2e7dc43edb
Update to latest Mimikatz, add sanity checks
...
Updated to the latest Mimikatz build. Added sanity checks to ensure that
32bit PowerShell isn't being run on a 64bit OS which will cause Mimikatz
to fail.
2015-02-16 23:16:31 -08:00
93bc214659
Adding PEBytes parameter
...
Added PEBytes parameter for reflectively loading a PE file passed as a
byte array to the script.
2015-01-26 09:26:43 -08:00
90a05de7a6
Bugfix: Resolving ordinals in remote dll injection
...
Thanks to sixdub for finding and fixing a bug when resolving functions
by ordinal in remote processes.
2015-01-07 21:08:58 -08:00
dc1a5e519f
Add-Persistence bugfix
...
When file paths were specified, they were not being properly validated.
2014-11-17 08:24:54 -05:00
956e4c968a
Moving all RE functionality to PowerShellArsenal
...
https://github.com/mattifestation/PowerShellArsenal
PowerSploit will now stay true to its roots of being a purely offensive
PowerShell module.
2014-11-16 10:26:11 -05:00
97034006f6
Loading of an SSP no longer requires a reboot.
2014-10-01 23:17:56 -04:00
4daac216c8
Merge pull request #56 from clymb3r/master
...
Added -PassThru to Invoke-TokenManipulation
2014-10-01 20:49:35 -04:00
0ca33b0347
Added Install-SSP and Get-SecurityPackages
2014-10-01 20:47:14 -04:00
ba02a11687
Added -PassThru to Invoke-TokenManipulation
...
Thanks to Run Mariboe for the contribution to Invoke-TokenManipulation
adding the -PassThru flag for newly created processes. Version increased
to 1.11.
2014-09-28 19:29:44 -07:00
9d412f0d6a
Updating the script style guide #2
2014-09-13 12:39:19 -04:00
6df4cf971b
Updating the script style guide
2014-09-13 12:37:50 -04:00
258c760c61
Adding MBR infector Set-MasterBootRecord
2014-08-29 21:44:14 -04:00
2e00756b59
Removing New-Object proxy function
2014-08-09 20:26:17 -04:00
36e1e29987
Merge pull request #52 from clymb3r/master
...
Bug fixes to Invoke-ReflectivePEInjection
2014-07-12 07:46:32 -04:00
03b8d5c6b4
Bug fixes to Invoke-ReflectivePEInjection
...
Fixed a bug where calling GetProcAddress by ordinal instead of procedure
name failed.
Fixed a bug where reflectively loading an EXE will cause the entry
function (main()) to be called twice instead of once as expected.
Added a ForceASLR flag to force ASLR to be used even if the PE file
doesn't officially support ASLR.
Some minor other changes.
2014-07-10 22:40:01 -07:00
b43429dd3c
Removed required module statement from Capstone
2014-07-10 19:28:47 -04:00
225fbfbc86
Updated Get-VaultCredential name in README
2014-06-30 17:02:03 -04:00
8c2411ccf3
Get-VaultCredential now takes the singular form.
2014-06-30 15:20:48 -04:00
dc3cab2c9f
Invoke-DllInjection now calls RtlCreateUserThread
...
Calling CreateRemoteThread on lsass.
Bug fix: Invoke-DllInjection was checking the processor architecture
when it should have been validating the OS architecture. This would
cause Invoke-DllInjection to fail on a 32-bit OS with a 64-bit
processor.
2014-06-21 11:29:46 -04:00
29a5d48c3f
Adding Mayhem module and Set-CriticalProcess
2014-06-19 20:28:50 -04:00
80ffa19fa3
Removing Watch-BlueScreen
...
This vulnerability was patched a while ago making this function largely
irrelevant.
2014-06-19 20:16:26 -04:00
3444a0700e
Updated Get-VaultCredentials - Package SID
...
Package SIDs are now displayed for Win8 apps. Both the package SID and
secret key are requirements for authenticating to Win8 app servers.
2014-05-31 21:22:22 -04:00
890247deec
Issue #43 - Adding Get-VaultCredentials
...
Displays Windows vault credential objects including cleartext web
credentials.
2014-05-30 21:22:31 -04:00
4567547d6d
Merge pull request #49 from clymb3r/master
...
Update to latest Mimikatz (crash fix on Win7/8)
2014-05-20 13:52:14 -04:00
6e56d40662
Update to latest Mimikatz (crash fix on Win7/8)
...
The latest version of Mimikatz fixes a crash that happens on Windows7/8
(and server versions) after installing the latest Windows updates.
2014-05-20 09:34:09 -07:00
67ed1d71b4
Merge pull request #44 from clymb3r/master
...
Updated to latest Mimikatz
2014-05-05 06:16:49 -04:00
794f55a82b
Updated to latest Mimikatz
...
Latest version of Mimikatz now natively supports being reflectively
loaded by Invoke-ReflectivePEInjection, updating the script to take
advantage of this new version.
2014-05-04 18:49:37 -07:00
193b005357
Merge pull request #42 from clymb3r/master
...
Fixing error in script
2014-04-28 20:57:56 -07:00
364dde11e1
Fixing error in script
2014-04-28 20:45:20 -07:00
22f984c3f1
Merge pull request #41 from clymb3r/master
...
Updating Invoke-Mimikatz to Mimikatz 2.0 alpha
2014-04-19 07:46:51 -04:00
d085c5b1d7
Fixing formatting
2014-04-16 21:16:02 -07:00
f03ab1444d
Fixing garbage put in by merge
2014-04-16 21:11:34 -07:00
b783b459c1
Merge branch 'master' of https://github.com/mattifestation/PowerSploit
...
Conflicts:
Recon/Get-ComputerDetails.ps1
Recon/Recon.psd1
2014-04-16 21:02:50 -07:00
47b90647c1
Updating Invoke-Mimikatz to Mimikatz 2.0 alpha
2014-04-16 20:47:14 -07:00
946328cf9e
Missing File Names
...
Added printers.xml and drives.xml to the search.
2014-03-21 13:22:33 -04:00
5fabddcf1d
Fixed error in PowerSploit ADS removal one-liner
2014-03-16 10:09:52 -04:00
202e8f4b36
Adding internal recon/privesc privesc functions #40
...
Added the following recon functions written by Joe Bialek
(@JosephBialek):
- Find-4648Logons
- Find-4624Logons
- Find-AppLockerLogs
- Find-PSScriptsInPSAppLog
- Find-RDPClientConnections
- Get-ComputerDetails (Combines all of the above functions into a single
function)
2014-03-16 10:02:37 -04:00
1798918edf
Bug fix of from v3 XML expanding to $Count
...
This bug fix was from @jakxx
2014-03-05 00:40:02 -05:00
49c9f04533
Update to version 2.4.0 from @jakxx
...
Removed unnecessary comment, merged update with printers.xml and drives.xml from @jackxx
2014-03-05 00:32:40 -05:00
77bcb336e0
Separating out functions & bug fix
...
All info gathering pieces of this script can now be called individually.
Fixed a bug where the user SID wasn't being converted to a username in
the RDP function.
2014-03-02 21:18:28 -08:00
b450a70dbf
Added Get-VolumeShadowCopy and Mount-VolumeShadowCopy
2014-03-01 18:26:31 -05:00
1df850208e
Consolidated Persistence module functions into Persistence.psm1
...
It doesn't make sense to have these as separate ps1 files.
2014-02-23 10:35:55 -05:00
bbd382e52a
#31 Persistence module function nouns are now singular
...
The function names New-UserPersistenceOption and
New-ElevatedPersistenceOptionNew-ElevatedPersistenceOption now conform
to PowerShell naming best practices.
2014-02-23 10:35:55 -05:00
28790b5a08
Merge pull request #32 from obscuresec/master
...
Minor fixes for compatibility between versions
2014-02-21 23:26:21 -05:00
3047ccfe32
Update Get-GPPPassword.ps1
2014-02-21 22:37:23 -05:00
7ee66855f3
Update Get-GPPPassword.ps1
2014-02-21 22:34:11 -05:00
22572d6e7d
Changed the direction of XML parsing
...
Used Select-XML to ensure compatibility with v2
2014-02-21 22:33:27 -05:00
770fe8ff10
Update Get-GPPPassword.ps1
...
Iterate version.
2014-02-21 15:26:49 -05:00
313d80373c
Update Get-GPPPassword.ps1
2014-02-21 15:19:55 -05:00
261aaf6302
Update Get-GPPPassword.ps1
...
Bug fix of variables.
2014-02-21 15:09:43 -05:00
clymb3r