Microsoft%20PowerShell

1
Microsoft PowerShell

• Tom Roeder
• CS215 2006fa

2
Motivation

• .NET as a platform
• shell
• web server
• database access
• Native access to resources
• eaiser to manage than P/Invoke
• scripting .NET natively can use reflection
• idea of managed code throughout

3
PowerShell introduction

• No more text
• traditional style of shell scripting the pipe
• find . name .sh xargs zip -_at_ shfiles
• what does this command do?
• many tools for this job
• sed, xargs, cut
• Instead, pass objects as return values. Why?
• convert to text as needed
• richer format

4
PowerShell Cmdlets

• built-in commands for PowerShell
• verb-noun names
• eg. get-childitem ( ls)
• but new-alias, new-object
• single parser for parameters
• passed as calls to cmdlets
• extensible set can write own cmdlets
• Aliases
• built in with (mostly) standard scripting names

5
PowerShell variable syntax

• Basic syntax similar to all scripting languages
• a value
• a 1 2
• a 137
• Built-in support for types
• a xmllttestgtltagtavaluelt/agtlt/testgt
• inta 42
• or cast to arbitrary .NET object

6
PowerShell parsing

• Two contexts
• command context
• starts with regular character
• tries to execute command
• expression context
• starts with num, var, or quoted string
• executes as expression
• Can reset mode with ( )
• (Get-Date).day 2

7
PowerShell array and hash

• a 1,2,3,4
• a 5..10
• adds elements to array
• .. is range operator. What is a1..3?
• a1, a2, a3
• a _at_ one1 val get-childitem
• aval
• a.one

8
PowerShell if/switch

• if lttestgt lttruegt else ltfalsegt
• elseif lttestgt ltelsegt
• switch (ltvargt) ltvalgt ltcasegt break
• default case
• switch regex (ltvargt) word. ltcasegt
• dropping break gives multiple matches
• _ variable referring to current ltvargt
• where lttestgt

9
PowerShell looping

• while(a lt 137) ltblockgt
• foreach(var in get-process) ltblockgt
• IEnumerable support
• Shorten foreach to
• ls _.Length
• receive piped objects
• _ as before
• for i 0 i lt 10 i 2 i
• regular for loop

10
PowerShell useful operators

• , .
• call operator
• a Get-childitem a calls get-childitem
• . used for executing scripts in current context
• -as, -is
• is/as in C
• a as int
• if a is System.DateTime

11
PowerShell functions

• function (args) ltbodygt
• if Param is first statement, then gives
  parameters
• arguments passed in args
• input passed in input
• parameter passing on cmd line
• add x 2 y 3
• add 2 3

12
Useful commands

• get-member
• return the members of an object
• eg. get-member MemberType property
• or, method
• Authenticode signing
• can use certificates to verify scripts
• checks the hash and returns

13
PowerShell errors

• throw
• throw error
• same as ThrowTerminatingError in Cmdlets
• trap
• catch exceptions
• trap DivideByZeroException ltdo somethinggt
• break/continue semantics

14
PowerShell surprises

• Drives
• C, D
• Env, Alias, HKLM, variable, function
• mount lets you create others
• variable scoping
• private, local, script, global

15
PowerShell surprises

• import/export CSV
• get-unique
• (foreach (line in get-content
  C\Test1\File1.txt) line.tolower().split(" "))
  sort get-unique
• get-item
• group
• x new-object COM ltProgIDgt
• eg. Outlook.Application

16
PowerShell surprises

• calc
• calc get-process calc
• calc.add_exited(write-host this.Processname
  has exited)
• calc.HasExited
• calc.kill()
• calc.HasExited

17
Scriptblocks

• a chunk of script
• a type in PowerShell
• x scriptblocky 137x
• Can be used as an EventHandler delegate
• this is whats happening in the last example
• object parameter -gt this
• EventArgs parameter -gt _

18
Cmdlet creation

• Subclass of System.Management. Automation.Cmdlet
• must have an attribute
• gives verb and noun components of name
• overrides at least one of
• BeginProcessing, ProcessRecord, EndProcessing
• use make-shell command to include it
• adds dll to set of cmdlets
• requires some registry manipulation

19
Cmdlet creation

• Cmdlet parameters
• add Parameter attribute
• Mandatorytruefalse
• Positionltindexgt
• others for in-pipeline action
• Return value any object
• native object facilities allow inspection
• can use arbitrary code

20
Example in script

• function MyWhere param ( scriptblockexpressio
  n )begin matches 0 process if (
  expression ) _ matches end "Found
  matches matches"

21
Execution Policy

• AllSigned
• require a digital signature and prompt
• user must agree to run script
• RemoteSigned
• only files from internet need to be signed
• default setting
• Unrestricted
• no signing required
• Attacks on AllSigned?