aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-06-06Rewrote/corrected logic for Get-NetGPOGroup, Find-GPOLocation, and ↵Harmj0y1-281/+293
Find-GPOComputerAdmin Rewrote/corrected logic for Find-GPOLocation Added Get-IniContent and rewrote Get-GptTmpl to use Get-IniContent to parse GptTmpl.inf files Rewrote Get-GroupsXML to not resolve SIDs and return the same object type as Get-GptTmpl
2016-06-04Merge pull request #148 from PowerShellMafia/powerup_psreflectHarmJ0y5-1378/+3114
PowerUp PSReflect
2016-06-04Get-ModifiablePath now also checks parent folders of files for modificationHarmj0y2-110/+193
Bug fixes Corrected PowerUp Pester tests Changed 'Path' field to 'ModifiablePath' in 'Get-ModifiablePath' Get-ServiceUnquoted now filters paths through Get-ModifiablePath
2016-06-04Renamed Get-RegistryAutoRun to Get-ModifiableRegistryAutoRunHarmj0y5-37/+43
Renamed Find-PathHijack to Find-PathDLLHijack Fixed exposed functions in PowerSploit.psd1
2016-06-04Overhauled and completed PowerUp/Privesc Pester testsHarmj0y1-213/+622
2016-06-04-Enum specification bug fixHarmj0y1-62/+70
-Additional error checking and documentation -OpenProcessToken() call now uses TOKEN_QUERY instead of TOKEN_READ
2016-06-03Added SidAttributes enum, Get-CurrentUserTokenGroupSid now returns an object ↵Harmj0y1-27/+43
with SID and attributes fields
2016-06-03Added Get-CurrentUserTokenGroupSid to enumerate all group SIDs the current ↵Harmj0y3-4/+94
user is a part of, regardless of being disabled. Replaced 'whoami /groups' local admin + medium integrity check with comparison against Get-CurrentUserTokenGroupSid
2016-06-03-Added ValueFromPipelineByPropertyName to Get-ModifiablePath to parse passed ↵Harmj0y1-603/+492
file objects -Service functions now accept just -Name (instead of -Service/-ServiceName) that accepts has ValueFromPipelineByPropertyName set in order to handle service objects on the pipeline -Moved PSReflect signatures to the bottom of the script -Function and help cleanup
2016-06-02Updated Privesc README.md and .psd1 to reflect the new PowerUp function names.Harmj0y2-34/+44
2016-06-02-Get-ModifiableFile renamed to Get-ModifiablePathHarmj0y1-249/+330
-Get-VulnSchTask renamed to Get-ModifiableScheduledTaskFile -Get-VulnAutoRun renamed Get-RegistryAutoRun -Get-RegAutoLogon renamed Get-RegistryAutoLogon -Find-DLLHijack renamed to Find-ProcessDLLHijack for clarification, code cleaned up, -Process parameter added, output object detail expanded, and help expanded -Removed most of the code from Find-PathHijack, replacing it with Get-ModifiablePath -Cleaned up logic for Write-HijackDll -Expanded help for the registry enumeration cmdlets -Added local user creation options to Write-HijackDll to match Write-ServiceBinary -Increased pause between user creation commands
2016-06-02-Help expanded for Invoke-ServiceAbuseHarmj0y1-340/+490
-Fixed parameter sets for Write-ServiceBinary and added -Credential and -Service params -Simplified/corrected logic for Install-ServiceBinary -Fixed parameter sets and simplified logic for Restore-ServiceBinary -Added sanity check with Get-ModifiableFile for Install-ServiceBinary -Cleaned up lingering spaces
2016-06-01-Removed Invoke-ServiceStart, Invoke-ServiceStop, Invoke-ServiceEnable, ↵Harmj0y1-425/+1419
Invoke-ServiceDisable -Renamed Get-ServiceFilePermission to Get-ModifiableServiceFile -Renamed Get-ServicePermission Get-ModifiableService -Integrated PSReflect codebase from @mattifestation -Modified Get-ModifiableFile to enumerate the ACLs for passed file paths, returning the path/permission set/identityreference for each modifable file (instead of opening file for modification) -Added Add-ServiceDacl from @mattifestation to add service Dacls to Get-Service objects -Added Set-ServiceBinPath replace "sc.exe config SERVICE binPath= X" - now modifies using the ChangeServiceConfig Win32 API call -Revamped Test-ServiceDaclPermission to take advantage of Add-ServiceDacl. Service permissions are now matched up against the current user's group memberships and specified permission sets to check for. -Functions that checked for service restarting now use Test-ServiceDaclPermission -Get-ModifiableService now uses Test-ServiceDaclPermission -Invoke-ServiceAbuse completely rebuilt to use native PowerShell functions and Set-ServiceBinPath to reconfiguring service binary paths for abuse -Parameter sets rewritten for several functions to accept -Credential objects were applicable and -Service objects from Get-Service on the pipeline TODO: Tune up Write-ServiceBinary, Install-ServiceBinary, Restore-ServiceBinary, Find-DLLHijack, Find-PathHijack, Write-HijackDll, and all the registry checks
2016-05-31Bug fix for Get-System for when a needed assembly isn't loaded.Harmj0y1-0/+2
2016-05-31Merge branch 'dev' of https://github.com/PowerShellMafia/PowerSploit into devHarmj0y5-4/+44
2016-05-31Corrected error checking for functions that used GetLastErrorHarmj0y1-182/+89
General errors are now parsed with [ComponentModel.Win32Exception] and written with Write-Verbose Write-Debug calls converted to Write-Verbose or removed
2016-05-29Merge remote-tracking branch 'refs/remotes/origin/master' into devMatt Graeber1-0/+40
2016-05-29Merge pull request #132 from pyllyukko/sch_hourlyMatt Graeber1-0/+40
Add hourly scheduled task persistence option
2016-05-29Fixed FreeLibrary function signature #146Matt Graeber4-4/+4
The parameter type and return types were accidentally transposed. Thanks @rojaster for pointing this out.
2016-05-23Combined Get-SiteListPassword.ps1 into PowerUp.ps1Harmj0y3-179/+189
2016-05-23Bug fix for issue #137Harmj0y1-13/+12
2016-05-22Updated functions in Recon.psd1Harmj0y1-1/+13
2016-05-22-Fixed bug in Get-NetGroupMember's ranged searching logic on PowerShell v3+Harmj0y1-123/+114
-Corrected parameter/variable scoping bug in several functions -TODO: fix begin{} scoping issues in Find-InterestingFile, Invoke-UserHunter, Invoke-ProcessHunter, Invoke-EventHunter, Invoke-ShareFinder, Invoke-FileFinder, Find-LocalAdminAccess, Invoke-EnumerateLocalAdmin -Other misc. fixes
2016-05-22Get-LoggedOnLocal now handles the situation when multiple SIDs are returnedHarmj0y1-101/+33
Get-LoggedOnLocal turned into a filter and given additional error handling Standardized tab/line spacing Removed Invoke-PSLoggedOn
2016-05-22Merge pull request #133 from breakersall/devHarmJ0y1-0/+143
Adds PSLoggedOn like functionality
2016-05-18Merge pull request #140 from Meatballs1/fix_groups_xmlHarmJ0y1-10/+32
PowerView - Fix Groups.xml Parsing
2016-05-13Logic bug fix in Get-NetDomainTrustHarmj0y1-1/+1
2016-05-13Merge branch 'dev' of https://github.com/PowerShellMafia/PowerSploit into devHarmj0y4-1/+224
2016-05-13Get-NetDomainTrust now gets an -API option to enumerate trusts through ↵Harmj0y1-16/+169
DsEnumerateDomainTrusts() Logic bug fix for Get-DNSZone Bug fix for Get-NetLocalGroup
2016-05-12Fix groupsxml parsingMeatballs1-10/+32
2016-05-12Merge pull request #139 from sixdub/devMatt Graeber4-1/+224
Added Get-MicrophoneAudio.ps1 and associated Pester tests
2016-05-12Added Get-MicrophoneAudio.ps1 and associated Pester testssixdub4-1/+224
2016-05-09Merge pull request #135 from Meatballs1/trust_sidsHarmJ0y1-0/+6
Retrieve Domain SIDs with -LDAP
2016-05-10Added Invoke-UserHunter field to keep output objects in sync.Harmj0y1-0/+1
2016-05-09Merge pull request #136 from andyrobbins/devHarmJ0y1-0/+20
Added name resolution to custom PSObject generated by Invoke-UserHunter.
2016-05-10Added name resolution to custom PSObject generated by Invoke-UserHunter.Andy Robbins1-0/+20
2016-05-09Began adding custom PSObject TypeNames to various PowerView output objects.Harmj0y1-7/+27
2016-05-09Retrieve Domain SIDs with -LDAPMeatballs1-0/+6
2016-05-05Adds PSLoggedOn like functionalityMatt Kelly1-0/+143
Adding in Get-LoggedOnLocal which uses HKU registry checks to see who is logged locally to a remote box and only requires user level access rights. The benefit over NetWkstaUserEnum is less user privileges required (admin for NetWkstaUserEnum) and is the same process PSLoggedOn uses. Invoke-PSLoggedOn launches both Get-LoggedOnLocal and Get-NetSessions and outputs the same format as PSLoggedOn.exe from Sysinternals. I did not change Invoke-UserHunter non-stealth to this option yet, but it is beneficial in that if you use both HKU and NetSessionEnum you only require basic user level rights not admin remote.
2016-05-03Added Get-RegistryMountedDriveHarmj0y1-6/+120
2016-04-27Modified Convert-DNSRecord to return the base64 encoded record for record ↵Harmj0y1-52/+26
types not currently handled.
2016-04-27Added Get-DNSZone and Get-DNSRecord to enumerate AD DNS information.Harmj0y1-0/+360
Added Convert-DNSRecord (ported from Michael B. Smith's code at https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1) - needs expansion work on record types
2016-04-25Changed some property types in Get-ObjectACLHarmj0y1-2/+9
2016-04-25Added ScheduledTaskHourly to New-UserPersistenceOptionpyllyukko1-0/+20
2016-04-24added Request-SPNTicket to request kerberos tickets for specified SPNsHarmj0y1-0/+48
2016-04-24For PowerView, added $Searcher.CacheResults = $False to Get-DomainSearcherHarmj0y1-19/+71
Added dispose() approach for the following cmdlets: Get-NetUser, Get-ObjectAcl/Add-ObjectAcl, Get-GUIDMap, Get-NetComputer, Get-ADObject, Get-NetOU, Get-NetSite, Get-NetSubnet, Get-NetGroup, Get-NetGroupMember, Get-DFSshare, Get-NetGPO, Get-NetDomainTrust
2016-04-24Merge pull request #128 from Meatballs1/fix_groups_xmlHarmJ0y1-2/+2
//Group -> //Groups
2016-04-16Added ScheduledTaskHourly to New-ElevatedPersistenceOptionpyllyukko1-0/+20
2016-04-11Merge pull request #125 from leechristensen/patch-1HarmJ0y1-1/+1
Change ComputerName default to the computer's name
2016-04-11Change ComputerName default to the computer's nameleechristensen1-1/+1
Change ComputerName default so Disabled doesn't report error
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-26 03:22:22 +0000