aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-07-19Merge pull request #168 from linuz/masterHarmJ0y1-6/+30
Added ability to specify domain controller to search (-Server parameter)
2016-07-19Added default value to parameterDennis Maldonado1-12/+4
Added default value to parameter and got rid of value check later in the code. Added validation of -Server value to ensure it is not $Null or an empty string
2016-07-15Merge branch 'dev' of https://github.com/PowerShellMafia/PowerSploit into devHarmj0y1-8/+13
2016-07-15typeHarmj0y1-1/+1
2016-07-15Fix for issue #167Harmj0y1-2/+4
2016-07-15Updated Invoke-Mimikatz to "2.1 alpha 20160711 (oe.eo) edition"Matt Graeber1-7/+5
2016-07-15#147 Bugfix: Invoke-MimikatzMatt Graeber1-1/+8
Invoke-Mimikatz was not not handling functions exported by ordinal. Thank you @gentilkiwi for the suggested fix!
2016-07-15Merge pull request #161 from joncave/batnewlinesHarmJ0y1-2/+2
PowerUp: Remove badly encoded new lines from .bat output
2016-07-15Merge pull request #160 from joncave/tokeninfoHarmJ0y1-6/+5
PowerUp: Allocate enough space for TOKEN_GROUPS
2016-07-15Merge pull request #158 from joncave/groupsxmlHarmJ0y1-7/+7
PowerView: Fix Groups.xml parsing for multiple <Group>s
2016-06-30Added ability to specify domain controller to search (-Server parameter)Dennis Maldonado1-5/+37
Added the ability for users to specify the domain controller that is searched, using the -Server parameter. The -Server parameter is optional and defaults to the user's current domain if not specified.
2016-06-30PowerUp: Remove badly encoded new lines from .bat outputJon Cave1-2/+2
The current implementation results in a .bat like: @echo off\n start /b net user john Password123! /add && timeout /t 5 && net localgroup Administrators john /add\n start /b "" cmd /c del "%~f0"&exit /b With literal "\n" strings at the end of the first two lines. A new line in a PowerShell string should be "`n". However, an extra new line isn't actually necessary in this case.
2016-06-30PowerUp: Allocate enough space for TOKEN_GROUPSJon Cave1-6/+5
Make an initial call to GetTokenInformation() with a NULL buffer to get the actual buffer size required. Prevents "The data area passed to a system call is too small" error being thrown.
2016-06-27Use correct variableJon Cave1-1/+1
2016-06-27Fix Get-GroupsXML for multiple <Group> tagsJon Cave1-6/+6
Select all <Group> nodes and iterate through them, not just the root <Groups> node.
2016-06-24Changed Get-NetGroup and Get-NetGroupMember to search for samaccountname ↵Harmj0y1-6/+6
instead of name
2016-06-24Fixed Find-LocalAdminAccess to properly check for the object output from ↵Harmj0y1-4/+4
Invoke-CheckLocalAdminAccess...whoops
2016-06-24Turned Get-GptTmpl and Get-GroupsXML into filtersHarmj0y1-113/+121
2016-06-24Merge pull request #157 from Meatballs1/localgrouprecursionHarmJ0y1-75/+72
Fix Get-NetLocalGroup Recursion for LocalGroups
2016-06-23Fixed bug in Get-ModifiablePath that resulted in spaces being expanded to ↵Harmj0y2-42/+101
the current directory location Fixed other logic bugs in Get-ModifiablePath Fixed bug in Add-ServiceDacl when the [ServiceProcess.ServiceController] wasn't loaded yet by Get-Service Error handling for Get-CachedGPPPassword Changed some Write-Warnings to Write-Verbose Updated Privesc Pester tests for PowerUp
2016-06-21Add missing parenthesisMeatballs1-1/+1
2016-06-21Check class typeMeatballs1-76/+73
Recurse if localgroup as well as domaingroup Normalize output values to empty string
2016-06-14Fixed logic bugs in Find-GPOLocation and Find-GPOComputerAdminHarmj0y1-30/+64
2016-06-12Fixed some Invoke-MapDomainTrust and Get-NetDomainTrust logicHarmj0y1-46/+57
Changed domain/forest Write-Warning's to Write-Verbose
2016-06-12Cleaned up Get-NetGroup's logic a bit, removed filtering for primary group ↵Harmj0y1-76/+96
ID (i.e. domain users) Modified Get-DomainSID to simplify Changed group determination in Get-NetLocalGroup -API Few optimizations to Find-ForeignUser and Find-ForeignGroup Changed DNS resolution method for Invoke-UserHunter Added 'PowerView.GPOLocalGroup' type to Find-GPOLocation
2016-06-12Merge pull request #150 from breenmachine/devHarmJ0y1-1/+1
Fixed thread countdown timer in Invoke-ThreadedFunction, wasn't ever …
2016-06-11Fixed thread countdown timer in Invoke-ThreadedFunction, wasn't ever killing ↵Stephen Breen1-1/+1
rogue jobs
2016-06-08Fixed LDAP preference for when -ADSPath is passed to Get-NetDomainTrustHarmj0y1-20/+29
Fixed Get-DomainSID to allow for a -DomainController parameter Fixed Get-NetDomainTrust logic
2016-06-08Fixed a few GC bugs in Get-DomainSearcherHarmj0y1-24/+49
Added attempted gpcfilesyspath resolution to Get-NetGPO Added -ADSPath for Get-NetDomainTrust
2016-06-07bug fixes/error handling in Get-NetGPOGroup for version 2Harmj0y1-30/+43
2016-06-07Corrected -Path parameter in Write-ServiceBinaryHarmj0y1-6/+6
2016-06-06Small bug fix in Find-GPOLocation when enumerating all relationshipsHarmj0y1-29/+79
Moved GPOType check to Get-NetGPOGroup Expanded comments and help for GPO location cmdlets
2016-06-06updated Privesc.psd1 and README.mdHarmj0y2-0/+2
2016-06-06Addded Get-CachedGPPPassword to PowerUp, based almost entirely on ↵Harmj0y2-0/+234
Get-GPPPassword. Added Pester tests for Get-CachedGPPPassword.
2016-06-06Rewrote/corrected logic for Get-NetGPOGroup, Find-GPOLocation, and ↵Harmj0y1-281/+293
Find-GPOComputerAdmin Rewrote/corrected logic for Find-GPOLocation Added Get-IniContent and rewrote Get-GptTmpl to use Get-IniContent to parse GptTmpl.inf files Rewrote Get-GroupsXML to not resolve SIDs and return the same object type as Get-GptTmpl
2016-06-04Merge pull request #148 from PowerShellMafia/powerup_psreflectHarmJ0y5-1378/+3114
PowerUp PSReflect
2016-06-04Get-ModifiablePath now also checks parent folders of files for modificationHarmj0y2-110/+193
Bug fixes Corrected PowerUp Pester tests Changed 'Path' field to 'ModifiablePath' in 'Get-ModifiablePath' Get-ServiceUnquoted now filters paths through Get-ModifiablePath
2016-06-04Renamed Get-RegistryAutoRun to Get-ModifiableRegistryAutoRunHarmj0y5-37/+43
Renamed Find-PathHijack to Find-PathDLLHijack Fixed exposed functions in PowerSploit.psd1
2016-06-04Overhauled and completed PowerUp/Privesc Pester testsHarmj0y1-213/+622
2016-06-04-Enum specification bug fixHarmj0y1-62/+70
-Additional error checking and documentation -OpenProcessToken() call now uses TOKEN_QUERY instead of TOKEN_READ
2016-06-03Added SidAttributes enum, Get-CurrentUserTokenGroupSid now returns an object ↵Harmj0y1-27/+43
with SID and attributes fields
2016-06-03Added Get-CurrentUserTokenGroupSid to enumerate all group SIDs the current ↵Harmj0y3-4/+94
user is a part of, regardless of being disabled. Replaced 'whoami /groups' local admin + medium integrity check with comparison against Get-CurrentUserTokenGroupSid
2016-06-03-Added ValueFromPipelineByPropertyName to Get-ModifiablePath to parse passed ↵Harmj0y1-603/+492
file objects -Service functions now accept just -Name (instead of -Service/-ServiceName) that accepts has ValueFromPipelineByPropertyName set in order to handle service objects on the pipeline -Moved PSReflect signatures to the bottom of the script -Function and help cleanup
2016-06-02Updated Privesc README.md and .psd1 to reflect the new PowerUp function names.Harmj0y2-34/+44
2016-06-02-Get-ModifiableFile renamed to Get-ModifiablePathHarmj0y1-249/+330
-Get-VulnSchTask renamed to Get-ModifiableScheduledTaskFile -Get-VulnAutoRun renamed Get-RegistryAutoRun -Get-RegAutoLogon renamed Get-RegistryAutoLogon -Find-DLLHijack renamed to Find-ProcessDLLHijack for clarification, code cleaned up, -Process parameter added, output object detail expanded, and help expanded -Removed most of the code from Find-PathHijack, replacing it with Get-ModifiablePath -Cleaned up logic for Write-HijackDll -Expanded help for the registry enumeration cmdlets -Added local user creation options to Write-HijackDll to match Write-ServiceBinary -Increased pause between user creation commands
2016-06-02-Help expanded for Invoke-ServiceAbuseHarmj0y1-340/+490
-Fixed parameter sets for Write-ServiceBinary and added -Credential and -Service params -Simplified/corrected logic for Install-ServiceBinary -Fixed parameter sets and simplified logic for Restore-ServiceBinary -Added sanity check with Get-ModifiableFile for Install-ServiceBinary -Cleaned up lingering spaces
2016-06-01-Removed Invoke-ServiceStart, Invoke-ServiceStop, Invoke-ServiceEnable, ↵Harmj0y1-425/+1419
Invoke-ServiceDisable -Renamed Get-ServiceFilePermission to Get-ModifiableServiceFile -Renamed Get-ServicePermission Get-ModifiableService -Integrated PSReflect codebase from @mattifestation -Modified Get-ModifiableFile to enumerate the ACLs for passed file paths, returning the path/permission set/identityreference for each modifable file (instead of opening file for modification) -Added Add-ServiceDacl from @mattifestation to add service Dacls to Get-Service objects -Added Set-ServiceBinPath replace "sc.exe config SERVICE binPath= X" - now modifies using the ChangeServiceConfig Win32 API call -Revamped Test-ServiceDaclPermission to take advantage of Add-ServiceDacl. Service permissions are now matched up against the current user's group memberships and specified permission sets to check for. -Functions that checked for service restarting now use Test-ServiceDaclPermission -Get-ModifiableService now uses Test-ServiceDaclPermission -Invoke-ServiceAbuse completely rebuilt to use native PowerShell functions and Set-ServiceBinPath to reconfiguring service binary paths for abuse -Parameter sets rewritten for several functions to accept -Credential objects were applicable and -Service objects from Get-Service on the pipeline TODO: Tune up Write-ServiceBinary, Install-ServiceBinary, Restore-ServiceBinary, Find-DLLHijack, Find-PathHijack, Write-HijackDll, and all the registry checks
2016-05-31Bug fix for Get-System for when a needed assembly isn't loaded.Harmj0y1-0/+2
2016-05-31Merge branch 'dev' of https://github.com/PowerShellMafia/PowerSploit into devHarmj0y5-4/+44
2016-05-31Corrected error checking for functions that used GetLastErrorHarmj0y1-182/+89
General errors are now parsed with [ComponentModel.Win32Exception] and written with Write-Verbose Write-Debug calls converted to Write-Verbose or removed
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-26 03:27:35 +0000