PowerSploit - PowerSploit - A PowerShell Post-Exploitation Framework

Age	Commit message (Collapse)	Author	Files	Lines
2016-04-08	Merge pull request #122 from joncave/patch-1	HarmJ0y	1	-0/+1
	Find-PathHijack: Expand environment variables in path
2016-03-20	Find-PathHijack: Expand environment variables in path	Jon Cave	1	-0/+1
	Paths containing environment variables can cause false-positives to occur, e.g. `%SystemRoot%\system32\WindowsPowerShell\v1.0\`. `Find-PathHijack` will believe this is a relative path and will report it as hijackable if the current directory is writeable.
2016-03-15	Moved admin check for Get-System to allow for RevToSelf	Harmj0y	1	-4/+4

2016-03-11	Added Get-System to Privesc/	Harmj0y	2	-3/+594
	Added Pester tests for Get-System
2016-02-12	Added Pester tests for Get-SiteListPassword	Harmj0y	1	-2/+7
	Encrypted password check for Get-SiteListPassword fields
2016-02-12	Added additional search paths, code cleanup.	Harmj0y	1	-42/+14

2016-02-11	Added Get-SiteListPassword to decrypt McAfee SiteList.xml file passwords.	Harmj0y	2	-1/+203

2016-01-25	Merge pull request #111 from sagishahar/dev	HarmJ0y	1	-3/+3
	Fix 'Install-ServiceBinary' for non-'Modifiable' files
2016-01-25	Merge pull request #108 from sagishahar/master	HarmJ0y	1	-55/+64
	Add 'CanRestart' to output and Pester tests
2016-01-17	Fix 'Install-ServiceBinary' for non-'Modifiable' files	sagishahar	1	-3/+3
	The 'Install-ServiceBinary' function fails on an edge case where the service's file permission does not include the 'Modify' permission but does include the 'Write' permission (https://technet.microsoft.com/en-au/library/dd349321(v=ws.10).aspx). In this scenario, renaming the original service file for backup purposes will result in 'Access Denied' message. Fixing this requires that the file be copied to service.exe.bak instead of renamed to service.exe.bak.
2016-01-13	Add 'CanRestart' to output and Pester tests	sagishahar	1	-55/+64
	Pester tests to the function 'Test-ServiceDaclPermission' were added in order to increase confidence in its reliability. In general, my intention was to replace the current functionality of the service management functions such as Invoke-ServiceStart, to not use blindly 'sc.exe start' but rather consult with the DACL permissions and base the decision on that. Unforunately, further investigation lead me to the conclusion that retrieval of the service's DACL permissions requires that an additional DACL permission (RC) be set. This may lead to an edge case that could miss a potential privilege escalation condition and thereby the original idea was discarded. Nonetheless, 'Test-ServiceDaclPermission' can be used for less critical tasks. Therefore, a 'CanRestart' property was added to the output of the service enumeration functions such as 'Get-ServiceUnquoted' as I think that it will add value to redteamers/pentesters by helping them prioritise which service should be abused for escalation of privileges. Services that can be restarted by a low privileged user will probably be prioritised first. Additionally, manual checking whether the vulnerable service can be restarted would not be required in most cases.
2015-12-29	Sorted exports into alphabetical order	Stuart Morgan	1	-13/+13

2015-12-18	Set all module versions to 3.0	Matt Graeber	1	-61/+1
	Also cleaned up some module manifest cruft.
2015-12-14	Removed commented blocks.	Harmj0y	1	-6/+6

2015-12-14	Removed C# enum for Test-ServiceDaclPermission	Harmj0y	1	-42/+42

2015-12-03	Added ./Privesc/ folder that integrates PowerUp.ps1	Harmj0y	4	-0/+2467
	Updated README.md's