aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-03-02Separating out functions & bug fixclymb3r1-295/+438
All info gathering pieces of this script can now be called individually. Fixed a bug where the user SID wasn't being converted to a username in the RDP function.
2014-02-20Adding Get-ComputerDetails recon scriptclymb3r2-1/+439
Get-ComputerDetails is a recon script which pulls a variety of useful information off a computer which might later be useful by an attacker. This includes: Logons AppLocker process start logs PowerShell logs to find scripts run RDP Client saved servers
2014-02-12Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.clymb3r5-3423/+3432
Added a check to ensure the script isn't being run from Session0 with the "NewWinLogon" flag. This flag does not work in Session0 because winlogon.exe tries to load stuff from user32.dll which requires a desktop is present. This is not possible in Session0 because there is no desktop/GUI, so it causes winlogon to load and then immediately close with error code c0000142 indicating a DLL failed to initialize. There is no way to fix this that I know of, if you need to run the script from Session0 use the "ExistingWinLogon" flag.
2014-01-10Bug fixes for Invoke-TokenManipulationclymb3r1-32/+142
Processes could not be started when the script was being run from Session 0. The fix is to use the CreateProcessAsUserW function when running in Session 0. This API requires SeAssignPrimaryTokenPrivilege priviege, so for non-session0 calls I still use CreateProcessWithTokenW which does not require special privileges.
2013-11-17Adding Inject-LogonCredentialsclymb3r18-1/+4428
2013-11-04Updated Invoke-TokenManipulation helpclymb3r1-2/+2
2013-11-03Adding Invoke-TokenManipulationclymb3r2-1/+1774
2013-11-03Fix for hostfiles option in powershell 2webstersprodigy1-2/+2
2013-11-03Updated usage tipmattifestation1-1/+4
2013-11-03Added a usage tipmattifestation1-0/+2
Added a one-liner for PSv3 that will remove the annoying warnings that are displayed when importing scripts downloaded from the Internet.
2013-11-03Slight clarification to license statementmattifestation1-1/+1
2013-11-03Modified license verbiagemattifestation1-1/+1
2013-11-03Added exfil script synopses to README.mdmattifestation1-0/+8
Descriptions for Invoke-NinjaCopy and Invoke-Mimikatz were added to the readme.
2013-11-03Fixed minor logic bug in C type undecorated symbolsmattifestation1-1/+8
2013-11-03Added Get-LibSymbolsmattifestation4-2/+313
Get-LibSymbols parses Microsoft .lib files and displays decorated and undecorated symbols.
2013-10-01Switching to ANSI from UTF8 encodingclymb3r3-8/+8
Scripts now work in 2008r2. I thought I tested before uploading but something broke somehow... Now the scripts work in 2008r2 and win8+
2013-10-01Adding Invoke-Mimikatz and Invoke-Ninjacopyclymb3r318-1/+29481
2013-10-01Adding gitignore fileclymb3r1-0/+215
Don't want gigantic ipch files from visual studio (among other useless files) to be uploaded.
2013-09-30Fixes for Windows 8.1/.NET 4.5clymb3r1-2593/+2575
.NET 4.5 introduced breaking changes in the way Marshalling works. Added a fix so ReflectivePEInjection works with Windows 8.1/.NET4.5.
2013-09-03Call to DllMain when unloading reflective DLLclymb3r1-0/+9
Prior to this fix, DllMain with the ProessDetach flag was not called when unloading the reflectively loaded DLL. This was causing very weird crashes in the Invoke-NinjaCopy script which is built on this script. This should fix the crash.
2013-08-29Added ProcessModuleTrace cmdletsmattifestation4-2/+153
Added *-ProcessModuleTrace cmdlets to trace details when modules are loaded into a process. These can be useful for malware analysis.
2013-08-17Explicitly casting types as [Type]v2.2Matt Graeber2-6/+6
The latest version of .NET added generics to many of the InteropService methods. Therefore, all of my uses of types need to be explicitly cast with [Type].
2013-08-17Added ps1xml file for Get-ILDisassemblyMatt Graeber3-3/+46
Output from Get-ILDisassembly is slightly cleaner.
2013-08-17Removing Get-PEArchitectureMatt Graeber3-100/+1
This functionality is present and maintained in Get-PEHeader.
2013-08-17Get-Keystrokes now accepts relative pathsMatt Graeber1-1/+3
2013-08-17Out-Minidump now provides descriptive outputMatt Graeber1-2/+2
Out-Minidump now outputs a FileInfo object (i.e. the same output as Get-ChildItem) upon successfully creating a dump file.
2013-08-17Added additional error handling to Get-GPPPasswordMatt Graeber1-3/+10
2013-08-17Merge pull request #11 from hajdbo/patch-1Matt Graeber1-2/+2
added ErrorAction SilentlyContinue to Get-ChildItem
2013-08-16Compiler parameters were not applied to Add-TypeMatt Graeber1-4/+2
The compiler parameters were not being applied to Add-Type in Get-PEHeader. Derp. This led to unexpected errors when Visual Studio environment variables were defined.
2013-08-12added ErrorAction SilentlyContinue to Get-ChildItemhajdbo1-2/+2
Sometimes you will have a denied access to a directory. "ErrorAction SilentlyContinue" will continue searching recursively in \SYSVOL even when it encounters a directory where access is denied.
2013-07-28Get-PEHeader can now return raw section dataMatt Graeber1-7/+45
2013-07-28Latest version of .NET Framework broke Get-PEHeaderMatt Graeber1-15/+15
To fix this, I needed to explicitly cast types in the SizeOf and PtrToStructure methods.
2013-07-11Latest version of .NET Framework broke Get-PEBMatt Graeber1-12/+12
To fix this, I needed to explicitly cast types in the SizeOf and PtrToStructure methods.
2013-07-09Added Get-ObjDumpMatt Graeber4-2/+1007
Get-ObjDump parses and return information about one or more Windows object files. It is similar to dumpbin but it returns objects!
2013-07-06Merge pull request #10 from mattifestation/webstersprodigy-PortscanMatt Graeber3-2/+1094
Webstersprodigy portscan
2013-07-06Added Invoke-Portscan to READMEMatt Graeber1-0/+4
2013-07-06Merge branch 'Portscan' of https://github.com/webstersprodigy/PowerSploit ↵Matt Graeber2-2/+1090
into webstersprodigy-Portscan Conflicts: Recon/Recon.psd1
2013-07-04Forgot to add CodeIntegrityInformation to helpMatt Graeber1-0/+4
2013-07-04Get-NtSystemInformation can now query UMCI infoMatt Graeber2-0/+55
Get-NtSystemInformation now returns SystemCodeIntegrityInformation - i.e. user-mode code integrity settings. This required reverse engineering a dll that is only present on Windows 8 ARM devices.
2013-07-04Merge pull request #9 from obscuresec/masterMatt Graeber2-6/+6
Bug fix for error handling
2013-07-03Update Get-TimedScreenshot.ps1Chris Campbell1-5/+5
Fix error handling and various style problems
2013-07-03Fix improper use of $Error[0]Chris Campbell1-1/+1
2013-07-03Merge pull request #8 from obscuresec/masterMatt Graeber1-1/+5
Add checks to terminate script if not running in proper environment.
2013-07-03Terminating Errors AddedChris Campbell1-1/+5
Added checks to ensure that the script is being ran on a domain-joined machine and with a domain account.
2013-07-03Updated Get-GPPPasswordMatt Graeber5-113/+133
2013-06-30Added Get-KeystrokesMatt Graeber3-1/+252
Get-Keystrokes is a PowerShell keylogger
2013-06-25IPv6 support in hosts paramRich Lundeen1-11/+14
2013-06-18fixing EOL spaces (again, sorry)Rich Lundeen1-3/+0
2013-06-18fixing EOL spacesRich Lundeen1-24/+13
2013-06-18Addressed mattifestation feedbackRich Lundeen1-235/+275
See https://github.com/mattifestation/PowerSploit/pull/6#issuecomment-19289063 1) I like this feedback a lot and took it. 2) I tried going thread only but it got messed up with very large scans. Eventually, I didn't think it was worth the amount of effort to make it reliable with only threads 3) Tried to do this 4) Did this 5) I like the idea in general and I took this one place (top-ports), but not for the two examples you gave. The reasoning is, I want people to be able to specify various options and arrays aren't that flexible. For example, I want people to specify a port list like "80,90,8080-8090". Similar with CIDR, since that's one option, but they could also be specifying hostnames e.g. "google.com,192.168.1.1/24,10.0.0.1"
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-29 10:36:52 +0000