FixTheExchange 17dd6835b9 Update Invoke-TokenManipulation.ps1 ...

Windows 10 breaks the current version of Invoke-TokenManipulation.ps1 because wininit is now a protected processes.  Rather than hardcoding to a specific process to obtain a SYSTEM token, it's better to enumerate all processes running as SYSTEM and find one that works. I have updated the script to version 1.12 and added logic on lines 1689-1696 to make sure it can successfully grab a SYSTEM token necessary to function.

2015-10-30 11:38:57 -05:00

..

LogonUser/LogonUser

Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.

2014-02-12 13:52:41 -08:00

NTFSParser

Adding Invoke-Mimikatz and Invoke-Ninjacopy

2013-10-01 09:47:05 -07:00

Exfiltration.psd1

Get-VaultCredential now takes the singular form.

2014-06-30 15:20:48 -04:00

Exfiltration.psm1

Normalized all scripts to ASCII encoding

2013-11-13 21:01:02 -05:00

Get-GPPPassword.ps1

Missing File Names

2014-03-21 13:22:33 -04:00

Get-Keystrokes.ps1

Fix for headings in wrong order

2015-05-10 21:32:14 +02:00

Get-TimedScreenshot.ps1

Normalized all scripts to ASCII encoding

2013-11-13 21:01:02 -05:00

Get-VaultCredential.ps1

Get-VaultCredential now takes the singular form.

2014-06-30 15:20:48 -04:00

Get-VaultCredential.ps1xml

Get-VaultCredential now takes the singular form.

2014-06-30 15:20:48 -04:00

Invoke-CredentialInjection.ps1

Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.

2014-02-12 13:52:41 -08:00

Invoke-Mimikatz.ps1

Fix for multi-processor systems

2015-09-30 21:32:04 -07:00

Invoke-NinjaCopy.ps1

Normalized all scripts to ASCII encoding

2013-11-13 21:01:02 -05:00

Invoke-TokenManipulation.ps1

Update Invoke-TokenManipulation.ps1

2015-10-30 11:38:57 -05:00

Out-Minidump.ps1

Normalized all scripts to ASCII encoding

2013-11-13 21:01:02 -05:00

Usage.md

Added 'Exfiltration' Module

2013-01-20 21:32:41 -05:00

VolumeShadowCopyTools.ps1

Cleaned up Remove-VSC and New-VSC

2015-07-08 22:27:12 -04:00