29329e1707
Merge pull request #8 from obscuresec/master
...
Add checks to terminate script if not running in proper environment.
2013-07-03 17:44:35 -07:00
eb85e1ce9d
Terminating Errors Added
...
Added checks to ensure that the script is being ran on a domain-joined machine and with a domain account.
2013-07-03 20:31:53 -04:00
371c65c9a7
Updated Get-GPPPassword
2013-07-03 05:46:44 -04:00
717950d00c
Added Get-Keystrokes
...
Get-Keystrokes is a PowerShell keylogger
2013-06-30 11:15:02 -04:00
94751bc156
New-Object proxy function compatibility fix
...
I was calling the [Guid]::TryParse method that was only present in .NET
4 so this wasn't working in PowerShell v2.
2013-06-08 09:47:16 -04:00
12d1ebaac2
Forgot to add -Property param to CLSID option
2013-06-05 22:13:26 -04:00
e210c89f39
Added New-Object proxy function
...
You can provide a CLSID (i.e. a Guid) to New-Object via the -ComObject
parameter in addition to a ProgId.
2013-06-05 22:03:27 -04:00
02c982dd18
Type names added to Get-NtSystemInformation
...
When displaying handle information, you can now filter by and display
object type names: Get-NtSystemInformation
2013-06-01 09:55:04 -04:00
dfec277813
Added Invoke-ReflectivePEInjection
...
Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection
is a vast improvement over Invoke-ReflectiveDllInjection. It adds the
following features:
* Now supports loading exe files in memory
* Supports reflective dll injection into a remote process
* Additional sample Visual Studio solutions
2013-05-31 19:35:26 -04:00
6e5338c8a3
Fixed architecture detection bug in Get-PEB
...
I was checking processor architecture when I should have been checking
OS architecture.
2013-05-31 18:56:57 -04:00
9b4b3dcc73
Silly me. Just discovered the SetOffset method.
...
Thanks @JosephBialek!
2013-05-29 18:32:24 -04:00
7d5e884c3f
ProcessParameters now displays properly
2013-05-25 08:58:24 -04:00
91bd44f0f0
Get-PEB now parses _RTL_USER_PROCESS_PARAMETERS
2013-05-24 21:16:43 -04:00
218f0cb24b
"Best practice" improvements to Out-Minidump
2013-05-18 09:46:00 -04:00
3d27e6b7de
_SYSTEM_HANDLE_INFORMATION prints as a table now
2013-05-16 20:40:21 -04:00
c98734a764
Added _SYSTEM_LOCK_INFORMATION struct
...
Yet another method of leaking kernel pointers.
2013-05-16 20:21:04 -04:00
af04f7e528
Added Out-Minidump
...
Out-Minidump writes a process dump file with all process memory to disk.
This is similar to running procdump.exe with the '-ma' switch.
2013-05-15 20:54:16 -04:00
c17f16bf0e
Cleaned up Get-NtSystemInformation
...
* Removed the unnecessary NTSTATUS entries
* Used splatting instead of backticks
* Fixed a n00b memory management error as well.
2013-05-13 21:18:48 -04:00
a1cb7db1d0
Added an idiot filter to Watch-BlueScreen
2013-05-13 20:26:05 -04:00
2a17b8fb56
Added Watch-BlueScreen
...
Causes a blue-screen (bugcheck) to occur.
2013-05-13 20:01:59 -04:00
f32a572fb9
Object access mask now displays properly
2013-05-12 15:28:44 -04:00
a1a842a218
Removed duplicate type definition
2013-05-12 13:22:30 -04:00
781e48c570
Removed some extraneous comments
2013-05-12 12:41:32 -04:00
ea0dc9a2b8
Added Get-NtSystemInformation
...
Get-NtSystemInformation is a wrapper function for
NtQuerySystemInformation. It is a swiss-army knife tool for obtaining
internal OS information. It can currently be used to query the
following: global flags, handles, objects, kernel pool allocations, and
loaded kernel modules
2013-05-12 10:27:15 -04:00
9c95f0bfda
Removing Get-KernelModuleInfo
...
Making way for Get-NtSystemInformation. Loaded kernel module information
can be viewed with `Get-NtSystemInformation -ModuleInformation`
2013-05-12 10:18:49 -04:00
9d7ee39166
Removed test code in Invoke-ShellcodeMSIL
...
There was some test code at the end of Invoke-ShellcodeMSIL that would
cause the function to execute when the script was dotsourced.
2013-05-12 10:17:00 -04:00
3d75f54835
Added ConvertTo-String
...
ConvertTo-String converts the bytes of a file to a string that has a
1-to-1 mapping back to the file's original bytes. ConvertTo-String is
useful for performing binary regular expressions.
2013-05-10 16:24:19 -04:00
87d01743d9
Merge pull request #3 from garignack/master
...
Merged Find-AVSignature performance improvements from garignack. Thanks, garignack!
2013-05-06 03:26:31 -07:00
6d9d805f1e
Code cleanup based upon discussion comments
...
Added comment-based help parameter, added additional parameter
validation, piped ReadStream.seek command to out-null to prevent output
to stdout.
2013-05-02 23:21:25 -04:00
acc46c71f7
Find-AVSignature Performance Improvements
...
Updated code to use [System.IO.FileStream] class with a buffer (64kb
default) to greatly increase performance, especially when handling large
files.
Updated $EndBytes validation logic to change it to a valid value rather
than throw an error.
2013-05-02 01:29:19 -04:00
9d286e511f
Added ARM support to Get-PEHeader
...
Also fixed various pointer width bugs
2013-04-28 22:17:14 -04:00
2224f4dca9
Adding reflective DLL loading capability
...
Adding Invoke-ReflectiveDllInjection. PowerSploit now has reflective DLL
loading capabilities!!! Thanks to Joe Bialek @JosephBialek for writing
this awesome code!
2013-04-06 07:04:16 -04:00
014a7bb421
Adding Invoke-ShellcodeMSIL
...
Invoke-ShellcodeMSIL executes shellcode without making any Win32
function calls.
2013-04-05 14:06:58 -04:00
1e79c0f793
Fixed x86 bug in Get-MethodAddress
...
Get-MethodAddress was not working correctly in 32-bit PowerShell because
it was returning a [UInt64] value when it should have been a [UInt32].
This fix will detect if PowerShell is running as 32 or 64-bit and define
its return type accordingly.
2013-04-05 11:04:48 -04:00
577be2fea5
Adding Persistence module
2013-04-04 15:10:09 -04:00
2ff300c03a
DownloadFromMSSymbolServer is a better name
2013-03-10 14:27:45 -04:00
4f7e59c5a7
Fixed export parsing bug in Get-PEHeader
2013-03-10 14:14:11 -04:00
60c49734df
Added DownloadEXEFromMSSymbolServer method
...
After parsing a PE header with Get-PEHeader, you now have the option of
downloading the original executable from Microsoft's symbol server for
reference/comparision.
2013-03-10 11:29:53 -04:00
4475824be0
Updated 64-32bit conversion logic for Metasploit
2013-02-17 18:12:56 -05:00
feca7f2513
Get-MethodAddress now returns an IntPtr.
...
It previously returned a UInt64. Returning an IntPtr makes more sense.
2013-02-17 18:12:00 -05:00
97a1a15120
Removed .git* files
...
They weren't relevant.
2013-01-23 19:32:53 -05:00
40eb187bca
Consistency improvements in comment-based help
2013-01-21 08:33:51 -05:00
46aead39c6
PowerSploit is now a respectable module!
...
PowerSploit just got a complete makeover! It is now comprised of a
collection of modules grouped by category.
2013-01-20 21:40:02 -05:00
03f34b1c1a
Updated PETools module file list
2013-01-20 21:37:23 -05:00
321d1f4c51
Corrections made to usage documentation
2013-01-20 21:36:49 -05:00
6e42ba1d39
Moved scripts to their respective modules.
2013-01-20 21:35:56 -05:00
3d83669635
Added 'AntivirusBypass' Module
2013-01-20 21:35:04 -05:00
a233d60908
Added 'CodeExecution' Module
...
* I unfortunately needed to change the names of Inject-Shellcode and
Inject-Dll to Invoke-Shellcode and Invoke-DllInjection in order to
confirm to proper verb naming.
2013-01-20 21:34:37 -05:00
b3bbe03e93
Added 'Exfiltration' Module
2013-01-20 21:32:41 -05:00
b53b6a03a5
Added 'Recon' Module
2013-01-20 21:32:27 -05:00
Matt Graeber