aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-05-31Added Invoke-ReflectivePEInjectionMatt Graeber56-1551/+4246
Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection is a vast improvement over Invoke-ReflectiveDllInjection. It adds the following features: * Now supports loading exe files in memory * Supports reflective dll injection into a remote process * Additional sample Visual Studio solutions
2013-05-31Fixed architecture detection bug in Get-PEBMatt Graeber1-1/+1
I was checking processor architecture when I should have been checking OS architecture.
2013-05-29Silly me. Just discovered the SetOffset method.Matt Graeber1-77/+75
Thanks @JosephBialek!
2013-05-25ProcessParameters now displays properlyMatt Graeber1-6/+3
2013-05-24Get-PEB now parses _RTL_USER_PROCESS_PARAMETERSMatt Graeber2-1/+201
2013-05-18"Best practice" improvements to Out-MinidumpMatt Graeber1-42/+39
2013-05-16_SYSTEM_HANDLE_INFORMATION prints as a table nowMatt Graeber1-34/+56
2013-05-16Added _SYSTEM_LOCK_INFORMATION structMatt Graeber2-1/+119
Yet another method of leaking kernel pointers.
2013-05-15Added Out-MinidumpMatt Graeber3-1/+139
Out-Minidump writes a process dump file with all process memory to disk. This is similar to running procdump.exe with the '-ma' switch.
2013-05-13Cleaned up Get-NtSystemInformationMatt Graeber1-2385/+81
* Removed the unnecessary NTSTATUS entries * Used splatting instead of backticks * Fixed a n00b memory management error as well.
2013-05-13Added an idiot filter to Watch-BlueScreenMatt Graeber1-3/+7
2013-05-13Added Watch-BlueScreenMatt Graeber3-1/+79
Causes a blue-screen (bugcheck) to occur.
2013-05-12Object access mask now displays properlyMatt Graeber1-2/+3
2013-05-12Removed duplicate type definitionMatt Graeber1-15/+0
2013-05-12Removed some extraneous commentsMatt Graeber1-17/+17
2013-05-12Added Get-NtSystemInformationMatt Graeber4-6/+3431
Get-NtSystemInformation is a wrapper function for NtQuerySystemInformation. It is a swiss-army knife tool for obtaining internal OS information. It can currently be used to query the following: global flags, handles, objects, kernel pool allocations, and loaded kernel modules
2013-05-12Removing Get-KernelModuleInfoMatt Graeber2-321/+0
Making way for Get-NtSystemInformation. Loaded kernel module information can be viewed with `Get-NtSystemInformation -ModuleInformation`
2013-05-12Removed test code in Invoke-ShellcodeMSILMatt Graeber1-4/+1
There was some test code at the end of Invoke-ShellcodeMSIL that would cause the function to execute when the script was dotsourced.
2013-05-10Added ConvertTo-StringMatt Graeber1-0/+70
ConvertTo-String converts the bytes of a file to a string that has a 1-to-1 mapping back to the file's original bytes. ConvertTo-String is useful for performing binary regular expressions.
2013-05-06Merge pull request #3 from garignack/masterMatt Graeber1-132/+185
Merged Find-AVSignature performance improvements from garignack. Thanks, garignack!
2013-05-02Code cleanup based upon discussion commentsgarignack1-5/+13
Added comment-based help parameter, added additional parameter validation, piped ReadStream.seek command to out-null to prevent output to stdout.
2013-05-02Find-AVSignature Performance Improvementsgarignack1-132/+177
Updated code to use [System.IO.FileStream] class with a buffer (64kb default) to greatly increase performance, especially when handling large files. Updated $EndBytes validation logic to change it to a valid value rather than throw an error.
2013-04-28Added ARM support to Get-PEHeaderMatt Graeber2-720/+741
Also fixed various pointer width bugs
2013-04-06Adding reflective DLL loading capabilityMatt Graeber15-1/+1960
Adding Invoke-ReflectiveDllInjection. PowerSploit now has reflective DLL loading capabilities!!! Thanks to Joe Bialek @JosephBialek for writing this awesome code!
2013-04-05Adding Invoke-ShellcodeMSILMatt Graeber3-87/+361
Invoke-ShellcodeMSIL executes shellcode without making any Win32 function calls.
2013-04-05Fixed x86 bug in Get-MethodAddressMatt Graeber1-110/+119
Get-MethodAddress was not working correctly in 32-bit PowerShell because it was returning a [UInt64] value when it should have been a [UInt32]. This fix will detect if PowerShell is running as 32 or 64-bit and define its return type accordingly.
2013-04-04Adding Persistence moduleMatt Graeber8-284/+1049
2013-03-10DownloadFromMSSymbolServer is a better nameMatt Graeber1-1/+1
2013-03-10Fixed export parsing bug in Get-PEHeaderMatt Graeber1-1/+1
2013-03-10Added DownloadEXEFromMSSymbolServer methodMatt Graeber1-881/+902
After parsing a PE header with Get-PEHeader, you now have the option of downloading the original executable from Microsoft's symbol server for reference/comparision.
2013-02-17Updated 64-32bit conversion logic for Metasploitbitform1-2/+2
2013-02-17Get-MethodAddress now returns an IntPtr.bitform1-3/+1
It previously returned a UInt64. Returning an IntPtr makes more sense.
2013-01-23Removed .git* filesbitform2-4/+0
They weren't relevant.
2013-01-21Consistency improvements in comment-based helpbitform21-234/+296
2013-01-20PowerSploit is now a respectable module!bitform3-31/+150
PowerSploit just got a complete makeover! It is now comprised of a collection of modules grouped by category.
2013-01-20Updated PETools module file listbitform1-1/+1
2013-01-20Corrections made to usage documentationbitform2-2/+2
2013-01-20Moved scripts to their respective modules.bitform5-1354/+0
2013-01-20Added 'AntivirusBypass' Modulebitform4-0/+218
2013-01-20Added 'CodeExecution' Modulebitform5-0/+1142
* I unfortunately needed to change the names of Inject-Shellcode and Inject-Dll to Invoke-Shellcode and Invoke-DllInjection in order to confirm to proper verb naming.
2013-01-20Added 'Exfiltration' Modulebitform4-0/+199
2013-01-20Added 'Recon' Modulebitform4-0/+199
2013-01-20Updated module manifest file listingbitform2-2/+2
2013-01-20Renamed Usage.txt to Usage.md to apply markdown.bitform3-0/+0
2013-01-20Updated PowerSploit README with proper markdownbitform2-189/+168
2013-01-20Created a ScriptModification module.bitform8-48/+326
* All scripts used to prepare and/or modify payload scripts were added to the ScriptModification module. * Added Remove-Comments - Strips comments and extra whitespace from a script. * Encrypt-Script was named to Out-EncryptedScript in order to conform to proper PowerShell verbs.
2013-01-20Removed logic in scripts to load ps1xml filesbitform5-27/+13
* Now that PETools and ReverseEngineering are both full-fledged modules with proper manifests, the manifests will take care of loading the appropriate ps1xml files. * Added Usage.txt to ReverseEngineering module.
2013-01-19PETools module doc. consistency improvementsbitform5-80/+182
* Slight consistency modifications were made to documentation. * Added module manifest for PETools
2013-01-19Renamed RE_Tools. Now ReverseEngineering modulebitform12-89/+227
* I renamed RE_Tools to ReverseEngineering and made it a module. * Slight consistency modifications were made to documentation. * This is one step in the process of modularizing all of PowerSploit.
2013-01-19Removed old release notes.bitform1-17/+0
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-30 10:30:53 +0000