18.1 PowerShell, Python, and Bash Attack Automation

Domain 4, Attacks and Exploits, is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.10 is Given a scenario, use scripting to automate attacks. You already learned the attacks in 4.2 through 4.9: relay, pass-the-hash, host privilege escalation, web injection, cloud IAM mistakes, wireless, social engineering, and specialized systems. 4.10 is not a new attack class. It is a matching exam: which language and which library or framework automate a job you already know. It is also not objective 2.3. 2.3 modified short Bash, Python, or PowerShell snippets for recon and data shaping. 4.10 automates attacks. If the stem is still ping-skip and CSV, stay in Domain 2. If the stem is "enumerate Domain Admins from a PowerShell foothold," "speak SMB from Python," or "craft a TCP SYN with a library," you are in 4.10.

Work example.com the same way as every other Domain 4 chapter: stay inside written rules of engagement (RoE). A loop that hits the agreed host list is in play. A loop that sprays a payment-processor CIDR because a certificate SAN mentioned it is not. Tiny snippets in this section illustrate I/O, loops, and library names. They are not exploit payloads.

PowerShell: Windows automation and the named modules

PowerShell is the attack-automation language when the stem puts you on a Windows workstation, a domain-joined member, or a PowerShell foothold. Cmdlets return objects, not raw text you have to cut. That is why Active Directory (AD) search, session lists, and SQL Server audits live here instead of in Bash.

PowerSploit is a module collection

PowerSploit is a PowerShell module collection, not a single binary and not Metasploit. Testers import modules from the collection to automate post-exploitation jobs that 4.4 already named conceptually: host inventory, privilege-check helpers, persistence helpers, and other Windows post-exploit tasks. On objective 3.1, CompTIA listed PowerSploit as a discovery helper. On 4.10, the same family is an attack-automation answer: which PowerShell framework you load to automate Windows post-exploit work. When you pick it: the stem says PowerShell modules, a module collection, or "import the offensive PowerShell framework" after a Windows foothold. When you do not: the tester is on Kali with no PowerShell session and the job is SMB or DCE-RPC — that is Impacket. Do not pick PowerSploit as a Nessus replacement, as Kube-hunter, or as a packet crafter.

Exam trap: treating PowerSploit, PowerView, and PowerUpSQL as synonyms. PowerSploit is the collection. PowerView and PowerUpSQL are named members of the 4.10 PowerShell list with narrower jobs.

PowerView: AD situational awareness

PowerView is PowerShell Active Directory situational awareness and enumeration. It automates the AD questions 2.2 and 4.3 already taught: who is in Domain Admins, which computers have unconstrained delegation, who is logged on where, which ACLs grant GenericAll, what trusts exist. You pick PowerView when the stem wants PowerShell AD enum, not a BloodHound graph (that was 3.1) and not a SQL Server audit.

Illustrative — not an exploit:

Get-DomainUser -Identity j.smith
Get-DomainGroupMember -Identity "Domain Admins"

Native AD search cmdlets do a related job without PowerView:

Get-ADUser -Filter "Department -eq 'Finance'" -Properties MemberOf |
  Select-Object SamAccountName, MemberOf
Get-ADComputer -Filter "OperatingSystem -like '*Server*'" |
  Select-Object Name

Get-ADUser, Get-ADComputer, Get-ADGroup, Get-ADObject, and LDAP -Filter / -LDAPFilter strings are the exam's AD search bullets. When you pick AD search: the stem shows the Active Directory module, a domain-joined workstation, and a query for users, computers, or groups. When you pick PowerView: the stem names PowerView or wants situational-awareness helpers (sessions, ACLs, trusts) that testers associate with that module. When you pick neither: the job is SQL Server instance hunting — that is PowerUpSQL. Exam trap: answering BloodHound for every AD question. BloodHound is a graph. PowerView and AD search are PowerShell.

PowerUpSQL: SQL Server, not AD

PowerUpSQL is a PowerShell toolkit of SQL Server attack and audit helpers. It finds SQL instances, checks authentication mode, looks at impersonation and linked-server paths, and audits weak SQL configurations. When you pick it: the stem is Microsoft SQL Server on Windows and the tester already has a PowerShell session. When you do not: Domain Admin group membership (PowerView or AD search), SMB named pipes from Linux (Impacket), or crafting TCP flags (Scapy). Exam trap: "PowerUp is PowerUpSQL." Host privilege-escalation scripts are not the SQL Server module.

Constrained Language Mode and execution policy are speed bumps

Constrained Language Mode (CLM) restricts which .NET types and language features a PowerShell session may use. Many PowerSploit-style helpers expect a Full Language session. If the stem says CLM is on, the helper does not run as written. Execution policy (Restricted, RemoteSigned, AllSigned, Unrestricted) controls whether a .ps1 file runs. If the stem says Restricted, the script file did not execute.

These are exam speed bumps, not a bypass lab. PT0-003 is testing whether you notice the control. The correct answer recognizes that CLM or execution policy blocked the automation, then you pick a different authorized path: an approved cmdlet, a signed script the client already allows, or a different language the RoE permits. This guide will not walk through policy bypasses, language-mode downgrades, or encoded-command tricks. Exam trap: picking "bypass execution policy" as the 4.10 skill being tested. The skill is matching the library, then noticing the control.

Bash: I/O and data manipulation as attack glue

Bash is attack-automation glue on Linux tester boxes (Kali, Parrot, a Linux jump host). CompTIA names two Bash ideas: input/output management and data manipulation. You are not authoring a new exploit. You are looping in-scope targets, feeding one tool's output into the next, and cutting the fields you need.

I/O management is redirection and pipes:

• > overwrites a file; >> appends
• < reads a file as stdin (a target list)
• 2> sends stderr; 2>&1 merges stderr into stdout
• >/dev/null discards a body you do not want in the attack log
• | pipes stdout into the next command

Data manipulation is cut, awk, grep, tr, sort, and uniq on tool output: keep the IP, drop the banner, select lines that contain 445/tcp.

Illustrative glue — not an exploit:

while read -r host; do
  grep -E ':445/' "scan-$host.txt" | cut -d: -f1 >> smb-hosts.txt
done < inscope.txt

The while read loop walks in-scope names. < inscope.txt is input management. grep and cut are data manipulation. >> appends survivors. If the exam asks what happens when scan-mail.txt has no port 445, mail is simply omitted. If it asks why errors vanished, look for 2>/dev/null.

When you pick Bash: Linux screenshot, a file of targets, pipes, redirects, or field-cutting. When you do not: AD cmdlets on a Windows member server (PowerShell), or SMB and Kerberos protocol objects (Impacket). Exam trap: rewriting a working Bash pipe as PowerSploit because 4.10 listed PowerShell first.

Python: Impacket and Scapy

Python is the language of libraries when Bash glue is not enough and you are not in a Windows cmdlet environment.

Impacket is a Python library of SMB, DCE-RPC, and Kerberos protocol implementations for Windows networks. From a Linux tester box, Impacket is how you automate jobs 4.2 and 4.3 already taught: SMB sessions, RPC calls, Kerberos exchanges, and related Windows-network tradecraft. When you pick it: the stem says Python plus SMB, named pipes, DCERPC, Kerberos, or Windows protocol automation. When you do not: Ethernet, IP, or TCP flag crafting (that is Scapy), PowerShell AD group membership (PowerView or AD search), or SQL Server audit from a Windows session (PowerUpSQL). Exam trap: calling Impacket a packet crafter. It implements Windows application protocols, not a generic frame builder.

Scapy is packet crafting in Python. You assemble IP, TCP, UDP, or other layers, set flags and fields, and send or sniff. 4.2 already used packet crafting as an attack type; 4.9 listed Scapy among specialized-system tools. On 4.10, Scapy is the Python library that automates that crafting.

Illustrative — not an exploit payload:

from scapy.all import IP, TCP, send
pkt = IP(dst="10.18.0.10") / TCP(dport=80, flags="S")
send(pkt)

When you pick Scapy: unusual flags, custom headers, protocol-field tests, or "craft a packet in Python." When you do not: "authenticate to SMB from Python" (Impacket) or "loop nmap greppable output" (Bash).

Pick the language from the OS and the API

Worked example.com automation

The tester has a Linux box and a Windows foothold on WS-018 in corp.example.com. RoE lists the user VLAN and the SQL cluster. From Linux, Impacket automates SMB and RPC work against in-scope file servers. Scapy is the wrong pick for that SMB session. On WS-018, AD search or PowerView lists finance users and group membership; PowerUpSQL is the follow-on when the stem shifts to the SQL cluster. Bash on Kali cuts 445/tcp hosts from a scan file and loops only those names. If PowerShell CLM is enabled on WS-018, PowerSploit helpers that need Full Language do not run as written — report the control, and do not treat a bypass as the 4.10 answer.

Sequence on the exam: name the OS, name the job (AD, SQL, SMB, packets, or glue), then pick PowerSploit, PowerView, PowerUpSQL, AD search, Bash I/O, Impacket, or Scapy.