aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-07-12Merge pull request #52 from clymb3r/masterMatt Graeber1-63/+157
Bug fixes to Invoke-ReflectivePEInjection
2014-07-10Bug fixes to Invoke-ReflectivePEInjectionclymb3r1-63/+157
Fixed a bug where calling GetProcAddress by ordinal instead of procedure name failed. Fixed a bug where reflectively loading an EXE will cause the entry function (main()) to be called twice instead of once as expected. Added a ForceASLR flag to force ASLR to be used even if the PE file doesn't officially support ASLR. Some minor other changes.
2014-07-10Removed required module statement from Capstonemattifestation1-2/+0
2014-06-30Updated Get-VaultCredential name in READMEmattifestation1-1/+1
2014-06-30Get-VaultCredential now takes the singular form.mattifestation3-6/+6
2014-06-21Invoke-DllInjection now calls RtlCreateUserThreadmattifestation1-24/+26
Calling CreateRemoteThread on lsass. Bug fix: Invoke-DllInjection was checking the processor architecture when it should have been validating the OS architecture. This would cause Invoke-DllInjection to fail on a 32-bit OS with a 64-bit processor.
2014-06-19Adding Mayhem module and Set-CriticalProcessmattifestation4-0/+206
2014-06-19Removing Watch-BlueScreenmattifestation3-83/+1
This vulnerability was patched a while ago making this function largely irrelevant.
2014-05-31Updated Get-VaultCredentials - Package SIDmattifestation2-1/+19
Package SIDs are now displayed for Win8 apps. Both the package SID and secret key are requirements for authenticating to Win8 app servers.
2014-05-30Issue #43 - Adding Get-VaultCredentialsmattifestation4-41/+426
Displays Windows vault credential objects including cleartext web credentials.
2014-05-20Merge pull request #49 from clymb3r/masterChris Campbell1-4/+4
Update to latest Mimikatz (crash fix on Win7/8)
2014-05-20Update to latest Mimikatz (crash fix on Win7/8)clymb3r1-4/+4
The latest version of Mimikatz fixes a crash that happens on Windows7/8 (and server versions) after installing the latest Windows updates.
2014-05-05Merge pull request #44 from clymb3r/masterMatt Graeber1-10/+24
Updated to latest Mimikatz
2014-05-04Updated to latest Mimikatzclymb3r1-10/+24
Latest version of Mimikatz now natively supports being reflectively loaded by Invoke-ReflectivePEInjection, updating the script to take advantage of this new version.
2014-04-28Merge pull request #42 from clymb3r/masterMatt Graeber1-2/+0
Fixing error in script
2014-04-28Fixing error in scriptclymb3r1-2/+0
2014-04-19Merge pull request #41 from clymb3r/masterMatt Graeber2-12/+12
Updating Invoke-Mimikatz to Mimikatz 2.0 alpha
2014-04-16Fixing formattingclymb3r2-1/+2
2014-04-16Fixing garbage put in by mergeclymb3r2-17/+0
2014-04-16Merge branch 'master' of https://github.com/mattifestation/PowerSploitclymb3r364-17271/+1688
Conflicts: Recon/Get-ComputerDetails.ps1 Recon/Recon.psd1
2014-04-16Updating Invoke-Mimikatz to Mimikatz 2.0 alphaclymb3r1-9/+9
2014-03-21Missing File NamesChris Campbell1-2/+2
Added printers.xml and drives.xml to the search.
2014-03-16Fixed error in PowerSploit ADS removal one-linermattifestation1-1/+1
2014-03-16Adding internal recon/privesc privesc functions #40mattifestation2-1/+583
Added the following recon functions written by Joe Bialek (@JosephBialek): - Find-4648Logons - Find-4624Logons - Find-AppLockerLogs - Find-PSScriptsInPSAppLog - Find-RDPClientConnections - Get-ComputerDetails (Combines all of the above functions into a single function)
2014-03-05Bug fix of from v3 XML expanding to $CountChris Campbell1-2/+2
This bug fix was from @jakxx
2014-03-05Update to version 2.4.0 from @jakxxChris Campbell1-3/+14
Removed unnecessary comment, merged update with printers.xml and drives.xml from @jackxx
2014-03-02Separating out functions & bug fixclymb3r1-295/+438
All info gathering pieces of this script can now be called individually. Fixed a bug where the user SID wasn't being converted to a username in the RDP function.
2014-03-01Added Get-VolumeShadowCopy and Mount-VolumeShadowCopymattifestation3-1/+157
2014-02-23Consolidated Persistence module functions into Persistence.psm1mattifestation5-703/+701
It doesn't make sense to have these as separate ps1 files.
2014-02-23#31 Persistence module function nouns are now singularmattifestation5-42/+42
The function names New-UserPersistenceOption and New-ElevatedPersistenceOptionNew-ElevatedPersistenceOption now conform to PowerShell naming best practices.
2014-02-21Merge pull request #32 from obscuresec/masterMatt Graeber1-72/+65
Minor fixes for compatibility between versions
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-3/+3
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-1/+1
2014-02-21Changed the direction of XML parsingChris Campbell1-70/+63
Used Select-XML to ensure compatibility with v2
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-1/+1
Iterate version.
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-5/+5
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-12/+12
Bug fix of variables.
2014-02-21Major Revision of Get-GPPPasswordsmattifestation1-59/+141
Thanks @obscuresec!
2014-02-20Adding Get-ComputerDetails recon scriptclymb3r2-1/+439
Get-ComputerDetails is a recon script which pulls a variety of useful information off a computer which might later be useful by an attacker. This includes: Logons AppLocker process start logs PowerShell logs to find scripts run RDP Client saved servers
2014-02-12Changed Inject-LogonCredentials name to Invoke-CredentialInjectionmattifestation1-1/+1
2014-02-12Merge pull request #28 from clymb3r/masterMatt Graeber5-3423/+3432
Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.
2014-02-12Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.clymb3r5-3423/+3432
Added a check to ensure the script isn't being run from Session0 with the "NewWinLogon" flag. This flag does not work in Session0 because winlogon.exe tries to load stuff from user32.dll which requires a desktop is present. This is not possible in Session0 because there is no desktop/GUI, so it causes winlogon to load and then immediately close with error code c0000142 indicating a DLL failed to initialize. There is no way to fix this that I know of, if you need to run the script from Session0 use the "ExistingWinLogon" flag.
2014-02-03Add Get-Entropymattifestation3-1/+111
2014-02-03Removed mimikatz.mattifestation289-16310/+0
This doesn't need to reside in PowerSploit. Those that are truly paranoid should validate that the embedded executable in Invoke-Mimikatz.ps1 is indeed mimikatz. This was causing AV to flag upon downloading PowerSploit.
2014-01-30Merge pull request #26 from obscuresec/masterMatt Graeber1-105/+130
Update Invoke-ReverseDnsLookup.ps1
2014-01-30Update Invoke-ReverseDnsLookup.ps1Chris Campbell1-105/+130
Added pipeline support and verbose statement.
2014-01-25Generate a non-terminating error if there's a binding/framework version mismatchmattifestation2-0/+5
The user should at least be made aware if they're using an unsupported framework library version.
2014-01-25Upgraded Capstone framework libs to 2.0mattifestation2-0/+0
These are the compiled libs straight from http://www.capstone-engine.org/download.html
2014-01-25Disable non-standard cmdlet verb checkingmattifestation1-1/+1
2014-01-19Capstone.dll returns the correct number of operands now.mattifestation1-0/+0
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-30 10:29:30 +0000