# Bootcamp: Powershell Olympics
## Getting Started with Powershell
1\) Enter the command `Write-Host 'Hello, PowerShell!'`, then press Enter.
```powershell
PS C:\Users\Sec504> Write-Host 'Hello, PowerShell!'
```
2\) PowerShell commands and parameters options are not case-sensitive. Press the up arrow to return to the previous command, then change Write-Host to read write-host (lowercase). Press Enter to run the command.
```powershell
PS C:\Users\Sec504> write-host 'Hello, PowerShell!'
```
3\) PowerShell supports many different commands. Let's try another. Type Clear-Host then press Enter. You can also clear your screen by pressing CTRL+L.
```powershell
PS C:\Users\Sec504> Clear-Host
```
4\) Next, let's try a different PowerShell command: `Get-ChildItem`. This command lists files and objects.
```powershell
PS C:\Users\Sec504> Get-ChildItem
```
5\) Use tab completion to run the `Get-NetAdapterAdvancedProperty` by typing just a few characters, then press Enter.
```powershell
PS C:\Users\Sec504> Get-NetAdapterAdvancedProperty
```
6\) Use `Get-ChildItem` to list the contents of the C:\Program Files (x86) directory by typing just a few characters
```powershell
PS C:\Users\Sec504> Get-ChildItem 'C:\Program Files (x86)\'
```
7\) Run `Get-Verb` to see a list of approved PowerShell verbs.
```powershell
PS C:\Users\Sec504> Get-Verb
```
8\) Next, let's look at some popular Verb-Noun PowerShell functionality. Run the `Get-Date` command.
```powershell
PS C:\Users\Sec504> Get-Date
```
9\) Next, type `Get-Volume`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Volume
```
10\) Next, let's try a different verb. Type the `Start-Process Notepad`, then press Enter.
```powershell
PS C:\Users\Sec504> Start-Process Notepad
```
11\) Next, let's look at the `Get-Process` command. Type `Get-Process Notepad`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Process Notepad
```
12\) Next, type `Stop-Process Notepad`, then press Enter.
```powershell
PS C:\Users\Sec504> Stop-Process -Name Notepad
```
13\) Let's investigate the `Start-Process` command further. We can use `Get-Command` to collect additional information about PowerShell commands. Type `Get-Command -Name Start-Process`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Command -Name Start-Process
```
14\) Let's take a look at another command using `Get-Command`. Type `Get-Command -Name Get-Volume`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Command -Name Get-Volume
```
15\) Type Get-Command -Noun Volume, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Command -Noun Volume
```
16\) Aliases are shortcuts to run PowerShell commands. Instead of Get-ChildItem, you can run the dir command.
```powershell
PS C:\Users\Sec504> dir
```
17\) You can use the Get-Alias command to look up the command associated with an alias. Type Get-Alias Dir, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Alias Dir
```
18\) Type Get-Alias -Definition Get-ChildItem, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Alias -Definition Get-ChildItem
```
19\) Find an alias for Get-Timezone.
```powershell
PS C:\Users\Sec504> Get-Alias -Definition Get-TimeZone
```
20\) Next, find out which command uses the alias ps.
```powershell
PS C:\Users\Sec504> Get-Alias ps
```
21\) Type Get-Help, then press Enter to display PowerShell's help system information.
```powershell
PS C:\Users\Sec504> Get-Help
```
22\) Get-Help also provides instructions for specific commands. Run Get-Help Get-Process to get help information for the Get-Process cmdlet.
```powershell
PS C:\Users\Sec504> Get-Help Get-Process
```
23\) When you run Get-Help, the help information displays all at once. Most of the time, we want to read the help documentation one screen at a time. This is the behavior of the Help function.
Type Help Get-Process, then press Enter. Press the spacebar several times to get to the end of the help information, then run next to continue.
```powershell
PS C:\Users\Sec504> Help Get-Process
```
24\) But there's more! Type Get-Help -Examples Get-Process, then press Enter. Scroll up to scan through the help information.
```powershell
PS C:\Users\Sec504> Get-Help -Examples Get-Process
```
25\) PowerShell also provides high-level help information. Type Get-Help about\_Core\_Commands, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Help about_Core_Commands
```
26\) There are many other PowerShell about help subjects. Type Get-Help about\*, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Help about*
```
27\) Type ping 127.0.0.1, then press Enter to use the ping.exe program.
```powershell
PS C:\Users\Sec504> PING.EXE 127.0.0.1
```
28\) Type sc query, then press Enter. PowerShell will prompt you for an option; press Enter when prompted.
```powershell
PS C:\Users\Sec504> sc.exe query
```
## Working with the Pipeline
1\) Let's start with a straightforward command. Type `Get-Service`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Service
```
2\) The Get-Service cmdlet allow us to interrogate the services running on the Windows system. There are a lot of services though, so it can be difficult to catch all of the output.
Press the up arrow to recall the `Get-Service` command. At the end of the line add a space followed by | more, then press Enter. Scroll through the output by pressing the spacebar multiple times until you return to the prompt.
```powershell
PS C:\Users\Sec504> Get-Service | more
```
3\) Use Sort-Object as a pipeline command to change the sort order of the Get-Service output to alphabetically descending. Type `Get-Service | Sort-Object -Descending`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Service | Sort-Object -Descending
```
4\) Create a pipeline to sort the output of Get-Process by name. Type `Get-Process | Sort-Object -Property Name`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Process | Sort-Object -Property Name
```
5\) In this output we see that `Sort-Object` has sorted the output by the Name property. You can also sort by process ID using the Id property.
```powershell
PS C:\Users\Sec504> Get-Process | Sort-Object -Property Id
```
6\) Sort-Object can also make the output unique. This can be useful to identifying the name of each item, eliminating duplicates.
Retrieve the process list again, sorting by name in alphabetically descending order. Add the `-Unique` argument to make the list of processes unique.
```powershell
PS C:\Users\Sec504> Get-Process | Sort-Object -Property Name -Descending -Unique
```
7\) Like other shells, PowerShell supports redirection operators such as > to send the output of the pipeline to a file.
Run the PowerShell Get-Process, redirecting the output to a file in the default user profile directory called processes1.txt
```powershell
PS C:\Users\Sec504> Get-Process > processes1.txt
```
8\) The redirection operator > allows us to create a file with the output of the pipeline, but we have little flexibility in defining the format of the file. This is where the cmdlet `Out-File` is useful.
Press the up arrow to recall the previous command. Instead of using the redirection operator, create a pipeline after Get-Process adding `Out-File -FilePath processes2.txt`
```powershell
PS C:\Users\Sec504> Get-Process | Out-File -FilePath processes2.txt
```
8\) When you use the redirection operator > or Out-File, PowerShell takes the pipeline output and creates a little-endian UTF-16 unicode text file with a Byte Order Mark (BOM) at the beginning of the file. That is, these look like text files, but they aren't plain ASCII files.
To create a plain ASCII text file, use `Out-File` with the parameter `-Encoding ASCII`. Run the previous command again, this time creating an ASCII file called processes3.txt
```powershell
PS C:\Users\Sec504> Get-Process | Out-File -FilePath processes3.txt -Encoding ascii
```
9\) Run `Get-ChildItem processes*` .Notice how the third file (the ASCII file) is approximately half the size of the other two. This is because UTF-16 format requires two bytes per ASCII character.
10\) Examine the first several lines of the processes3.txt file. Type `Get-Content -Path processes3.txt -First 5`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Content -Path .\processes3.txt -First 5
```
11\) No surprise here, the content of processes3.txt is just like what we saw when we ran Get-Process output in the terminal. Adding `Out-File` just redirects the output to a file.
What if you want the output to go to the screen and go to a file? This is the job of the Tee-Object cmdlet and the PowerShell pipeline. Type `Get-Process | Tee-Object -FilePath processes4.txt`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Process | Tee-Object -FilePath processes4.txt
```
`Tee-Object` duplicated the output of `Get-Process`, showing it on the screen and saving it to processes4.txt
12\) PowerShell also supports other output mechanisms, such as `Export-Csv`. Create a list of processes, sending the output to the pipeline with `Export-Csv -Path processes.csv`.
```powershell
PS C:\Users\Sec504> Get-Process | Export-Csv -Path processes.csv
```
`Export-Csv` took the output of `Get-Process` and converted it into a CSV file, allowing us to process the data with other tools.
13\) Take a look at the first several lines of processes.csv using Get-Content. Limit the output to the first 5 lines.
```powershell
PS C:\Users\Sec504> Get-Content -Path .\processes.csv -First 5
```
This is a lot more information than what we saw when we used `Get-Process | Out-File`. Earlier we saw 8 columns of information but the CSV file has over 60 columns!
This highlights an important concept about the PowerShell pipeline: PowerShell passes objects in the pipeline, not just text. An object is a collection of code (methods) and data properties that represents the item. Type next then press Enter to continue.
14\) This is an important concept. When you run a PowerShell command and send the output in a pipeline, you are sending an object or a collection of objects to the next step in the pipeline. These objects can include more information than what you see by default.
Using PowerShell, we can retrieve the information that is important to us using different commands. Let's try it now. Type `Get-Process -Name lsass | Select-Object -Property *`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Process -Name lsass | Select-Object -Property *
```
15\) Use `Get-Process` to collect the default properties for the rexplorer process.
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer
```
Get-Process shows some information, but let's gather more data. Let's examine summary information about the object returned by Get-Process using the PowerShell pipeline.
16\) Run `Get-Process -Name rexplorer | Measure-Object`
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer | Measure-Object
```
Measure-Object returns information about the numeric properties of the objects received in the pipeline. In this example, `Measure-Object` tells us that there are 2 objects in the pipeline, corresponding to the two instances of the rexplorer process. We'll return to `Measure-Object` when we look at file processing.
17\) Next, let's look at the object members. Run Get-Process -Name rexplorer | Get-Member
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer | Get-Member
```
Get-Member returns information about the object properties and methods received in the pipeline. For `Get-Process`, we see lots of interesting properties about the processes, but no values.
18\) To see the values and the property names, run `Get-Process -Name rexplorer | Select-Object -First 1 -Property *`
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer | Select-Object -First 1 -Property *
```
In the previous command we used `Select-Object` to get a list of the properties available, limiting it to the first object returned with `-First 1` to avoid repeating the output for the two rexplorer processes. In this output we see the same property names that we saw with `Get-Member`, but we can also see the values for the first object.
This type of analysis is called introspection: the ability to examine properties of an object at runtime. We'll use Get-Member and Select-Object -Property \* often to see which properties are available when working with PowerShell objects.
19\) Let's retrieve specific properties about the rexplorer process using `Select-Object`. Instead of using `-Property *`, we can specify a comma-separated list of properties that we want to see.
Run `Get-Process -Name rexplorer | Select-Object -Property Name, Id, Path` to get the process name, process ID, and process path information.
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer | Select-Object -Property Name, Id, Path
```
20\) Repeat the last command by pressing the up arrow, then add two additional properties: CPU and WorkingSet64
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer | Select-Object -Property Name, Id, Path, CPU, WorkingSet64
```
21\) Press the up arrow to recall the previous command and extend the pipeline, adding `Format-Table` as the last element.
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer | Select-Object -Property Name, Id, Path, CPU, WorkingSet64 | Format-Table
```
22\) Many of the associated PowerShell nouns work together in a pipeline. You can use a PowerShell command such as `Get-Process`, then stop the target process by adding `Stop-Process` to the pipeline with no parameters.
Type `Get-Process -Name rexplorer | Stop-Process` then press Enter to terminate the rexplorer processes.
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer | Stop-Process
```
23\) Since PowerShell is designed around the concept of using a pipeline, there are lots of cmdlets that allow us to leverage this functionality. We can take the output of `Get-Process` and export the results to an HTML report using ConvertTo-HTML, for example.
Run `Get-Process | Select-Object -Property Name, Id, Path, CPU, WorkingSet64 | ConvertTo-Html | Out-File processes.html` to create an HTML report of all running processes, saving the output as processes.html
```powershell
PS C:\Users\Sec504> Get-Process | Select-Object -Property Name, Id, Path, CPU, WorkingSet64 | ConvertTo-Html | Out-File processes.html
PS C:\Users\Sec504> Start-Process .\processes.html
```
24\) Once you understand the concepts around PowerShell pipelines, it can be applied to lots of different functionality. For example, we can get basic information about the Event Log service by running `Get-Service -Name eventlog`
```powershell
PS C:\Users\Sec504> Get-Service -Name EventLog
```
25\) Press the up arrow to recall the previous command. Use `Select-Object` in a pipeline to retrieve the following fields about the Event Log service: Status, Name, DisplayName, and StartType
```powershell
PS C:\Users\Sec504> Get-Service -Name EventLog | Select-Object -Property Status, Name, DisplayName, StartType
```
```powershell
PS C:\Users\Sec504> Get-Service -Name EventLog | Select-Object -Property *
```
26\) Press the up arrow to recall that command, then display the results in a table format.
```powershell
PS C:\Users\Sec504> Get-Service -Name EventLog | Select-Object -Property * | Format-Table
```
27\) So far we've started out pipeline examples with `Get-Process` and `Get-Service`, but that doesn't have to be the start of the pipeline. Examine the status of the WinRM service: type `'winrm' | Get-Service` then press Enter.
```powershell
PS C:\Users\Sec504> 'winrm' | Get-Service
```
In this command we created a string object 'winrm' as the input to the `Get-Servic`e cmdlet.
27\) Type `'winrm' | Get-Member` to see all of the string properties.
```powershell
PS C:\Users\Sec504> 'winrm' | Get-Member
```
28\) Run `Get-Content -Path services.txt`
```powershell
PS C:\Users\Sec504> Get-Content -Path .\services.txt
```
29\) This file has several services listed. We can quickly interrogate all of the services by leveraging PowerShell parameter binding in the pipeline.
Press the up arrow to recall the previous `Get-Content` command, then add `Get-Service` to the pipeline.
```powershell
PS C:\Users\Sec504> Get-Content -Path .\services.txt | Get-Service
```
30\) Run `'rexplorer' | Stop-Process`
```powershell
PS C:\Users\Sec504> 'rexplorer' | Stop-Process
```
Stop-Process returns an error here, not because it doesn't support parameter binding (it does), but because it can't accept a string as the default parameter. However, you can build a pipeline starting with `Get-Process -Name rexplorer`, followed by `Stop-Process`. Do that now to stop the rexplorer process.
```powershell
PS C:\Users\Sec504> Get-Process -Name rexplorer | Stop-Process
```
31\) Get a list of running services using `Where-Object` by typing `Get-Service | Where-Object -Property Status -EQ Running`, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Service | Where-Object -Property Status -EQ Running
```
32\) Type `Get-Service | Where-Object -Property DisplayName -Like 'Application*'` then press Enter.
```powershell
PS C:\Users\Sec504> Get-Service | Where-Object -Property DisplayName -Like 'Application*'
```
33\) Use `Get-Process` to identify all processes running from a path that includes the string temp.
```powershell
PS C:\Users\Sec504> Get-Process | Where-Object -Property Path -Like "*temp*"
```
Here we identifed all processes running from a directory with temp anywhere in the name. This is useful for incident response, since non-malicious processes rarely launch from temporary directories.
34\) Press the up arrow to recall the previous command. Use the pipeline to retrieve multiple details about these processes including the name, ID, path, and start time.
```powershell
PS C:\Users\Sec504> Get-Process | Where-Object -Property Path -Like "*temp*" | Select-Object -Property Name, Id, Path, StartTime
```
35\) Now, extend the pipeline to sort the results by StartTime.
```powershell
PS C:\Users\Sec504> Get-Process | Where-Object -Property Path -Like "*temp*" | Select-Object -Property Name, Id, Path, StartTime | Sort-Object -Property StartTime
```
36\) Export this analysis into a CSV file named malicious-processes.csv and an HTML report named malicious-processes.html
```powershell
PS C:\Users\Sec504> Get-Process | Where-Object -Property Path -Like "*temp*" | Select-Object -Property Name, Id, Path, StartTime | Sort-Object -Property StartTime | Export-Csv -Path malicious-processes.csv
PS C:\Users\Sec504> Get-Process | Where-Object -Property Path -Like "*temp*" | Select-Object -Property Name, Id, Path, StartTime | Sort-Object -Property StartTime | ConvertTo-Html | Out-File -FilePath malicious-processes.html
```
37\) Next, terminate all of the processes running from temporary directories.
```powershell
PS C:\Users\Sec504> Get-Process | Where-Object -Property Path -Like "*temp*" | Select-Object -Property Name | Stop-Process
```
39\) Remove the files starting with services in the file name.
```powershell
PS C:\Users\Sec504> Get-ChildItem -Name "services*" | Remove-Item
```
## Navigating Powershell Drives
1\) Navigating the file system is an essential skill for using PowerShell well. Start by examining your current directory.
Run `Get-Location` to examine your current directory.
```powershell
PS C:\Users\Sec504> Get-Location
```
2\) You can also use the alias pwd for `Get-Location`. Try running the alias for `Get-Location` now.
```powershell
PS C:\Users\Sec504> pwd
```
3\) In PowerShell you can use `Set-Location` to change to a different directory. Use `Set-Location` to change to the C:\temp\bobsled directory, then run `Get-Location` to display the current directory.
```powershell
PS C:\Users\Sec504> Set-Location C:\Temp\bobsled
PS C:\Users\Sec504> Set-Location C:\Temp\bobsled
```
4\) In the previous command you used an absolute directory reference, but PowerShell also supports a relative directory reference.
Use `Set-Location` to go back one directory by running `Set-Location ..` then run `Get-Location` to display the current directory.
```powershell
PS C:\Temp\bobsled> Set-Location ..
PS C:\Temp> Get-Location
```
5\) Next, return to the bobsled directory, this time using the relative path name with `Set-Location`, then run `Get-Location` to display the current directory.
```powershell
PS C:\Temp> Set-Location bobsled
PS C:\Temp\bobsled> Get-Location
```
6\) Next, let's create a new directory. Creating directories in PowerShell is the job of the `New-Item` cmdlet. To create a directory, specify `-ItemType` Directory and the name of the directory using -Name DirectoryName.
Use `New-Item` to create the directory sled (you need to already be in the C:\temp\bobsled directory).
```powershell
PS C:\Temp\bobsled> New-Item -Name sled -ItemType Directory
```
7\) PowerShell will let you specify multiple directories in one command, creating each needed sub-directory. Run the `New-Item` command again, this time creating the following nested directories for a 4-person bobsled team: Brakeman\Pusher\Pusher\Pilot.
```powershell
PS C:\Temp\bobsled> New-Item -ItemType Directory -Name Brakeman\Pusher\Pusher\Pilot
```
8\) The `New-Item` syntax to create directories can be simplified using the `mkdir` function: `mkdir DirName`. Create the directory structure using `mkdir` for a 2-person bobsled team: Brakeman\Pilot.
```powershell
PS C:\Temp\bobsled> mkdir Brakeman\Pilot
```
9\) When you want to remove a directory, you can use `Remove-Item` followed by the directory name. Remove the sled directory using the `Remove-Item` cmdlet.
```powershell
PS C:\Temp\bobsled> Remove-Item .\sled
```
10\) PowerShell will prompt you if you try to remove a directory that has sub-directories or files in it. You can add the `-Recurse` argument to remove a directory and everything in it without a prompt. Remove the brakeman directory and sub-directories using `Remove-Item`. Add `-Recurse` to remove the directories without a prompt.
```powershell
PS C:\Temp\bobsled> Remove-Item .\Brakeman -Recurse
```
11\) Next we'll look at the powerful cmdlet `Get-ChildItem`. This cmdlet allows us to list items and child items in one or more directories.Run the `Get-ChildItem` cmdlet with no arguments. Make sure you are in the C:\temp\bobsled directory. Note that we've added some files for your analysis.
```powershell
PS C:\Temp\bobsled> Get-ChildItem
```
12\) Get the content of the data folder. Use -Name also.
```powershell
PS C:\Temp\bobsled> Get-ChildItem data
PS C:\Temp\bobsled> Get-ChildItem -Name data
```
13\) Run the previous command again, this time adding `-Recurse` to display file and directory names in all subdirectories.
```powershell
PS C:\Temp\bobsled> Get-ChildItem -Name data -Recurse
```
14\) Let's focus on the files in the data/1952 directory. Change to this directory, then run `Get-Location`. Then list the files in this directory.
```
PS C:\Temp\bobsled> Set-Location .\data\1952
PS C:\Temp\bobsled\data\1952> Get-Location
PS C:\Temp\bobsled\data\1952> Get-ChildItem
```
15\) By default, `Get-ChildItem` doesn't list files that have the hidden attribute set. To display hidden files, add the `-Force` argument. Run the previous command again, this time adding `-Force`.
```powershell
PS C:\Temp\bobsled\data\1952> Get-ChildItem -Force
```
16\) Using `Get-ChildItem` you can search for file or directory names by specifying a name as an argument. When you add `-Recurse`, you can search all subdirectories as well.
Search for the file named Hans\_He-GER-Bronze.txt.
```powershell
PS C:\Temp\bobsled> Get-ChildItem -Recurse 'Hans_He-GER-Bronze.txt'
```
17\) You can also use the wildcard \* in the file name to perform partial name matches. Use `Get-ChildItem` with a wildcard to identify all Gold medal winners.
```powershell
PS C:\Temp\bobsled> Get-ChildItem -Recurse '*Gold*'
```
18\) PowerShell also allows you to exclude named with the `-Exclude` argument. PowerShell also allows you to exclude named with the `-Exclude` argument.
```powershell
PS C:\Temp\bobsled> Get-ChildItem -Name .\data\1998 -Exclude "*Gold*"
```
19\) The `Get-ChildItem` cmdlet is especially powerful, not just because you can list files and directories, but also because it allows you to examine other PowerShell Drives as well.
We normally think of drives as a drive letter (C:, E:, etc.), but PowerShell also supports other drive prefixes. Run the `Get-PsDrive` cmdlet to see a list of PPowerShell drives on the system.
```powershell
PS C:\Temp\bobsled> Get-PSDrive
```
The output of Get-PSDrive shows us other PowerShell drive prefixes that we can also interrogate with Get-ChildItem.
20\) Examine the contents of the Env drive prefix using `Get-ChildItem`.
```powershell
PS C:\Temp\bobsled> Get-ChildItem Env:
```
21\) Repeat the prior command, this time examining the contents of the HKCU PowerShell Drive.
```powershell
PS C:\Temp\bobsled> Get-ChildItem HKCU:
```
HKCU is an alias for the Windows registry hive `HKEY_CURRENT_USER`. Since PowerShell treats this as a drive, we can use `Get-ChildItem` to interrogate the registry.
22\) Repeat the prior command, this time specifying the registry location HKCU:\Software.
```powershell
PS C:\Temp\bobsled> Get-ChildItem HKCU:\SOFTWARE
```
23\) Here we see the Software registry key. Within this key we see several subkeys, including Microsoft. Repeat the prior command, this time examining the contents of the HKCU:\Software\Microsoft key.
```powershell
PS C:\Temp\bobsled> Get-ChildItem HKCU:\SOFTWARE\Microsoft\
```
24\) As you can see, we can navigate the contents of the registry hive very much like we navigate a conventional file system. Examine the registry key values in the HKCU:\Software\Monobob2022 key.
```powershell
PS C:\Temp\bobsled> Get-ChildItem HKCU:\SOFTWARE\Monobob2022\
```
25\) Repeat the last command, enumerating the contents of each of these registry keys by adding the `-Recurse` option.
```powershell
PS C:\Temp\bobsled> Get-ChildItem HKCU:\SOFTWARE\Monobob2022\ -Recurse
```
26\) Repeat the following command, this time adding the pipeline `Where-Object -Property Name -Match "Qing"` to find the key matching the Olymplic athlete name.
```powershell
PS C:\Temp\bobsled> Get-ChildItem HKCU:\SOFTWARE\Monobob2022\ -Recurse | Where-Object -Property Name -Match "Qing"
```
27\) Next, let's investigate one more PowerShell Drive provider: system certificates. Use `Get-ChildItem` to examine the Cert: drive.
```powershell
PS C:\Temp\bobsled> Get-ChildItem Cert:
```
28\) Examine the trusted root certificate authorities on the local system using `Get-ChildItem Cert:\LocalMachine\Root`
```powershell
PS C:\Temp\bobsled> Get-ChildItem Cert:\LocalMachine\Root\
```
## Working with Powershell Variables
PowerShell has support for variables: named objects that hold data and code. First we'll look at PowerShell's automatic variables.
1\) PowerShell has several automatic variables available to every PowerShell session that describes the environment. Let's examine several of them.
```powershell
PS C:\Users\Sec504> $Host
```
2\) Examine the available members by typing `$Host | Get-Member`, then press Enter.
```powershell
PS C:\Users\Sec504> $Host | Get-Member
```
The $Host variable is an object, just like everything else in PowerShell. Here we see the names of the properties and the methods. We can access these object members using dot notation.
3\) Access the Version property of the `$Host` variable: type `$Host.Version`, then press Enter.
```powershell
PS C:\Users\Sec504> $Host.Version
```
Like $Host, $Host.Version is also a PowerShell object. Accessing this member shows the table format for the major, minor, build, and revision members. We can see all of the members in this object like we did for $Host using dot notation.
4\) Run the previous command with `Get-Member` .
```powershell
PS C:\Users\Sec504> $Host.Version | Get-Member
```
5\) Here we see the list of properties for the $Host.Version property. If you want to access just the Major value you can reference this member directly using more dot notation.
```powershell
PS C:\Users\Sec504> $Host.Version.Major
```
6\) You can also invoke the methods associated with the `$Host.Version` object by specifying the method name followed by () (sometimes with a value inside the parenthesis).
Invoke the `ToString()` method by typing `$Host.Version.ToString()`, then press Enter.
```powershell
PS C:\Users\Sec504> $Host.Version.ToString()
```
7\) Let's take a look at a few more useful variables. Type `$Home` then press Enter.
```powershell
PS C:\Users\Sec504> $HOME
```
9\) We've created a file C:\TEMP\report.html; copy it to your user profile directory by typing `Copy-Item C:\TEMP\report.html $Home`
```powershell
PS C:\Users\Sec504> Copy-Item C:\Temp\report.html $HOME
```
10\) The `$Error` automatic variable keeps track of all the times your commands generated an error for the current session. This is valuable since your custom PowerShell programs can reference error messages to provide help to users.
```powershell
PS C:\Users\Sec504> good
PS C:\Users\Sec504> $Error
```
11\) We'll look at one more automatic variable: `$?`. First, run `Get-ChildItem -Name report.html`
```powershell
PS C:\Users\Sec504> Get-ChildItem -Name report.html
PS C:\Users\Sec504> $?
```
Notice how `$?` returns True. True is a Boolean data type; that is, it is either True or False. The `$?` variable indicates if the last command ran successfully. The output True here indicates that the `Get-ChildItem` command ran successfully.
12\) Let's look at another case: Type Get-ChildItem -Name report.txt, then press Enter. Then type `$?` .
```powershell
PS C:\Users\Sec504> Get-ChildItem -Name report.txt
PS C:\Users\Sec504> $?
```
Notice how the value of `$?` is now set to False. This tells us the previous command did not run successfully. This is valuable in PowerShell scripts to test if the previous command returned an error. PowerShell has other automatic variables as well, you can read about them by running `help about_Automatic_Variables`.
13\) You may remember this from the PowerShell Olympics Using the Pipeline event. `Get-Process` retrieves a list of process details.
Run the command again, this time creating a variable name `$processes` to store the process information by typing `$processes = Get-Process`, then press Enter.
```powershell
PS C:\Users\Sec504> $processes = Get-Process
```
Type `$processes` and press Enter.
```powershell
PS C:\Users\Sec504> $processes
```
14\) Declare a new process information variable: type `$pnow = Get-Process`, then press Enter.
```powershell
PS C:\Users\Sec504> $pnow = Get-Process
```
We can compare the `$processes` and `$pnow` variables using `Compare-Object`. Type `Compare-Object $processes $pnow`, then press Enter.
Notice how `Compare-Object` examines the two variables and shows us the differences? This is a powerful feature of PowerShell variables: they allow us to save a point-in-time representation of any object output, then compare it to another similar variable later.
15\) In the output of `Compare-Object` we see the rexplorer process is back. Type `$targetproc = Get-Process -Name rexplorer` then press Enter.
```powershell
PS C:\Users\Sec504> $targetproc = Get-Process -Name rexplorer
```
Notice how this time the variable holds just the process information for rexplorer, corresponding to the `-Name` argument of the `Get-Process` command. We can continue to leverage the features of different PowerShell commands as needed to refine what is represented in the variable.
16\) Use the PowerShell pipeline to examine the members of the `$targetproc` variable with `Get-Member`.
```powershell
PS C:\Users\Sec504> $targetproc | Get-Member
```
Scroll up a bit and examine some of the methods and properties associated with the object. Notice the `Kill()` method that can be invoked to kill the processes identified in the `$targetproc` variable. Methods for an object can be invoked using dot notation `ObjectName.Method()`.
17\) Invoke the `Kill()` method on the `$targetproc` variable to terminate the two processes using dot notation.
```powershell
PS C:\Users\Sec504> $targetproc.Kill()
```
By calling the `Kill()` method on the `$targetproc` variable you terminated both the rexplorer processes. You could have used the pipeline, sending the variable to `Stop-Process` as well; which one you choose is a matter of preference.
18\) Let's start by declaring a variable that represents a number. Type `$limit = 10`, then press Enter.
```powershell
PS C:\Users\Sec504> $limit = 10
```
19\) Like everything in PowerShell, `$limit` is an object. Take a look at the members of this object by running `$limit | Get-Member`
```powershell
PS C:\Users\Sec504> $limit | Get-Member
```
At the top of this output look at the line starting with TypeName. When you declared the $limit variable with the value 10, PowerShell decided to use a type of Int32 (a 32-bit integer) to represent this data. The methods associated with this object are mostly for converting this to other types. Let's invoke one of those methods now.
20\) Type `$limit.GetType()` then press Enter.
```powershell
PS C:\Users\Sec504> $limit.GetType()
```
21\) PowerShell is a dynamically typed scripting language, which means that every variable has a type, but that variable type can change (it's dynamic). Let's experiment with that now: type `$limit = '100'` (with the quotation marks), then press Enter.
```powershell
PS C:\Users\Sec504> $limit = '100'
```
Press the up arrow a few times, recalling the `$limit | Get-Member` command, then press Enter.
```powershell
PS C:\Users\Sec504> $limit = '100'
```
If you scroll up again you'll see the type has changed. This time, `$limit` is a String type with different methods and properties. When you specify quotation marks around a value, PowerShell will treat it as a string. Numbers assigned to a variable without quotations will be assigned a type of Int32 or other numeric types depending on the number selected.
22\) Next, let's look at something cool and useful. Type `$limit = 100MB`, then press Enter.
```powershell
PS C:\Users\Sec504> $limit = 100MB
PS C:\Users\Sec504> $limit | Get-Member
PS C:\Users\Sec504> $limit
```
Instead of `$limit` having a value of 100, it has a value of 104857600, the number of bytes in 100 MB. PowerShell is designed to be "administrator first", with handy integer literals to interpret values including kilobytes, megabytes, gigabytes, terabytes, and petabytes.
23\) PowerShell can also work with converting hexadecimal and binary values using the prefix 0x or 0b. Change `$limit` to 0x31337 now.
```powershell
PS C:\Users\Sec504> $limit = 0x31337
PS C:\Users\Sec504> $limit
```
24\) Next, let's look at another type: arrays. PowerShell arrays hold zero or more elements denoted by `@()` notation. Create a PowerShell array: type `$alpinecourses = @('Rock', 'Ice River', 'Nile')` then press Enter.
```powershell
PS C:\Users\Sec504> $alpinecourses = @('Rock', 'Ice River', 'Rainbow')
```
Access the last element of the array. Type `$alpinecourses[2]`, then press Enter.
```powershell
PS C:\Users\Sec504> $alpinecourses[2]
```
Access the first element of the array.
```powershell
PS C:\Users\Sec504> $alpinecourses[0]
```
25\) Retrieve a list of the Windows services using `Get-Service`, saving it in a variable called `$services`.
```powershell
PS C:\Users\Sec504> $services = Get-Service
```
Call the `GetType()` method on the `$services` variable.
```powershell
PS C:\Users\Sec504> $services.GetType()
```
The `$services` variable has a type of `Object[]`, but notice how the base type indicates that it is an array. We can use the array subscript notation to access different elements in this variable as well.
```powershell
PS C:\Users\Sec504> $services[10]
```
26\) We'll look at one more variable type: DateTime. `Type Get-Date | Get-Membe`r, then press Enter.
```powershell
PS C:\Users\Sec504> Get-Date | Get-Member
```
The PowerShell `Get-Date` command returns a DateTime type which represents the date and time when you invoke the command. We can use this command to record a start and ending time for an operation (such as a long-running job). Let's do that now.
27\) Create two variables, `$start` and `$stop` using `Get-Date`, with a delay of 3 seconds between using Start-Sleep 3. We'll use the command separator ; to run all three commands on one line. Type `$start = Get-Date ; Start-Sleep 3 ; $stop = Get-Date` then press Enter.
```powershell
PS C:\Users\Sec504> $start = Get-Date; Start-Sleep 3; $stop = Get-Date
```
Subtract `$stop` from `$start` to see the time difference: `$stop - $start`
```powershell
PS C:\Users\Sec504> $stop - $start
```
The TotalSeconds property will show you the time delay between the two Get-Date commands, which will be just over 3 seconds. `Get-Date` will return the current date, but we can also specify an arbitrary date.
28\) Create a `$future` variable string of Feb. 8, 2030 at 9:00 AM (use MM/DD/YYYY or DD/MM/YYYY based on your regional convention; add a space after the year then 9:00 AM for the time).
```powershell
PS C:\Users\Sec504> $future = "08/02/2030 9:00 AM"
```
Try to subtract the `$start` object from `$future`.
```powershell
PS C:\Users\Sec504> $future - $start
```
We know that `$future` is a string object, since we declared it using quotes. We received an error because we can't perform arithmetic using a string and a DateTime object. We need to convert the string to a DateTime object using the cast operator.
29\) In PowerShell, you can specify a type in square brackets before the variable name to convert it to the specified type. Let's try that now.
Type `[DateTime]$future`, then press Enter.
```powershell
PS C:\Users\Sec504> [DateTime]$future
```
PowerShell converted the string in $future to a DateTime object.
30\) Press the up arrow several times to return to the subtraction operation and add a typecast to calculate the time span difference between `$future` and `$start`.
```powershell
PS C:\Users\Sec504> [DateTime]$future - $start
```
31\) PowerShell can easily embed variables inside of strings. To practice this, create a variable called `$favcolor` with a value of 'gold'.
```powershell
PS C:\Users\Sec504> $favcolor = 'gold'
```
Send a message to the console, using string substitution to expand the $favcolor variable. Type `Write-Host "My favorite color is $favcolor."`
```powershell
PS C:\Users\Sec504> Write-Host "My favorite color is $favcolor."
```
Press the up arrow to recall the last command and change the double quotes to single quotes, then press Enter.
```powershell
PS C:\Users\Sec504> Write-Host 'My favorite color is $favcolor.'
```
32\) Along with string substitution, we also have escape sequences in strings. The backtick character is used to indicate an escape sequence, followed by an escape sequence character. For example, \`n is used to indicate a newline.
We can create a prompt to accept user input with `Read-Host`. Type ``$age = Read-Host "Please enter your age.`nBe honest please"`` then press Enter. Enter a value when prompted, then press Enter.
```powershell
PS C:\Users\Sec504> $age = Read-Host "Please enter your age.`nBe honest please"
```
Here we used \` to indicate that a newline character should be inserted in the string. The `Read-Host` command prompts the user for input and saves it in the specified variable. Examine the contents of the `$age` variable to see your answer.
```powershell
PS C:\Users\Sec504> $age
```
.png?alt=media&token=3693eb6d-130a-4901-bb3b-3f4da9aedc54)
.png?alt=media&token=c66a22f8-df12-46e1-9d0c-86870c17ea5d)
.png?alt=media&token=0692bc85-ee46-4cd1-81a6-203a668548b1)
.png?alt=media&token=4bd208b9-9064-457d-927e-80c46c183dc8)
.png?alt=media&token=3e8cf63f-2b8e-4fab-8ad5-ed298b972a04)
.png?alt=media&token=4ac3c3ed-f8e7-41ed-bb0d-9e26ae08c730)
.png?alt=media&token=8d11f1e1-0816-4ec5-b948-4bce87056bfa)
.png?alt=media&token=feac1705-d9cc-4a58-ac4e-8693d66e6130)
.png?alt=media&token=6f59a06e-a095-4fa7-b405-cfbae7814dca)
.png?alt=media&token=f2a7b43d-1e15-460c-ba20-dd5ecc53ce81)
.png?alt=media&token=4176ec3f-aa20-4b9c-aaa0-4a577483cbb4)
.png?alt=media&token=26cfde87-7604-47d6-ad35-7557892f4c8d)
.png?alt=media&token=241c1292-0b91-4cc3-883f-10ba6a355118)
.png?alt=media&token=a3eaf065-751c-4313-9460-b700ea8b252c)
.png?alt=media&token=fabfe3a0-4f8f-48e5-83a3-a0d2e267bde5)
.png?alt=media&token=b8f9a3b5-22b4-4db7-bbb1-93478f8aabc9)
.png?alt=media&token=8b56c4c4-35b4-425a-864f-aa8f2baab4ba)
.png?alt=media&token=980323de-b842-46ee-b459-e4b3e0569e62)
.png?alt=media&token=4e3e240c-7838-4663-8673-97ef141dbb03)
.png?alt=media&token=8838d90e-3310-414c-8a95-dd502060a97f)
.png?alt=media&token=c9f79235-1688-4079-95de-352d3eb764b5)
.png?alt=media&token=db2b1574-b0df-4505-9421-522cedc333d8)
.png?alt=media&token=858b29da-d888-4197-adde-b82ff5a6b8fc)
.png?alt=media&token=c292dfae-ee4c-4f8b-8dfb-0c787e96580f)
.png?alt=media&token=aa8e83d4-05e0-46bc-b22e-3caccfdf89f5)
.png?alt=media&token=7ad08671-ebb0-4653-b808-b1f5e19657cf)
.png?alt=media&token=72a59660-d7d4-4b1d-8ada-601bfa169967)
.png?alt=media&token=33b8dc50-0d93-4953-97ca-ac34e6658502)
.png?alt=media&token=35b77ad3-aaca-49ed-8c94-0bd51012c853)
.png?alt=media&token=36045e64-02b9-4e20-9c0e-d8113f719430)
.png?alt=media&token=c6e9ecd0-9793-44bf-8576-9a0121dc8c2d)
.png?alt=media&token=8eaddd44-1ba3-4760-8424-2381583f3578)
.png?alt=media&token=2211c2fd-5476-48c6-8153-31d5e57d1619)
.png?alt=media&token=51b0e64a-ac4d-4867-9c43-408da8447014)
.png?alt=media&token=49d7329c-9e00-495d-a76b-f890d043acff)
.png?alt=media&token=caeaaae7-8851-4826-bb09-c38d85c4ae95)
.png?alt=media&token=2b7b4f8e-10ba-48ad-8134-3c0c8e8939bd)
.png?alt=media&token=1fc1cafa-60e4-4d80-a904-9c95478d9d64)
.png?alt=media&token=413f389e-a24d-4133-a6b5-32647812f009)
.png?alt=media&token=5af966d7-ae7b-4301-aa69-c9cc06f1b883)
.png?alt=media&token=41a32da8-6788-453b-b22a-97ffe3398fe6)
.png?alt=media&token=00d3630b-1e94-4adb-a8ef-23ad86b64dcb)
.png?alt=media&token=ad709e84-d21a-4893-b710-c080cd248747)
.png?alt=media&token=25846445-66be-4b31-b0f1-86808bd8188c)
.png?alt=media&token=7d545bd0-f2cd-494b-818c-f19c863b8fcd)
.png?alt=media&token=14aa3a91-456d-48c1-a257-a41196373279)
.png?alt=media&token=7ff05bc2-21a3-4964-b51e-1b5f5aca33d6)
.png?alt=media&token=41edc2bf-3049-4ea9-9ab4-e41a1a5def5b)
.png?alt=media&token=dcc7b0a2-195d-4bbc-8bf0-9caaf9e6de8d)
.png?alt=media&token=61ced96f-1589-459a-a336-7a4c416e711f)
.png?alt=media&token=5267d9c2-1986-442e-bb2b-4d3e292cb71b)
.jpg?alt=media&token=e3864722-6199-4553-9c81-ff9d679a240f)
.png?alt=media&token=027c19ca-6f77-4cca-b9a0-55f822066fa3)
.png?alt=media&token=ef33126f-9c84-47bd-80fb-3d245d5b4794)
.png?alt=media&token=09ef580f-4dc3-4117-b9a3-9ca0746f590b)
.png?alt=media&token=a40ef0f6-fa4b-4fe3-aa80-697a42fb05d7)
.png?alt=media&token=07041c02-b129-4e5e-be68-b5eb94125725)
.png?alt=media&token=65a3154f-19be-4e95-9d96-346daf02bc10)
.png?alt=media&token=66ae2683-1b43-4ead-bdf6-07c0a29e7e2f)
.png?alt=media&token=a963ada9-dace-46dd-9a3a-82b82bb97d34)
.png?alt=media&token=8dbe3747-602f-418f-9584-2d8f246fad1e)
.png?alt=media&token=d78f784f-f66f-451c-b5d4-ed97b75703db)
.png?alt=media&token=f4f2d6f8-7fd7-4020-9be4-82156f58a96f)
.png?alt=media&token=3c02e71e-7cd6-48e5-9666-21fb9d9ebb21)
.png?alt=media&token=50b13ad6-7bbc-4cd6-9a93-92857c2f3fbc)
.png?alt=media&token=e200aecc-efcf-4032-b839-32a0f307eeb9)
.png?alt=media&token=6bcb61ef-abd7-404d-9963-f5bc59a6d6a3)
.png?alt=media&token=8537de6d-b1d2-4ed2-9af0-7b25f7c5aa53)
.png?alt=media&token=cf1161a6-928a-4641-81cf-e89d3fe81334)
.png?alt=media&token=ef70cd3a-ed26-416b-b010-42ef35ceb1a3)
.png?alt=media&token=367eea73-6e36-44b3-b74e-68cf58b3f4d3)
.png?alt=media&token=33745331-89ca-4fc2-a951-543f9f1c7e66)
.png?alt=media&token=fad11970-a5b2-4611-9250-c35d851d5a57)
.png?alt=media&token=a7c38a13-c960-40db-9f5d-e3441fda80f5)
.png?alt=media&token=5ba8083e-6a7c-41c6-ae63-023a66d21ada)
.png?alt=media&token=d3f26775-f185-4743-b649-fe69d3809c51)
.png?alt=media&token=8e12f9ad-f673-4a29-a2fc-00c797a0c9b8)
.png?alt=media&token=e8f23648-4311-4269-adef-9762fc7e6ec8)
.png?alt=media&token=9c3d8241-792d-4e5b-b7e1-922bf75d7311)
.png?alt=media&token=1a91efd7-8bc9-4f4f-a0ac-311dd9e668ce)
.png?alt=media&token=67da0966-4bbf-410a-9648-5b3e3f553a0f)
.png?alt=media&token=3aecd8eb-1f4a-4a23-bd3b-c97230cdd24d)
.png?alt=media&token=b55910e5-a53b-46d7-9295-a389f055ed49)
.png?alt=media&token=8eb2a9ff-fbca-4b9f-ac15-fc1f3e42024a)
.png?alt=media&token=585ad6d4-cce8-4582-bd0f-f1cf5db6f95f)
.png?alt=media&token=69851689-803f-4e1a-af8b-024a12b76004)
.png?alt=media&token=c96d4a12-2ad9-46ee-81d0-380c8b079592)
.png?alt=media&token=fa555c25-8bc3-4658-8492-b02dd1b4fa79)
.png?alt=media&token=0d29306d-fc6c-4e55-9d3d-0909e5e35bc2)
.png?alt=media&token=df423705-14a5-4ef0-94d1-a3a3375364ce)
.png?alt=media&token=363eb6b9-e69c-41f7-9835-850bfe8e555d)
.png?alt=media&token=616a9b64-7846-438f-a7b6-bea3e6ef1997)
.png?alt=media&token=81831b83-0ad4-47aa-a26c-c69a336e0d62)
.png?alt=media&token=29d22d62-6a84-412d-bdf7-870d8665daff)
.png?alt=media&token=559dd961-9805-4942-884e-361f578a29e5)
.png?alt=media&token=0960c5a0-45c3-4cd7-85cb-ac3327df10d6)
.png?alt=media&token=5c6cd3ad-246b-4032-b1b4-b847b1abb1f4)
.png?alt=media&token=dd47dd8b-d205-4b2a-8b97-09dc50d35b2d)
.png?alt=media&token=ceb91b2b-496e-4cc8-a056-1ea305b37ddf)
.png?alt=media&token=73526db5-2634-4094-a747-84978eeb60bd)
.png?alt=media&token=6a6f7619-8c5c-4b76-b15b-e47403546cf3)
.png?alt=media&token=e9c7a31e-5f00-43ca-a4b4-4f8c99eaacf0)
.png?alt=media&token=2547ade7-33d1-49af-b4db-1f356ef1b7fe)
.png?alt=media&token=b4645ab3-432a-499b-a6c2-2203ba165486)
.png?alt=media&token=d09a8a51-048e-449d-920f-e2c8ef388c33)
.png?alt=media&token=418ad5d9-8f17-4da6-8e9c-ff2f1a70f341)
.png?alt=media&token=344d5b14-b2a0-4a4f-be1f-5eceb13c2b1e)
.png?alt=media&token=ec606978-f5a8-4efc-84c4-14bef9a0724e)
.png?alt=media&token=9e1d33a8-934f-446d-a726-59291373d244)
.png?alt=media&token=923bb845-146e-4ff3-af21-b095dd5170ea)
.png?alt=media&token=2e6fab9d-e510-4944-a9f0-eb6c28317b19)
.png?alt=media&token=df30e317-1d02-436b-b62e-771510de06f8)
.png?alt=media&token=8e9df3ed-d134-4c86-b317-f8de9cb3c680)
.png?alt=media&token=12bfb74b-efcf-4afb-8f6e-813b2d097813)
.png?alt=media&token=290c8625-77cd-4c5f-a759-66531b4c06d5)
.png?alt=media&token=6a175dda-fff9-4a16-abb0-dc5925e21e4a)
.png?alt=media&token=68f460cd-e54c-4c03-bf45-4caeed8eff93)
.png?alt=media&token=36dda283-d892-4b21-ba73-33c90736f7fc)
.png?alt=media&token=91d290e7-6d03-4885-979e-5938a1c36ca8)
.png?alt=media&token=6f31801a-597b-407c-a9e7-83fac9006171)
.png?alt=media&token=81ec0688-a294-4b4f-96ab-b99273dc140c)
.png?alt=media&token=4f71ec7c-3185-44d6-931f-fb12cc4a9d42)
.png?alt=media&token=08b50726-1df4-4f15-a585-7f2031c1619f)
.png?alt=media&token=92dbc108-2c82-4635-80cf-a80d6784ff23)
.png?alt=media&token=d50dc6cd-d5e6-414d-9311-6fdd93846f54)
.png?alt=media&token=b81531dc-fcf2-4f49-89f0-43979f8437d2)