aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-01-20Updated module manifest file listingbitform2-2/+2
2013-01-20Renamed Usage.txt to Usage.md to apply markdown.bitform3-0/+0
2013-01-20Updated PowerSploit README with proper markdownbitform2-189/+168
2013-01-20Created a ScriptModification module.bitform8-48/+326
* All scripts used to prepare and/or modify payload scripts were added to the ScriptModification module. * Added Remove-Comments - Strips comments and extra whitespace from a script. * Encrypt-Script was named to Out-EncryptedScript in order to conform to proper PowerShell verbs.
2013-01-20Removed logic in scripts to load ps1xml filesbitform5-27/+13
* Now that PETools and ReverseEngineering are both full-fledged modules with proper manifests, the manifests will take care of loading the appropriate ps1xml files. * Added Usage.txt to ReverseEngineering module.
2013-01-19PETools module doc. consistency improvementsbitform5-80/+182
* Slight consistency modifications were made to documentation. * Added module manifest for PETools
2013-01-19Renamed RE_Tools. Now ReverseEngineering modulebitform12-89/+227
* I renamed RE_Tools to ReverseEngineering and made it a module. * Slight consistency modifications were made to documentation. * This is one step in the process of modularizing all of PowerSploit.
2013-01-19Removed old release notes.bitform1-17/+0
2013-01-19Added 'Id' parameter documentation to Get-PEBbitform1-0/+4
Forgot to add this. Oops.
2013-01-19Removed ValueFromPipeline from the Path param.bitform1-2/+2
That parameter attribute doesn't make sense in this context.
2013-01-19Updated readme to reflect renamed Prepare-Payloadbitform1-1/+1
2013-01-19Improved Prepare-Payload (now Out-EncodedCommand)bitform2-154/+182
* Renamed Prepare-Payload to Out-EncodedCommand in order to conform to a standard cmdlet verb. * Fixed bug in PowerShell v2 * Defaults to full base-64 encoding unless it exceeds the cmd.exe character limit. Otherwise, it will default to partial base-64 encoding in an effort to save space. Thanks @Carlos_Perez for the idea! * User will be prompted if the cmd.exe character limit is exceeded. * Command-line output uses truncated arguments in order to save space. Thanks @obscuresec!
2013-01-15Added Get-TimedScreenshotbitform2-0/+103
A function that takes screenshots at a regular interval and saves them to a folder. Developed by @obscuresec
2013-01-13Prepare-Payload now accepts pipeline outputbitform1-2/+2
2013-01-13Fixed bug in Prepare-Payloadbitform1-2/+12
* Some payloads were not decoding properly after being uncompressed. This was due to a bug in how `Get-Content -Encoding ASCII` was interpreting input. When reading a script from a file, Prepare-payload no longer makes any assumptions about the script's encoding. * Prepare-Payload will display a warning if the cmd.exe or base64 string length maximums are exceeded.
2013-01-07Added Get-PEBbitform3-0/+2114
Returns the process environment block (PEB) of a process.
2013-01-02Added Get-StructFromMemorybitform2-0/+205
Marshals data from an unmanaged block of memory in an arbitrary process to a newly allocated managed object of the specified type. In other words, it will parse and return a structure at a known memory address in any process.
2012-12-30Fixed several bugs in Get-KernelModuleInfobitform1-8/+3
* The script now silently continues if the ps1xml file is not present. * Removed compiler parameter code. This was a remnant of the first version of Get-KernelModuleInfo when it compiled code. * Improved the heuristics for determining when the last kernel module is encountered.
2012-12-16Improved Get-KernelModuleInfobitform1-59/+108
Get-KernelModuleInfo utilizes reflection exclusively now and no longer requires compilation of C# code. This means that is runs entirely in memory.
2012-12-16Added Get-KernelModuleInfobitform3-0/+287
Returns loaded kernel module information.
2012-12-14Added the Wow64 switch to Prepare-Payloadbitform1-3/+17
Now, you can optionally output a call to the x86 (Wow64) version of PowerShell.
2012-12-12Added Find-AVSignaturebitform2-0/+122
A tool for bypassing AV signatures.
2012-12-01Added Out-CompressedDllbitform2-0/+83
A script to aid in the loading of managed dlls in memory
2012-11-22Fixed Prepare-Payload documentation grammar fail.bitform1-1/+1
2012-11-22Adding Prepare-Payloadbitform2-0/+134
Prepare-Payload compresses, Base-64 encodes, and generates command-line output for a PowerShell payload script. This script was inspired by and an improvement upon createcmd.ps1 (https://www.trustedsec.com/files/PowerShell_PoC.zip)
2012-11-17Adding Get-MethodAddressbitform2-0/+114
2012-10-27Added Get-Stringsbitform2-1/+101
Get-Strings dumps strings from any file in Ascii and/or Unicode.
2012-09-21Nearly complete rewrite of Inject-Dllbitform1-93/+224
The functionality remains the same but the code was cleaned up drastically to be more consistent with PowerShell scripting best practices.
2012-09-11Improved Metasploit payload support for 32/64-bitbitform1-1/+37
Updated Inject-Shellcode. If running a 32-bit Metasploit payload from 64-bit PowerShell, it will prompt the user to execute the payload from 32-bit PowerShell. This fix was in response to Chris Gate's feature request: http://carnal0wnage.attackresearch.com/2012/05/powershell-shellcode-metasploit-x64.html Note, there are some side effects: 1) It takes about one minute to initialize and execute the payload in the 32-bit process. This is because the execution essentially emulates copying and pasting its contents into the child process. 2) You will see some output artifacts of the script running in the child PowerShell process. I couldn't think of a good way to rectify these problems without dropping the contents of the script to disk, which would not be desireable.
2012-08-24Cleaned up Encrypt-Script coment-based helpbitform1-35/+56
2012-08-20Updated Inject-Shellcode and style guidebitform2-192/+410
New Features/Changes: - Dramatically simplified parameters. Removed redundancies and named parameter sets more appropriately - Added 'Shellcode' parameter. Now, you can optionally specify shellcode as a byte array rather than having to copy and paste shellcode into the $Shellcode32 and/or $Shellcode64 variables - Added 'Payload' parameter. Naming is now consistant with Metasploit payloads. Currently, only 'windows/meterpreter/reverse_http' and 'windows/meterpreter/reverse_https' payloads are supported. - Inject-Shellcode will now prompt the user to continue the 'dangerous' action unless the -Force switch is provided. Hopefully, this will prevent some people from carrying out stupid/regrettable actions. - Added the 'ListMetasploitPayloads' switch to display the Metasploit payloads supported by Inject-Shellcode Bug fixes/Miscellaneous: - Added UserAgent parameter to help documentation - Code is much more readable now - Changed internal helper functions to 'local' scope - Now using proper error handling versus Write-Warning statements - Added a subtle warning to the built-in shellcode...
2012-08-11Added the Get-Member proxy functionbitform2-0/+348
This extends the built-in Get-Member cmdlet by adding the '-Private' parameter for dissecting .NET types.
2012-08-09Added additional recon dictionariesbitform3-1/+106
2012-08-07Added Get-HttpStatus and 'Recon' directorybitform4-7/+342
* All recon scripts not live in the 'Recon' directory * Added Get-HttpStatus - An http[s] enumeration tool * Added default dictionary for Get-HttpStatus - .\Dictionaries\admin.txt * Moved Invoke-ReverseDnsLookup to 'Recon'
2012-07-25Fixed bug in display of PE optional headerbitform1-4/+4
2012-07-22Fixed bug in executables with no imports/exportsbitform1-0/+10
I now check for the existance of imports/exports in the data directory.
2012-07-22Added Get-PEHeader. PETools is now a module.bitform7-2/+1278
Get-PEHeader is a 32 and 64-bit in-memory and on-disk PE parsing utility. PETools is now a PowerShell module that can be loaded with `Import-Module PETools`
2012-06-26Added Get-ILDisassembly - an MSIL disassemblerbitform2-0/+202
Added Get-ILDisassembly. Added RE_Tools folder for all current and future reverse engineering tools.
2012-06-26Changed licensing to BSD 3-Clausebitform9-13/+37
Fixed some spelling errors in README. Added additional usage information
2012-06-07Converted all ps1 files from UTF-16 BE to Asciibitform7-0/+0
PowerShell ISE saves to UTF-16 BE by default. git doesn't diff this properly. Diffs should now display properly.
2012-06-07Attempted to fix ps1 diffingbitform1-1/+1
2012-06-07Fixed .gitattributesbitform1-0/+1
2012-06-07Added reverse HTTP[S] meterpreter payloadsbitform1-0/+0
2012-06-02Added two PE tools and updated Readmebitform3-1/+12
Added: Get-DllLoadPath, Get-PEArchitecture Updated: Readme to reflect new additions
2012-05-27Deleted .gitattributesbitform1-1/+0
2012-05-26Added Invoke-ReverseDnsLookupbitform2-0/+4
2012-05-26Added style guide to the readmebitform1-1/+51
2012-05-26Tweaked .gitattributesbitform1-1/+1
2012-05-26Get-GPPPassword now outputs custom objectbitform1-0/+0
Got rid of Write-Host output.
2012-05-26Added Get-GPPPasswordbitform2-0/+5
Used with permission from @obscuresec (www.obscuresecurity.blogspot.com)
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-29 10:45:50 +0000