b43429dd3c
Removed required module statement from Capstone
2014-07-10 19:28:47 -04:00
225fbfbc86
Updated Get-VaultCredential name in README
2014-06-30 17:02:03 -04:00
8c2411ccf3
Get-VaultCredential now takes the singular form.
2014-06-30 15:20:48 -04:00
dc3cab2c9f
Invoke-DllInjection now calls RtlCreateUserThread
...
Calling CreateRemoteThread on lsass.
Bug fix: Invoke-DllInjection was checking the processor architecture
when it should have been validating the OS architecture. This would
cause Invoke-DllInjection to fail on a 32-bit OS with a 64-bit
processor.
2014-06-21 11:29:46 -04:00
29a5d48c3f
Adding Mayhem module and Set-CriticalProcess
2014-06-19 20:28:50 -04:00
80ffa19fa3
Removing Watch-BlueScreen
...
This vulnerability was patched a while ago making this function largely
irrelevant.
2014-06-19 20:16:26 -04:00
3444a0700e
Updated Get-VaultCredentials - Package SID
...
Package SIDs are now displayed for Win8 apps. Both the package SID and
secret key are requirements for authenticating to Win8 app servers.
2014-05-31 21:22:22 -04:00
890247deec
Issue #43 - Adding Get-VaultCredentials
...
Displays Windows vault credential objects including cleartext web
credentials.
2014-05-30 21:22:31 -04:00
4567547d6d
Merge pull request #49 from clymb3r/master
...
Update to latest Mimikatz (crash fix on Win7/8)
2014-05-20 13:52:14 -04:00
6e56d40662
Update to latest Mimikatz (crash fix on Win7/8)
...
The latest version of Mimikatz fixes a crash that happens on Windows7/8
(and server versions) after installing the latest Windows updates.
2014-05-20 09:34:09 -07:00
67ed1d71b4
Merge pull request #44 from clymb3r/master
...
Updated to latest Mimikatz
2014-05-05 06:16:49 -04:00
794f55a82b
Updated to latest Mimikatz
...
Latest version of Mimikatz now natively supports being reflectively
loaded by Invoke-ReflectivePEInjection, updating the script to take
advantage of this new version.
2014-05-04 18:49:37 -07:00
193b005357
Merge pull request #42 from clymb3r/master
...
Fixing error in script
2014-04-28 20:57:56 -07:00
364dde11e1
Fixing error in script
2014-04-28 20:45:20 -07:00
22f984c3f1
Merge pull request #41 from clymb3r/master
...
Updating Invoke-Mimikatz to Mimikatz 2.0 alpha
2014-04-19 07:46:51 -04:00
d085c5b1d7
Fixing formatting
2014-04-16 21:16:02 -07:00
f03ab1444d
Fixing garbage put in by merge
2014-04-16 21:11:34 -07:00
b783b459c1
Merge branch 'master' of https://github.com/mattifestation/PowerSploit
...
Conflicts:
Recon/Get-ComputerDetails.ps1
Recon/Recon.psd1
2014-04-16 21:02:50 -07:00
47b90647c1
Updating Invoke-Mimikatz to Mimikatz 2.0 alpha
2014-04-16 20:47:14 -07:00
946328cf9e
Missing File Names
...
Added printers.xml and drives.xml to the search.
2014-03-21 13:22:33 -04:00
5fabddcf1d
Fixed error in PowerSploit ADS removal one-liner
2014-03-16 10:09:52 -04:00
202e8f4b36
Adding internal recon/privesc privesc functions #40
...
Added the following recon functions written by Joe Bialek
(@JosephBialek):
- Find-4648Logons
- Find-4624Logons
- Find-AppLockerLogs
- Find-PSScriptsInPSAppLog
- Find-RDPClientConnections
- Get-ComputerDetails (Combines all of the above functions into a single
function)
2014-03-16 10:02:37 -04:00
1798918edf
Bug fix of from v3 XML expanding to $Count
...
This bug fix was from @jakxx
2014-03-05 00:40:02 -05:00
49c9f04533
Update to version 2.4.0 from @jakxx
...
Removed unnecessary comment, merged update with printers.xml and drives.xml from @jackxx
2014-03-05 00:32:40 -05:00
77bcb336e0
Separating out functions & bug fix
...
All info gathering pieces of this script can now be called individually.
Fixed a bug where the user SID wasn't being converted to a username in
the RDP function.
2014-03-02 21:18:28 -08:00
b450a70dbf
Added Get-VolumeShadowCopy and Mount-VolumeShadowCopy
2014-03-01 18:26:31 -05:00
1df850208e
Consolidated Persistence module functions into Persistence.psm1
...
It doesn't make sense to have these as separate ps1 files.
2014-02-23 10:35:55 -05:00
bbd382e52a
#31 Persistence module function nouns are now singular
...
The function names New-UserPersistenceOption and
New-ElevatedPersistenceOptionNew-ElevatedPersistenceOption now conform
to PowerShell naming best practices.
2014-02-23 10:35:55 -05:00
28790b5a08
Merge pull request #32 from obscuresec/master
...
Minor fixes for compatibility between versions
2014-02-21 23:26:21 -05:00
3047ccfe32
Update Get-GPPPassword.ps1
2014-02-21 22:37:23 -05:00
7ee66855f3
Update Get-GPPPassword.ps1
2014-02-21 22:34:11 -05:00
22572d6e7d
Changed the direction of XML parsing
...
Used Select-XML to ensure compatibility with v2
2014-02-21 22:33:27 -05:00
770fe8ff10
Update Get-GPPPassword.ps1
...
Iterate version.
2014-02-21 15:26:49 -05:00
313d80373c
Update Get-GPPPassword.ps1
2014-02-21 15:19:55 -05:00
261aaf6302
Update Get-GPPPassword.ps1
...
Bug fix of variables.
2014-02-21 15:09:43 -05:00
24fc1b6b6c
Major Revision of Get-GPPPasswords
...
Thanks @obscuresec!
2014-02-21 05:59:58 -05:00
308042f493
Adding Get-ComputerDetails recon script
...
Get-ComputerDetails is a recon script which pulls a variety of useful
information off a computer which might later be useful by an attacker.
This includes:
Logons
AppLocker process start logs
PowerShell logs to find scripts run
RDP Client saved servers
2014-02-20 17:47:27 -08:00
22f0c1b13a
Changed Inject-LogonCredentials name to Invoke-CredentialInjection
2014-02-12 19:44:12 -05:00
331d54eeaf
Merge pull request #28 from clymb3r/master
...
Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.
2014-02-12 19:40:32 -05:00
b684da050a
Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.
...
Added a check to ensure the script isn't being run from Session0 with
the "NewWinLogon" flag. This flag does not work in Session0 because
winlogon.exe tries to load stuff from user32.dll which requires a
desktop is present. This is not possible in Session0 because there is no
desktop/GUI, so it causes winlogon to load and then immediately close
with error code c0000142 indicating a DLL failed to initialize. There is
no way to fix this that I know of, if you need to run the script from
Session0 use the "ExistingWinLogon" flag.
2014-02-12 13:52:41 -08:00
92fcfdc384
Add Get-Entropy
2014-02-03 18:37:36 -05:00
c5168cdba6
Removed mimikatz.
...
This doesn't need to reside in PowerSploit. Those that are truly
paranoid should validate that the embedded executable in
Invoke-Mimikatz.ps1 is indeed mimikatz.
This was causing AV to flag upon downloading PowerSploit.
2014-02-03 17:13:41 -05:00
d9ca5357e4
Merge pull request #26 from obscuresec/master
...
Update Invoke-ReverseDnsLookup.ps1
2014-01-30 14:38:50 -08:00
14780a5678
Update Invoke-ReverseDnsLookup.ps1
...
Added pipeline support and verbose statement.
2014-01-30 17:13:25 -05:00
7c51e9331b
Generate a non-terminating error if there's a binding/framework version mismatch
...
The user should at least be made aware if they're using an unsupported
framework library version.
2014-01-25 11:48:53 -05:00
22cbc47642
Upgraded Capstone framework libs to 2.0
...
These are the compiled libs straight from
http://www.capstone-engine.org/download.html
2014-01-25 11:47:09 -05:00
7f0267db7c
Disable non-standard cmdlet verb checking
2014-01-25 11:45:59 -05:00
3d564121d7
Capstone.dll returns the correct number of operands now.
2014-01-19 18:53:17 -05:00
5fede76351
Capstone module now incorporates framework 2.0RC1
...
* I also moved the contents of Get-CSDisassembly.ps1 into Capstone.psm1
2014-01-19 13:56:48 -05:00
4f5faf672f
Merge pull request #25 from clymb3r/master
...
Bug fixes for Invoke-TokenManipulation
2014-01-11 15:02:48 -08:00
mattifestation