43c4c69b38
Merge pull request #108 from sagishahar/master
...
Add 'CanRestart' to output and Pester tests
2016-01-25 15:19:20 -08:00
cde9447c5f
Merge pull request #107 from secabstraction/dev
...
new Get-Keystrokes
2016-01-14 12:37:52 -08:00
9cc65e4a85
Fixed Pester/PassThru
2016-01-13 22:32:44 -06:00
75548931ba
Fixed Pester/PassThru
2016-01-13 22:30:38 -06:00
4ffd3084e4
Fixed Pester/PassThru
2016-01-13 22:20:05 -06:00
414daa60b8
Fixed Pester/PassThru
2016-01-13 22:19:06 -06:00
759bd481ae
Fixed Pester/PassThru
2016-01-13 21:02:50 -06:00
e83e97d672
Merge pull request #110 from PowerShellMafia/master
...
Merging Invoke-TokenManipulation fix into dev
2016-01-13 11:09:42 -08:00
2a813faedb
Merge pull request #109 from mmashwani/master
...
Don't search for SYSTEM token by using hard coded English name
2016-01-13 11:05:46 -08:00
96ad796da8
Don't search for SYSTEM token by using hard coded English name for SYSTEM account. Translate SYSTEM SID to NTAccount to maintain compatibility across languages.
2016-01-13 04:52:42 -05:00
5f13c7b4de
Add 'CanRestart' to output and Pester tests
...
Pester tests to the function 'Test-ServiceDaclPermission' were added in
order to increase confidence in its reliability. In general, my
intention was to replace the current functionality of the service
management functions such as Invoke-ServiceStart, to not use blindly
'sc.exe start' but rather consult with the DACL permissions and base the
decision on that. Unforunately, further investigation lead me to the
conclusion that retrieval of the service's DACL permissions requires
that an additional DACL permission (RC) be set. This may lead to an edge
case that could miss a potential privilege escalation condition and
thereby the original idea was discarded. Nonetheless,
'Test-ServiceDaclPermission' can be used for less critical tasks.
Therefore, a 'CanRestart' property was added to the output of the
service enumeration functions such as 'Get-ServiceUnquoted' as I think
that it will add value to redteamers/pentesters by helping them
prioritise which service should be abused for escalation of privileges.
Services that can be restarted by a low privileged user will probably be
prioritised first. Additionally, manual checking whether the vulnerable
service can be restarted would not be required in most cases.
2016-01-13 01:36:23 +08:00
d133db696a
Update Get-Keystrokes.ps1
2016-01-11 09:09:48 -06:00
ef887af9d6
Update Exfiltration.tests.ps1
2016-01-09 17:55:47 -06:00
f66e219bd6
new Get-Keystrokes
2016-01-09 17:50:58 -06:00
872d4b0eb7
Merge pull request #105 from stufus/find_ad_managed_security_groups
...
Find AD Managed Security Groups
2015-12-29 09:22:07 -05:00
bc7efdf229
Added Find-ManagedSecurityGroups to readme
2015-12-29 14:08:28 +00:00
ed60b51f0a
Sorted exports into alphabetical order
2015-12-29 14:06:06 +00:00
f645f61607
Sorted the recon.psd1 module import into alphabetical order
2015-12-29 14:04:03 +00:00
2343f43e7c
Added reference to function to powersploit.psd1 and recon.psd1
2015-12-29 13:37:40 +00:00
841150e1c6
Added Find-ManagedSecurityGroups
2015-12-28 17:54:47 +00:00
9e771d15bf
Merge pull request #102 from PowerShellMafia/dev
...
Merge 3.0 release changes
2015-12-18 16:33:59 -08:00
9f183e3651
Set all module versions to 3.0
...
Also cleaned up some module manifest cruft.
2015-12-18 16:28:03 -08:00
29ae830b73
Improved root module manifest for PS Gallery
2015-12-18 16:17:16 -08:00
26e0b29e67
Added manifest info for the PowerShell Gallery
2015-12-18 14:24:11 -08:00
2a8da712b6
Updated .psproj to reflect additions/removals
2015-12-18 11:43:40 -08:00
52c46b1d3a
Revert "Invoke-ReflectivePEInjection test harnesses updated"
...
This reverts commit 98ebc1b0b8
2015-12-17 20:30:04 -08:00
98ebc1b0b8
Invoke-ReflectivePEInjection test harnesses updated
...
Affected test harness PEs were updated to work in XP. Addresses issue
#100
2015-12-17 18:50:15 -08:00
55098d59e9
Removed version numbers from scripts
...
A module should maintain a version number not the individual scripts.
2015-12-16 17:08:58 -08:00
c2a70924e1
Removed all version numbers from scripts
...
Scripts in a module should not be individually versioned. Only the
module should be versioned.
2015-12-16 17:08:57 -08:00
b01a8127bc
Added volume shadow copy functions to README.md
2015-12-16 16:52:53 -08:00
70f25c90e2
Update README.md
2015-12-16 15:24:18 -08:00
1cdad586c8
Added a slight delay to Invoke-DllInjection validation
...
In some cases, the loaded module would show up as loaded after the check
occurred.
2015-12-16 14:48:09 -08:00
f5d9b25275
Invoke-DllInjection detects OS arch on all OSes
...
This fix addresses issue #99 . While I'm not the biggest fan of
performing tests based on environment variables, I felt that making
additional Win32 API calls would have been overkill.
2015-12-16 14:31:03 -08:00
ef37a138b8
Fixed Add-Persistence. Issue #98
2015-12-16 13:36:22 -08:00
9a2dfad3de
Fixed mangled decrypted script output
...
Addresses issue #80 . This was a tricky fix because the script should
ideally handle Unicode and Ascii encoded scripts. I haven't tested
scripts with international characters but I would imagine those script
would get mangled since the decrypted output is ultimately normalized to
ascii.
2015-12-16 10:15:14 -08:00
fdcdeab702
Fixed Invoke-WmiCommand credential popup issue
...
Easy fix to issue #97
2015-12-16 08:50:34 -08:00
fef09e6cc1
Merge pull request #91 from FixTheExchange/patch-1
...
Update Invoke-TokenManipulation.ps1 to address Win 10 incompatibility
2015-12-15 12:23:12 -08:00
f70c63f9d5
Invoke-WmiCommand is now PSv2 compatible
...
This bug fix addresses issue #96 . As much as a hate dropping files to
disk, this was the easiest way to preserve objects in PSv2+. If someone
want to implement the [de]serialization themselves and keep everything
in memory, please submit a PR.
2015-12-15 11:55:47 -08:00
f6e032c3b1
Invoke-WmiCommand now obtains full powershell path
...
Addresses issue #95 .
2015-12-15 09:10:35 -08:00
924103aa01
Invoke-DllInjection Pester test improvement
...
The test dll I now use is advpack.dll since that is present in all
versions of windows.
2015-12-14 20:43:51 -08:00
e144be7f29
Invoke-Mimkatz: Incorporated latest 2.0 alpha build
...
Updated embedded powerkatz.dll to the latest version of mimikatz -
[Commit
1b13057](https://github.com/gentilkiwi/mimikatz/commit/1b130574ed78d1d9bf6117b0839056900cb8f816 )
This update addresses issue #94 .
2015-12-14 20:21:43 -08:00
55fabd7e2e
Removed commented blocks.
2015-12-14 22:00:21 -05:00
dae9d91fdb
Merge branch 'dev' of https://github.com/PowerShellMafia/PowerSploit into dev
2015-12-14 21:54:11 -05:00
0181ff0c09
Removed C# enum for Test-ServiceDaclPermission
2015-12-14 21:53:42 -05:00
00af1656b2
Bugfix #93
...
Removed the "EndAddress" parameter set since it was never used. This
should resolve any parameter set confusion.
2015-12-14 17:26:33 -08:00
ce3b21685a
Bugfix #92 : perform OS check when importing NtCreateThreadEx
2015-12-14 16:40:09 -08:00
9ffc26af70
Added admin rights check for existing Privesc Pester tests
2015-12-14 19:33:15 -05:00
5690b09027
Get-NetDomain now not called if -ComputerName or -ComputerFile are passed for meta functions, in order to prevent failure when running on a non-domain joined machine
...
took out FQDN Pester tests from Recon.tests.ps1 that used $env:userdnsdomain
2015-12-14 19:01:10 -05:00
e2993b63aa
Modified Tests/Privesc.tests.ps1 to ensure file artifacts are not left on disk.
2015-12-14 18:19:17 -05:00
a235313996
Modified Tests/Recon.tests.ps1 to ensure file artifacts are not left on disk.
2015-12-14 17:34:12 -05:00
HarmJ0y