = $objFonts.Families
$objIE = New-Object -com "InternetExplorer.Application"
$objIE.Navigate("about:blank")
$objIE.ToolBar = 0
$objIE.StatusBar = 0
$objIE.Visible = $True
$objDoc = $objIE.Document.DocumentElement.LastChild
foreach ($objFont in $colFonts)
{
$strHTML = $strHTML + "<font size='5' face='" + $objFont.Name + "'>" + $objFont.Name + "</font><br>"
}
$objDoc.InnerHTML = $strHTML
neděle 11. září 2011
admin status
pátek 9. září 2011
HOSTS
Function Get-HostsFile {
.SYNOPSIS
Retrieves the contents of a hosts file on a specified system.
.DESCRIPTION
Retrieves the contents of a hosts file on a specified system.
.PARAMETER ComputerName
The computers to access.
.NOTES
Name: Get-HostsFile
Author: Boe Prox
DateCreated: 15Mar2011
1.1 - 2011-03-17 - Jason Archer
Improved pipeline support (and fixed positional usage).
Added custom object creation and incremental output (better performance and cleaner code).
For local host, use local path.
Added error messages for error conditions.
1.0 - 2011-03-15 - Boe Prox
Initial release.
.LINK
http://boeprox.wordpress.com
.EXAMPLE
Get-HostsFile "server1"
Description
-----------
Retrieves the contents of the hosts file on 'server1'.
#>
[CmdletBinding()]
Param(
[Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]
[ValidateNotNull()]
[string[]]$ComputerName = "localhost"
)
Begin {
$PSBoundParameters.GetEnumerator() | Foreach-Object {
Write-Verbose "Parameter: $_"
}
}
Process {
Write-Verbose "Starting process of computers"
ForEach ($c in $ComputerName ) {
Write-Verbose "Testing connection of $c"
If (Test-Connection -ComputerName $c -Quiet -Count 1) {
Write-Verbose "Validating path to hosts file"
if ($c -eq "localhost") {
$root = "C:"
} else {
$root = "\\$c\C`$"
}
If (Test-Path "$root\Windows\system32\drivers\etc\hosts") {
Switch -regex -file ("$root\Windows\system32\drivers\etc\hosts") {
"^#\w+" {
}
"^\d\w+" {
Write-Verbose "Adding IPV4 information to collection"
$new = $_.Split("") | Where-Object {$_ -ne ""}
If ($new[2] -eq $null) {
$notes = $null
} Else {
$notes = $new[2]
}
New-Object PSObject -Property @{
ComputerName = $c
IPV4 = $new[0]
IPV6 = $null
Hostname = $new[1]
Notes = $notes
}
}
Default {
If (!("\s+" -match $_ -OR $_.StartsWith("#"))) {
Write-Verbose "Adding IPV6 information to collection"
$new = $_.Split("") | ? {$_ -ne ""}
If ($new[2] -eq $null) {
$notes = $null
} Else {
$notes = $new[2]
}
New-Object PSObject -Property @{
ComputerName = $c
IPV4 = $null
IPV6 = $new[0]
Hostname = $new[1]
Notes = $notes
}
}
}
}
} ElseIf (Test-Path "$root\WinNT\system32\drivers\etc\hosts") {
Switch -regex -file ("$root\WinNT\system32\drivers\etc\hosts") {
"^#\w+" {
}
"^\d\w+" {
Write-Verbose "Adding IPV4 information to collection"
$new = $_.Split("") | ? {$_ -ne ""}
If ($new[2] -eq $null) {
$notes = $null
} Else {
$notes = $new[2]
}
New-Object PSObject -Property @{
ComputerName = $c
IPV4 = $new[0]
IPV6 = $null
Hostname = $new[1]
Notes = $notes
}
}
Default {
If (!("\s+" -match $_ -OR $_.StartsWith("#"))) {
Write-Verbose "Adding IPV6 information to collection"
$new = $_.Split("") | ? {$_ -ne ""}
If ($new[2] -eq $null) {
$notes = $null
} Else {
$notes = $new[2]
}
New-Object PSObject -Property @{
ComputerName = $c
IPV4 = $null
IPV6 = $new[0]
Hostname = $new[1]
Notes = $notes
}
}
}
}
} Else {
## TODO: Could use the properly localized path not found error
Write-Error "Unable to locate host file on computer: $c"
}
} Else {
## TODO: Could use the properly localized can not locate host error
Write-Error "Unable to locate computer: $c"
}
}
}
}
pátek 22. července 2011
Portable powershell
pátek 10. června 2011
Seskupovaní podle kriterií
Opět tip z powertips
Někde v hloubi blogu je myslim už group a totožne co je na powertips jenom misto
Get-Process | Group-Object -property Company je tam seskupovaní služeb.
Ukazka z powertips ukazuje vlastni seskupení podle tří kataegorii – rozdilná velikost,jak si je kdo nazve ve scriptu nebo kolik si takových kriteríí uděla a jaká velikost bude patřit k čemu je věc jenom toho co hledám a seskupuji.
PS> $criteria = {
if ($_.Length -lt 1KB) {
'tiny'
} elseif ($_.length -lt 1MB) {
'average'
} else {
'huge' }
}
PS> dir $env:windir | Group-Object -Property $criteria
Výsledek
Tvorba hash table se samozřejmě neomezuje na velikost nebo seskupovaní procesů,nakombinovat jde spousta věcí.
Vypnutí sitových adaptérú –různé způsoby
Další tip který vyšel na powertips
Ruzne zpusoby vypnuti network adapteru
GET-WMIOBJECT WIN32_NETWORKADAPTER | foreach { $_.Disable() }
Vypne všechny sitove adaptersy - Physical, Logical, všechny a GET-WMIOBJECT WIN32_NETWORKADAPTER | foreach { $_.Enable() }
všechny povolí
Filtr na fyzicke neboli where { $_.PhysicalAdapter –eq $TRUE} a přikaz níže zakáže pouze fyzicke adaptery
GET-WMIOBJECT WIN32_NETWORKADAPTER | where { $_.PhysicalAdapter –eq $TRUE} | foreach { $_.Disable() }
Co se týče filtrace tak fantazii se meze nekladou…
Inventura jinak
Pár tipů z powertips..
Get-WmiObject -Class Win32_PnPEntity |
Select-Object Name, Service, ClassGUID |
Sort-Object ClassGUID
Je to inventura trošku jinak než byla ukázaná v předchozích příspěvcích.
Máme – Name,Service a ClassGUID
ClassGUID
neděle 5. června 2011
Restart sitovky
ipconfig /renew
arp -d *
nbtstat -R
nbtstat -RR
ipconfig /flushdns
ipconfig /registerdns
Spustitt powershell jako spravce
středa 27. dubna 2011
Nove procesy
Nove procesy v danem časovem oddobí
Get-Process | Where-Object { try { (New-Timespan $_.StartTime).TotalMinutes -le 5} catch { $false } }
sobota 2. dubna 2011
Powershell a HTML 5
V jednom postu byl zminěn koncept integrace powershellu a HTML5,našel jsem tam mimo jine toto
iex (New-Object Net.WebClient).DownloadString("http://bit.ly/e0Mw9w")
vložte do powershellu a budete překvapeni stejně jako já.
pondělí 14. března 2011
pondělí 7. března 2011
Powershell a Nmap
Dnes jsem při upravování výstupu pro netstat v powershellu narazil v jine souvislosti na zajimavý ps1 script pro nmap.
http://blogs.sans.org/windows-security/2009/06/11/powershell-script-to-parse-nmap-xml-output/
Jeden z možných vystupů ktere exportuje potom vypadá takto
