News for hackers. Stuff that matters.
Re:The increased use of PowerShell in attacks [pdf] by simooooo on Friday May 19, 2017 @03:52PM (#14378853)
are you nuts? its about 10x harder to use than c#, and twice as hard to debug.

I've come to the conclusion that its just better to write a small c# app than try and use powershell

Re:The increased use of PowerShell in attacks [pdf] by joeyaiello on Friday May 19, 2017 @04:29PM (#14379078)
PM on PowerShell here: if you have any of those small C# apps handy, I'd love to take a look at them to see what you're doing that's difficult in PowerShell.

Similarly, we're trying to make some improvements to debugging right now with PowerShell 6.0 [1] (the one that's cross-plat and built on .NET Core), and I'm very interested in hearing your feedback on how we can do a better job there.

Even if it's "fix your docs" or "too hard to learn", that's great info, especially coming from a C# guru.

[1]: https://github.com/powershell/powershell/issues?utf8=%E2%9C%...

Re:The increased use of PowerShell in attacks [pdf] by mpw222 on Saturday May 20, 2017 @12:56AM (#14381107)
Writing a robust, idiomatic PowerShell function of any complexity is deceptively challenging, and the background required to do it correctly is almost all unique to PowerShell. PS is a weird amalgamation of C#, Bash, Perl, VB and cmd-isms that ends up being incredibly confusing to basically everyone.

Try getting an experienced C# developer to write a PS function that:

- Initializes an IDisposable resource and deterministically disposes of it when the function terminates (successfully, with an error, or due to ctrl+C). - Honors the caller's $ErrorActionPreference/-ErrorAction. - Understands that catches won't catch "non-terminating" errors. - Throws errors without trashing the ErrorRecord so that the caller gets a meaningful stacktrace. - Copes with the difference between process working directory and PS working directory if a .NET method and a relative path are involved. - Doesn't blow up on a square bracket because someone didn't realize they needed -LiteralPath. - Doesn't accidentally write an unintended object to the pipeline. - Does something reasonable with pipeline input. - Doesn't get tripped up by type coercion magic - $a = @(); $a -eq $null - Uses multiple ParameterSets without creating ambiguity problems. - Doesn't get tripped up by PS silently swallowing exceptions thrown by property getters. - Uses some appropriate subset of language features and modules available across different versions of the OS and WMF. The OS based limitations are understandable. The hard dependencies that Microsoft's own products have on specific PS versions are not. - Is not super-slow.

It's not impossible, but it sure is hard (and takes a ton of boilerplate), and there aren't many resources out there to teach you how. It's all quick and dirty "how to do X" recipes for sysadmins that don't care about more than what they need to paste into a console.

To be clear, I actually mostly like PS I'm just trying to express a set of pain points here.

Re:The increased use of PowerShell in attacks [pdf] by joeyaiello on Monday May 22, 2017 @04:59PM (#14396900)
That list you just provided is actually an AWESOME list of things we should make more accessible/understandable in our documentation. There's a few that would also make great rules for PSScriptAnalzyer[1] (basically our linter; the LiteralPath one in particular would probably be easy to write as a warning).

At this point I should also plug our tooling improvements. First, our VS Code Extension[2] is AWESOME, debugging there has massively improved, there's snippet support for boilerplate with best practices, it integrates directly with PSScriptAnalzyer, and even enables some "quick fix" of linter warnings. We've also got something called Plaster[3] that does templating to encourage best practices (think of it like a "Yeoman for PowerShell").

But yeah, as we craft new docs for writing the best "cross-CLR, cross-platform" (aka universal, aka portable) PowerShell modules, I want to make sure we tick all these boxes.

Oh, and we believe we addressed the whole "different singleton version on different versions of Windows/WMF" thing by making sure that PowerShell 6[4] is x-copyable, fully side-by-side, and supported downlevel to Windows 7/2008 R2 (though Win7 support is currently busted, we're working through fixing it). If you've got a workload or an application that depends on a new feature of PowerShell, you can include PowerShell 6 app-local, or you can distribute it to machines in an environment through either MSI or a ZIP-based file copy.

As for Microsoft products that support specific versions: again, I totally hear you. The best thing you can do is push on those products their respective feedback mechanisms (almost everything is on the Feedback Hub or some product-specific UserVoice now) to support all versions of PowerShell. In the meantime, the side-by-side nature of PowerShell 6 means you can install the latest version without fear that you'll void your support or break existing scripts/workloads.

[1] https://github.com/PowerShell/PSScriptAnalyzer

[2] https://github.com/PowerShell/vscode-powershell

[3] https://github.com/PowerShell/Plaster

[4] https://github.com/PowerShell/PowerShell

Re:The increased use of PowerShell in attacks [pdf] by pweissbrod on Friday May 19, 2017 @05:50PM (#14379606)
As a touch-and-go end user I'll take you up on that at least with some anecdotes:

In 2007 I joined the powershell enthusiasts excited by the notion of a bash-like capability treating .NET constructs as a first-class citizen. I invested time into learning common use cases. Certain things you would THINK would be easy like loading a DLL as well as it's corresponding config file were actually quite difficult in practice which was a shame because the primary vision for powershell was to be flexible glue between compiled assemblies. Have you ever tried to invoke ms-test with powershell on a DLL which has a config xml?

I had a touch-and-go relationship with poweshell. I returned to use it a few years later to find that many of my powershell V1 scripts were obseleted by the powershell V2 runtime. Writing C#/.NET code to execute on many versions of windows this is rarely an issue. Writing powershell code to execute on many versions of windows you have a serious problem on your hands as the commands syntax and general practices vary significantly between versions.

To this day googling for examples on how to accomplish something basic such as running a dos command line call with parameters constructed within powershell is not only highly vexing for the occasional casual user such as myself but many of the answers I see in blogs or stackoverflow are completely temporal and you need to be careful to look for results dating around 2013 for powershell v2 because anything before that wont work, but not too new because v4 has a new approach and that would require a service pack not all my users can currently procure. Not to mention everyone writes powershell in a different style. You often end up with a handful of different code examples that look wildly different each with their own issues as well.

Sure there are expert powershell users out there with muscle memory that can write elegant solutions for version incompatibility issues and common gotchas, however for the casual seldom user the overall experience that too much frustration, less than intuitive approach and 10 ways to solve a common problem. It feels sort of like running perl in a dos prompt that is constantly changing. Compare this with zen of python where [There should be one-- and preferably only one --obvious way to do it.] I find myself installing python runtime and avoiding powershell when I'm required to make something of significant complexity and high compatibility.

Re:The increased use of PowerShell in attacks [pdf] by contextfree on Friday May 19, 2017 @09:03PM (#14380445)
I've tried to use PS for some system automation glue using .NET libraries I was also developing, the biggest irritation was that code written with some common C#/.NET idioms are awkward to interop with via Powershell. It's been a while (and this was with PS v4 I think so some of this may have gotten better in later versions) but off the top of my head the problematic stuff included:

* Referencing dependencies (if you're used to "add reference" and "using" it's awkward having to write a bunch of Assembly.Load that then needs to be maintained redundantly with the C#; it would be nice if PS could somehow work with VS/MSBuild projects)

* Calling extension methods (ties in with above since in C# they depend on "using")

* Calling generic methods

* Calling overloaded methods

* Calling async methods

There are workarounds for all the above but put together they definitely make PS less pleasant/useful for me.

Also, much of the above also applies to interop with WinRT which I think is becoming important (as much of the value of PS comes from good access to the underlying system, and more and more Windows functionality is being exposed through WinRT APIs).

The other problem I've had is performance - for example, PS could be useful for some of the same text processing tasks for which Bash is often used (and I'd prefer it for its stronger programming language/object system), but in my experience is dramatically and prohibitively slower when dealing with large amounts of text.

Re:The increased use of PowerShell in attacks [pdf] by defined on Friday May 19, 2017 @06:07PM (#14379696)
One thing I'm having conniptions over is the inability to automate the installation of TLS certificates into stores other than the local machine or user. I'm referring specifically to the NTDS store, where I need to replace certs used for LDAPS, and I can find no way to do this outside of using MMC certificate store snapins.

If PowerShell could support this, it would allow fully automated cert replacement for those of us who use Let's Encrypt on Windows (ducks)

Re:The increased use of PowerShell in attacks [pdf] by c0wb0yc0d3r on Friday May 19, 2017 @04:58PM (#14379306)
If I could make a suggestion about debugging scripts.

It doesn't seem that I can currently debug scripts that are contained in a module folder, but not directly the script being called.

If I have a module file that looks like this:

Get-ChildItem -Path $PSScriptRoot\.ps1 | ForEach-Object{ .$_.FullName } # source the script files Export-ModuleMember -function -* # export those sourced scripts

I am not sure how it works exactly, but if I am writing a new cmdlet, Get-HackerNews.ps1, the breakpoints aren't hit in ISE. It would be super cool if it did.

------

Also is there guidance on module structure? Right now it looks like the docs indicate that all the cmdlets should be placed in the .psm1 file, but to me that sounds like it would get rather unmaintainable very quickly. Just looking at the one my dev team has created, we have nearly 50 exported functions. Maybe our our module could be broken up, but that would still leave us ~10 cmdlets per module.

Re:The increased use of PowerShell in attacks [pdf] by hobs on Friday May 19, 2017 @09:40PM (#14380587)
Here is an example of a real project that uses PowerShell to help DBA automation, you dont include them in your psm1, just dot source them, see https://github.com/sqlcollaborative/dbatools/blob/master/dba... for an example.
Re:The increased use of PowerShell in attacks [pdf] by c0wb0yc0d3r on Thursday May 25, 2017 @10:00AM (#14417328)
Awesome, that is similar to what I do right now.
Re:The increased use of PowerShell in attacks [pdf] by simooooo on Friday May 19, 2017 @08:20PM (#14380285)
I have a bunch of scripts that I use for various things.

- One which stops IIS app pools before a deployment (30 of them). I wanted to stop them all in parallel but found this far more difficult than executing a list of Tasks in c#. So I now just run c# console app to do it

- one which runs msdeploy commands against a web server and had many issues dealing with passing parameters down to msdeploy. I can't quite recall but I think it was either quotes or spaces related.

The ISE as it's called is very very basic. Not what I'd expect from MS. I'd like a full debugger.

There also seems to be a potential security risk of having editable text file scripts on a server Vs a compiled exe.

Re:The increased use of PowerShell in attacks [pdf] by 13of40 on Saturday May 20, 2017 @01:53AM (#14381228)
Off-topic, but if I say "1..10 | Get-Widget" and Get-Widget doesn't have an InputObject parameter, the input object should be bound to the first positional parameter. Likewise, "dir | $_.length" should be semantically equivalent to "dir | %{$_.length}". Right now the former is an error because the second pipeline element is an expression, but you could implicitly make it a foreach. You could do either of these without a breaking change.
Re:The increased use of PowerShell in attacks [pdf] by kuschku on Friday May 19, 2017 @06:35PM (#14379846)
One major complaint I have with powershell is just how completely horribly slow the UI is.

Compared to what cygwin’s bash does, it’s like an entirely different world.

Re:The increased use of PowerShell in attacks [pdf] by MaulingMonkey on Friday May 19, 2017 @08:49PM (#14380396)
Different guy but same conclusion here (write it in C# instead of powershell). The main pain points I run into:

1) Powershell mingles "process stdout" and "function return" to be one and the same. While this kind of makes sense, unless I'm extremely fastidious about redirecting everything I call to $null, chances are I'm not returning what I expect to return. The end result is I shy away from doing anything that needs to return values (rather than output) in Powershell, which is kind of important for anything nontrivial. I tend to set globals like I've gone back to the Apple 2 and started programming in BASIC again as a result, which gets messy real quick. Processing stdout/stderr in C# is a little annoying by comparison, but easily fixed.

2) Syntax changes in updates. When I installed powershell tools for VS, my scripts broke - to fix them I had to replace e.g.:

  info "$vmGuid: has BuildMatrix tags: $tags"
With:

  info "${vmGuid}: has BuildMatrix tags: $tags"
And:

  logCmd {& $VBM -- clonevm $OriginalVmGuid --register --name $NewCloneId}
  logCmd {& $VBM -- modifyvm $NewCloneId --natpf1 "ssh,tcp,$SshHost,$SshPort,,22"}
  logCmd {& $VBM -- startvm $NewCloneId --type headless}
  waitUpTo 60 3 -Sensitive $true {& $VBM -- guestcontrol $NewCloneId run --exe "/bin/sh" --username "$Username" --password "$Password" -- '/bin/sh' -c "mkdir ~/.ssh; echo '$PubKey' >> ~/.ssh/authorized_keys"}
  waitUpTo 60 3 {& $Ssh -- -o NoHostAuthenticationForLocalhost=yes -o ConnectTimeout=60 -o BatchMode=yes -p $SshPort $Username@$SshHost -- '/bin/sh' -c "echo Server ready" 2>&1}
With:

  logCmd {& $VBM clonevm $OriginalVmGuid --register --name $NewCloneId}
  logCmd {& $VBM modifyvm $NewCloneId --natpf1 "ssh,tcp,$SshHost,$SshPort,,22"}
  logCmd {& $VBM startvm $NewCloneId --type headless}
  waitUpTo 60 3 -Sensitive $true {& $VBM guestcontrol $NewCloneId run --exe "/bin/sh" --username "$Username" --password "$Password" -- '/bin/sh' -c "mkdir ~/.ssh; echo '$PubKey' >> ~/.ssh/authorized_keys"}
  waitUpTo 60 3 {& $Ssh -o NoHostAuthenticationForLocalhost=yes -o ConnectTimeout=60 -o BatchMode=yes -p $SshPort $Username@$SshHost -- '/bin/sh' -c "echo Server ready" 2>&1}
Those "--"s I removed were mandatory in PowerShell 2 for at least some of these commands, yet caused problems in later versions - I don't even know how to write this in a way that will work on multiple powershell versions. I guess I have to explicitly pin -Version when invoking PowerShell all the time? The now simple problem of "How do I get this running consistently on multiple computers" has now turned into an IT and debugging headache. Meanwhile, C# projects get consistently built with a single VS and C# compiler version, and machines I install to are just running the even more stable bytecode.

3) Default installs lag way behind - e.g. Windows 7 only comes with PowerShell 2 by default, so you don't even have things like Invoke-WebRequest, forcing you to write your own or get your IT department to install an updated version for everyone. C# just feels like it has more "batteries included" even for older .NET targets.

4) Figuring out exactly what types are expected vs what I happen to be using is a general muddle in Powershell for any sort of collection in my experience. C#'s static typing, clear errors, and intellisense in general is just extremely hard to beat.

Re:The increased use of PowerShell in attacks [pdf] by throwaway7645 on Friday May 19, 2017 @09:03PM (#14380443)
Yes...lots of frustration when I write a script and co-workers can't use it. I'm glad they're adding stuff, but the default installs are ancient in a lot of companies.
Re:The increased use of PowerShell in attacks [pdf] by 13of40 on Friday May 19, 2017 @04:09PM (#14378962)
You're not comparing your 1000th day of C# programming to your first day of PowerShell programming by any chance, are you?
Re:The increased use of PowerShell in attacks [pdf] by simooooo on Friday May 19, 2017 @08:23PM (#14380292)
About 100 to 1.
Re:The increased use of PowerShell in attacks [pdf] by jug on Friday May 19, 2017 @04:19PM (#14379009)
The beautiful part about Powershell is that it's object oriented so that it doesn't depend on "plain" textual output formats. Something like a bash command line and piping text outputs, struggling with regexps in awk or whatnot while crossing your fingers no update will break your scripts felt pretty archaic and a wrong way to go about it when I had started to get more fluent in PS. (which btw is OSS and available on Linux now too)

But the worst thing I came across with Powershell is this. The fricking return semantics. http://stackoverflow.com/questions/10286164/function-return-...

Re:The increased use of PowerShell in attacks [pdf] by InclinedPlane on Friday May 19, 2017 @05:01PM (#14379330)
I wish I could give out a prize for comments like this. "I tried to use X language casually for a few days and didn't like it, it must objectively suck!"

PowerShell isn't 10x harder to use than C#, how do I know that? Because many people use PowerShell regularly in their day to day jobs, and do so quite successfully. Most people who actually use PowerShell don't complain about how hard it is.

It is harder than C# to debug, probably more than twice as hard, actually. Does that make it impossible to program in? Hardly. There are tons of other languages that are roughly equally difficult to debug, especially many of the dynamic languages: PHP, Python, etc. People have been building things of tremendous value with hard to debug languages for ages. The fact that C# has such a good debugging story is great, but it's not the end-all be-all of a language. Also, PowerShell has some significantly advanced debugging tools compared to a lot of other dynamic languages.

Re:The increased use of PowerShell in attacks [pdf] by ams6110 on Friday May 19, 2017 @09:40PM (#14380583)
Different strokes. Different people grasp concepts differently.

I can say that every programming language that I grew to love, I liked almost immediately. The ones that make no sense from the get-go, I don't spend much time on.

Re:The increased use of PowerShell in attacks [pdf] by JadeNB on Saturday May 20, 2017 @08:19AM (#14382059)
> I can say that every programming language that I grew to love, I liked almost immediately. The ones that make no sense from the get-go, I don't spend much time on.

Surely the second sentence is the reason for the first? If you don't give languages that make a bad first impression a second chance, then you have no idea whether you would have grown to love one of them. (Certainly you aren't obliged to find out, but to regard this as evidence that you wouldn't have liked them I think is reversing causality.)

Re:The increased use of PowerShell in attacks [pdf] by czechdeveloper on Friday May 19, 2017 @04:10PM (#14378964)
They just have different places. I use both and really Powershell is not 10x more difficult. It's just different language with different goals.
Re:The increased use of PowerShell in attacks [pdf] by c0wb0yc0d3r on Friday May 19, 2017 @04:17PM (#14378998)
I agree that powershell can be hard to debug but I would not say that C# is exactly easier to use. Some cases sure, but when it comes to machine management especially, powershell destroys C#. Another example of powershell being superior to C# would be ist ability to interact with RESTful APIs and parsing JSON (see Invoke-RestMethod ConvertFrom-Json, and ConvertTo-Json). Not saying that it can't be done in C#, but definitely far easier in powershell.
Re:The increased use of PowerShell in attacks [pdf] by braveo on Friday May 19, 2017 @05:32PM (#14379511)
Powershell works well as a shell, but fails specacularly as a programming language.

The whole "I can run this script on 100 different machines at once super easy" is fine, but lets see you try to write some rigorous code in PS and the come back and tell me how it's easier than C#.

They both have their place.

Re:The increased use of PowerShell in attacks [pdf] by Arnavion on Friday May 19, 2017 @06:49PM (#14379911)
I once took over a certain repository that builds a dozen or so disparate external libraries with dependencies between themselves. The original developer of the repository did it by manually remembering which library had which dependencies and running .bat scripts to build them in order.

When I took over it, I wrote a PS script to automate the whole build. The script contains a description of each library's dependencies, so it knows what order to build all the libraries in. Each library is built in its own "job" using Start-Job, so the builds are also maximally parallelized; the script is essentially a loop of two functions: `for each library -> if library's dependencies have all been built -> start parallel job to build library` and `for each job -> if the job has finished -> mark the library as built`.

I would not write it in C#. Most of the build steps for each library involve running other processes, so using a shell DSL rather than multiple Process.Start()+Process.WaitForExit() is convenient. Even things like copying files is more convenient using Copy-Item than C#, especially since the PS versions support globs.

I would hope a build tool counts as both rigorous code as well as justifies PS as a programming language.

Aside: The repository was forked by some other people who did not like / could not read PS, so they rewrote it in Python. The Python version is several times larger than the PS version, though to be fair to it it's also more generic and has more features. A lot of that verbosity though does come from the more verbose code for spawning processes from Python compared to PS.

Re:The increased use of PowerShell in attacks [pdf] by braveo on Saturday May 20, 2017 @10:24AM (#14382498)
Sure, but I bet your PS code isn't rigorous or bullet proof.

and I should mention, I feel like that's a solved problem. I don't know the specifics of the project, but it's hard for me to buy that you needed to write dependency checker in PS.

Re:The increased use of PowerShell in attacks [pdf] by arghimonmobile2 on Saturday May 20, 2017 @12:06AM (#14380976)
Soooo... you reimplemented GNU Make?
Re:The increased use of PowerShell in attacks [pdf] by JadeNB on Saturday May 20, 2017 @08:17AM (#14382055)
> Soooo... you reimplemented GNU Make?

Well, it puts Arnavion in good company: https://en.wikipedia.org/wiki/List_of_build_automation_softw... .

Re:The increased use of PowerShell in attacks [pdf] by Arnavion on Saturday May 20, 2017 @12:40AM (#14381069)
Pretty much, but the build steps are more complicated than what make supports on its own, so even a makefile would have had to be augmented by shell scripts anyway.
Re:The increased use of PowerShell in attacks [pdf] by yks on Friday May 19, 2017 @09:23PM (#14380522)
I started using F# scripts instead of PowerShell or compiled C#. Just got to copy Fsi.exe and a few other dlls onto the target machine for it to work.
Re:The increased use of PowerShell in attacks [pdf] by throwasehasdwi on Friday May 19, 2017 @04:23PM (#14379038)
I second this. Powershell syntax is almost as bad as Bash. I have no idea why they didn't just make a command-line version of C#, it's a far better designed language.
Re:The increased use of PowerShell in attacks [pdf] by dahart on Friday May 19, 2017 @04:46PM (#14379214)
Bash and Powershell are shells, they are command languages, and not programming languages like C#. That distinction, while in many ways subtle with tons of overlap, is the primary factor in shell syntax being crappy as a "language" -- it's because command evaluation is (necessarily) prioritized over language design. There is a good reason that no shells exist that have a "better designed language." As well as good reasons that no well designed programming language makes a good shell. They solve different problems, and I don't think C# would make a good command shell without significant syntax compromises.
Re:The increased use of PowerShell in attacks [pdf] by thaumasiotes on Saturday May 20, 2017 @02:07AM (#14381255)
> There is a good reason that no shells exist that have a "better designed language." As well as good reasons that no well designed programming language makes a good shell.

Where does tcl fit into things for you?

Re:The increased use of PowerShell in attacks [pdf] by dahart on Saturday May 20, 2017 @10:24AM (#14382494)
Hmm good question! It's been a very long time since I used tcl/tk, but I just gave myself a 2 minute refresher and browsed the docs. I would say Tcl is a programming language, not a system shell. The tcl tutorial concurs, calls tcl specifically a 'dynamic programming language', and compares tcl to python.

I'm definitely using 'shell' and 'command' in a narrow sense. I meant to add contrast between PowerShell and C#, by calling one a command shell and the other a programming language. But both words have been used with much broader meanings. So I'll try to be a little more careful and say that what I'm really talking about is a system shell and system commands, where a system command means direct access to executable files on the system, and system shell means an interpreter that provides system commands.

Even though Tcl stands for 'command language', it's not talking about system commands using the same distinction I made above. Tcl's use of "command" is referring to programmer-defined functions & API, and it is not referring to system commands.

Tclsh is a shell, but I wouldn't call that a system shell like PowerShell or bash. It is an interactive tcl interpreter, but not really a system shell. Tclsh isn't something sysadmins would typically use, right?

Perhaps the defining characteristic of a system shell (as opposed to a programming language) is system commands; running executable files on the system can be done by typing the bare name of the file, without any other syntax in the way. That is true in powershell and bash, and not true in C#, tcl, python, etc. To run a system command in tcl, you have to use 'exec' or 'open', you have to use 'glob' to get file completion, and there's required programming language syntax frequently involved in passing arguments. In tcl you have to use $env(var) or $::env(var) to get an environment variable rather than $var. Those are the kinds of things that shells provide with little or no syntax, and exactly the kind of stuff that begins to compromise language syntax and language design in favor of promoting system commands to first class status.

BTW, you got me curious about tcl again. I never used it enough to get a sense of what it's best used for. What kinds of things would you use tcl for yourself? Do you like to use it for system shell tasks instead of bash? (I know there are certainly legit reasons to do that.) What kinds of programs would you start in tcl?

Re:The increased use of PowerShell in attacks [pdf] by maxxxxx on Friday May 19, 2017 @11:22PM (#14380880)
You would have thought that they had learned from bash and made a really nice scripting language. Instead it just has another set of weirdnesses compared to bash.

they definitely should have gone with some variation of C#.

Re:The increased use of PowerShell in attacks [pdf] by oneZergArmy on Friday May 19, 2017 @04:36PM (#14379132)
It's made for sysadmins like me who think C# is too hard.
Re:The increased use of PowerShell in attacks [pdf] by throwaway7645 on Friday May 19, 2017 @09:08PM (#14380463)
Or the kind of programming you do at work is easier solved by short scripts such as Perl, Python, PS, Bash, or Batch instead of something like Java where one has to write a lot of scaffolding.
Re:The increased use of PowerShell in attacks [pdf] by Scaevolus on Friday May 19, 2017 @04:52PM (#14379267)
Sometimes it's better to write something in a more advanced language, but for small tasks it's hard to beat the overhead of a shell!

There are crossover points (varying by person) where a scripting language is preferable to a shell, and where a strongly-typed language is preferable to a dynamically-typed language.

Re:The increased use of PowerShell in attacks [pdf] by throwaway7645 on Friday May 19, 2017 @09:12PM (#14380477)
PowerShell is a scripting language though, but it can also be used as a shell. The syntax is more advanced now that it has classes...etc.
Re:The increased use of PowerShell in attacks [pdf] by nthcolumn on Friday May 19, 2017 @04:32PM (#14379102)
Agree - I find the thing incomprehensible without some sort of intellisense running (which I abhor I tell you abhor!) seems arcane and weird to me and much prefer c# but "WHY ARE ATTACKERS USING POWERSHELL?" - simply because its already there probably? And cmdlets are a bit like nmap scripts - if you can read lua you can probably spitball them together. I'm not sure that ps is amazingly more powerful - just all we before was .bat from hell and debug sadly gone now...
Re:The increased use of PowerShell in attacks [pdf] by drak0n1c on Friday May 19, 2017 @08:01PM (#14380217)
He said "as a complete non-techie".
Re:The increased use of PowerShell in attacks [pdf] by Dolores12 on Friday May 19, 2017 @04:01PM (#14378913)
There are people that need not debug.