diff options
| author | Matt Graeber <mattgraeber@gmail.com> | 2013-11-04 13:56:47 -0800 |
|---|---|---|
| committer | Matt Graeber <mattgraeber@gmail.com> | 2013-11-04 13:56:47 -0800 |
| commit | 20f0a5cd96b86b9441e9361df9b0c4d50293a3e2 (patch) | |
| tree | b49f9ec63e59202facd693a952f4f4d7a7c1303f | |
| parent | 22f232920bd25f01f8e6a4d99bbcbfca1a8cd041 (diff) | |
| parent | 5af0589e8f97aa49aef6bd083a00a4689c7553aa (diff) | |
| download | PowerSploit-20f0a5cd96b86b9441e9361df9b0c4d50293a3e2.tar.gz PowerSploit-20f0a5cd96b86b9441e9361df9b0c4d50293a3e2.zip | |
Merge pull request #19 from clymb3r/master
Updated Invoke-TokenManipulation help
| -rw-r--r-- | Exfiltration/Invoke-TokenManipulation.ps1 | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Exfiltration/Invoke-TokenManipulation.ps1 b/Exfiltration/Invoke-TokenManipulation.ps1 index affbc20..c692299 100644 --- a/Exfiltration/Invoke-TokenManipulation.ps1 +++ b/Exfiltration/Invoke-TokenManipulation.ps1 @@ -140,13 +140,13 @@ Spawns cmd.exe using the token belonging to thread ID 500. .EXAMPLE -Get-Process lsass | Token-TokenManipulation -CreateProcess "cmd.exe" +Get-Process wininit | Invoke-TokenManipulation -CreateProcess "cmd.exe" Spawns cmd.exe using the primary token of LSASS.exe. This pipes the output of Get-Process to the "-Process" parameter of the script. .EXAMPLE -Get-Process lsass | Token-TokenManipulation -ImpersonateUser +Get-Process wininit | Invoke-TokenManipulation -ImpersonateUser Makes the current thread impersonate the lsass security token. |