aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-07-04Get-NtSystemInformation can now query UMCI infoMatt Graeber2-0/+55
Get-NtSystemInformation now returns SystemCodeIntegrityInformation - i.e. user-mode code integrity settings. This required reverse engineering a dll that is only present on Windows 8 ARM devices.
2013-07-04Merge pull request #9 from obscuresec/masterMatt Graeber2-6/+6
Bug fix for error handling
2013-07-03Update Get-TimedScreenshot.ps1Chris Campbell1-5/+5
Fix error handling and various style problems
2013-07-03Fix improper use of $Error[0]Chris Campbell1-1/+1
2013-07-03Merge pull request #8 from obscuresec/masterMatt Graeber1-1/+5
Add checks to terminate script if not running in proper environment.
2013-07-03Terminating Errors AddedChris Campbell1-1/+5
Added checks to ensure that the script is being ran on a domain-joined machine and with a domain account.
2013-07-03Updated Get-GPPPasswordMatt Graeber5-113/+133
2013-06-30Added Get-KeystrokesMatt Graeber3-1/+252
Get-Keystrokes is a PowerShell keylogger
2013-06-08New-Object proxy function compatibility fixMatt Graeber1-0/+0
I was calling the [Guid]::TryParse method that was only present in .NET 4 so this wasn't working in PowerShell v2.
2013-06-05Forgot to add -Property param to CLSID optionMatt Graeber1-0/+0
2013-06-05Added New-Object proxy functionMatt Graeber3-1/+5
You can provide a CLSID (i.e. a Guid) to New-Object via the -ComObject parameter in addition to a ProgId.
2013-06-01Type names added to Get-NtSystemInformationMatt Graeber2-4/+227
When displaying handle information, you can now filter by and display object type names: Get-NtSystemInformation
2013-05-31Added Invoke-ReflectivePEInjectionMatt Graeber56-1551/+4246
Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection is a vast improvement over Invoke-ReflectiveDllInjection. It adds the following features: * Now supports loading exe files in memory * Supports reflective dll injection into a remote process * Additional sample Visual Studio solutions
2013-05-31Fixed architecture detection bug in Get-PEBMatt Graeber1-1/+1
I was checking processor architecture when I should have been checking OS architecture.
2013-05-29Silly me. Just discovered the SetOffset method.Matt Graeber1-77/+75
Thanks @JosephBialek!
2013-05-25ProcessParameters now displays properlyMatt Graeber1-6/+3
2013-05-24Get-PEB now parses _RTL_USER_PROCESS_PARAMETERSMatt Graeber2-1/+201
2013-05-18"Best practice" improvements to Out-MinidumpMatt Graeber1-42/+39
2013-05-16_SYSTEM_HANDLE_INFORMATION prints as a table nowMatt Graeber1-34/+56
2013-05-16Added _SYSTEM_LOCK_INFORMATION structMatt Graeber2-1/+119
Yet another method of leaking kernel pointers.
2013-05-15Added Out-MinidumpMatt Graeber3-1/+139
Out-Minidump writes a process dump file with all process memory to disk. This is similar to running procdump.exe with the '-ma' switch.
2013-05-13Cleaned up Get-NtSystemInformationMatt Graeber1-2385/+81
* Removed the unnecessary NTSTATUS entries * Used splatting instead of backticks * Fixed a n00b memory management error as well.
2013-05-13Added an idiot filter to Watch-BlueScreenMatt Graeber1-3/+7
2013-05-13Added Watch-BlueScreenMatt Graeber3-1/+79
Causes a blue-screen (bugcheck) to occur.
2013-05-12Object access mask now displays properlyMatt Graeber1-2/+3
2013-05-12Removed duplicate type definitionMatt Graeber1-15/+0
2013-05-12Removed some extraneous commentsMatt Graeber1-17/+17
2013-05-12Added Get-NtSystemInformationMatt Graeber4-6/+3431
Get-NtSystemInformation is a wrapper function for NtQuerySystemInformation. It is a swiss-army knife tool for obtaining internal OS information. It can currently be used to query the following: global flags, handles, objects, kernel pool allocations, and loaded kernel modules
2013-05-12Removing Get-KernelModuleInfoMatt Graeber2-321/+0
Making way for Get-NtSystemInformation. Loaded kernel module information can be viewed with `Get-NtSystemInformation -ModuleInformation`
2013-05-12Removed test code in Invoke-ShellcodeMSILMatt Graeber1-4/+1
There was some test code at the end of Invoke-ShellcodeMSIL that would cause the function to execute when the script was dotsourced.
2013-05-10Added ConvertTo-StringMatt Graeber1-0/+70
ConvertTo-String converts the bytes of a file to a string that has a 1-to-1 mapping back to the file's original bytes. ConvertTo-String is useful for performing binary regular expressions.
2013-05-06Merge pull request #3 from garignack/masterMatt Graeber1-132/+185
Merged Find-AVSignature performance improvements from garignack. Thanks, garignack!
2013-05-02Code cleanup based upon discussion commentsgarignack1-5/+13
Added comment-based help parameter, added additional parameter validation, piped ReadStream.seek command to out-null to prevent output to stdout.
2013-05-02Find-AVSignature Performance Improvementsgarignack1-132/+177
Updated code to use [System.IO.FileStream] class with a buffer (64kb default) to greatly increase performance, especially when handling large files. Updated $EndBytes validation logic to change it to a valid value rather than throw an error.
2013-04-28Added ARM support to Get-PEHeaderMatt Graeber2-720/+741
Also fixed various pointer width bugs
2013-04-06Adding reflective DLL loading capabilityMatt Graeber15-1/+1960
Adding Invoke-ReflectiveDllInjection. PowerSploit now has reflective DLL loading capabilities!!! Thanks to Joe Bialek @JosephBialek for writing this awesome code!
2013-04-05Adding Invoke-ShellcodeMSILMatt Graeber3-87/+361
Invoke-ShellcodeMSIL executes shellcode without making any Win32 function calls.
2013-04-05Fixed x86 bug in Get-MethodAddressMatt Graeber1-110/+119
Get-MethodAddress was not working correctly in 32-bit PowerShell because it was returning a [UInt64] value when it should have been a [UInt32]. This fix will detect if PowerShell is running as 32 or 64-bit and define its return type accordingly.
2013-04-04Adding Persistence moduleMatt Graeber8-284/+1049
2013-03-10DownloadFromMSSymbolServer is a better nameMatt Graeber1-1/+1
2013-03-10Fixed export parsing bug in Get-PEHeaderMatt Graeber1-1/+1
2013-03-10Added DownloadEXEFromMSSymbolServer methodMatt Graeber1-881/+902
After parsing a PE header with Get-PEHeader, you now have the option of downloading the original executable from Microsoft's symbol server for reference/comparision.
2013-02-17Updated 64-32bit conversion logic for Metasploitbitform1-2/+2
2013-02-17Get-MethodAddress now returns an IntPtr.bitform1-3/+1
It previously returned a UInt64. Returning an IntPtr makes more sense.
2013-01-23Removed .git* filesbitform2-4/+0
They weren't relevant.
2013-01-21Consistency improvements in comment-based helpbitform21-234/+296
2013-01-20PowerSploit is now a respectable module!bitform3-31/+150
PowerSploit just got a complete makeover! It is now comprised of a collection of modules grouped by category.
2013-01-20Updated PETools module file listbitform1-1/+1
2013-01-20Corrections made to usage documentationbitform2-2/+2
2013-01-20Moved scripts to their respective modules.bitform5-1354/+0
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-30 12:05:15 +0000