PowerSploit - PowerSploit - A PowerShell Post-Exploitation Framework

Age	Commit message (Collapse)	Author	Files	Lines
2013-08-17	Explicitly casting types as [Type]v2.2	Matt Graeber	2	-6/+6
	The latest version of .NET added generics to many of the InteropService methods. Therefore, all of my uses of types need to be explicitly cast with [Type].
2013-08-17	Added ps1xml file for Get-ILDisassembly	Matt Graeber	3	-3/+46
	Output from Get-ILDisassembly is slightly cleaner.
2013-07-11	Latest version of .NET Framework broke Get-PEB	Matt Graeber	1	-12/+12
	To fix this, I needed to explicitly cast types in the SizeOf and PtrToStructure methods.
2013-07-04	Forgot to add CodeIntegrityInformation to help	Matt Graeber	1	-0/+4

2013-07-04	Get-NtSystemInformation can now query UMCI info	Matt Graeber	2	-0/+55
	Get-NtSystemInformation now returns SystemCodeIntegrityInformation - i.e. user-mode code integrity settings. This required reverse engineering a dll that is only present on Windows 8 ARM devices.
2013-06-08	New-Object proxy function compatibility fix	Matt Graeber	1	-0/+0
	I was calling the [Guid]::TryParse method that was only present in .NET 4 so this wasn't working in PowerShell v2.
2013-06-05	Forgot to add -Property param to CLSID option	Matt Graeber	1	-0/+0

2013-06-05	Added New-Object proxy function	Matt Graeber	2	-1/+1
	You can provide a CLSID (i.e. a Guid) to New-Object via the -ComObject parameter in addition to a ProgId.
2013-06-01	Type names added to Get-NtSystemInformation	Matt Graeber	2	-4/+227
	When displaying handle information, you can now filter by and display object type names: Get-NtSystemInformation
2013-05-31	Fixed architecture detection bug in Get-PEB	Matt Graeber	1	-1/+1
	I was checking processor architecture when I should have been checking OS architecture.
2013-05-29	Silly me. Just discovered the SetOffset method.	Matt Graeber	1	-77/+75
	Thanks @JosephBialek!
2013-05-25	ProcessParameters now displays properly	Matt Graeber	1	-6/+3

2013-05-24	Get-PEB now parses _RTL_USER_PROCESS_PARAMETERS	Matt Graeber	2	-1/+201

2013-05-16	_SYSTEM_HANDLE_INFORMATION prints as a table now	Matt Graeber	1	-34/+56

2013-05-16	Added _SYSTEM_LOCK_INFORMATION struct	Matt Graeber	2	-1/+119
	Yet another method of leaking kernel pointers.
2013-05-13	Cleaned up Get-NtSystemInformation	Matt Graeber	1	-2385/+81
	* Removed the unnecessary NTSTATUS entries * Used splatting instead of backticks * Fixed a n00b memory management error as well.
2013-05-12	Object access mask now displays properly	Matt Graeber	1	-2/+3

2013-05-12	Removed duplicate type definition	Matt Graeber	1	-15/+0

2013-05-12	Removed some extraneous comments	Matt Graeber	1	-17/+17

2013-05-12	Added Get-NtSystemInformation	Matt Graeber	3	-4/+3425
	Get-NtSystemInformation is a wrapper function for NtQuerySystemInformation. It is a swiss-army knife tool for obtaining internal OS information. It can currently be used to query the following: global flags, handles, objects, kernel pool allocations, and loaded kernel modules
2013-05-12	Removing Get-KernelModuleInfo	Matt Graeber	2	-321/+0
	Making way for Get-NtSystemInformation. Loaded kernel module information can be viewed with `Get-NtSystemInformation -ModuleInformation`
2013-05-10	Added ConvertTo-String	Matt Graeber	1	-0/+70
	ConvertTo-String converts the bytes of a file to a string that has a 1-to-1 mapping back to the file's original bytes. ConvertTo-String is useful for performing binary regular expressions.
2013-04-05	Fixed x86 bug in Get-MethodAddress	Matt Graeber	1	-110/+119
	Get-MethodAddress was not working correctly in 32-bit PowerShell because it was returning a [UInt64] value when it should have been a [UInt32]. This fix will detect if PowerShell is running as 32 or 64-bit and define its return type accordingly.
2013-02-17	Get-MethodAddress now returns an IntPtr.	bitform	1	-3/+1
	It previously returned a UInt64. Returning an IntPtr makes more sense.
2013-01-21	Consistency improvements in comment-based help	bitform	7	-7/+9

2013-01-20	Corrections made to usage documentation	bitform	1	-1/+1

2013-01-20	Updated module manifest file listing	bitform	1	-1/+1

2013-01-20	Renamed Usage.txt to Usage.md to apply markdown.	bitform	1	-0/+0

2013-01-20	Removed logic in scripts to load ps1xml files	bitform	4	-20/+13
	* Now that PETools and ReverseEngineering are both full-fledged modules with proper manifests, the manifests will take care of loading the appropriate ps1xml files. * Added Usage.txt to ReverseEngineering module.
2013-01-19	Renamed RE_Tools. Now ReverseEngineering module	bitform	11	-0/+3526
	* I renamed RE_Tools to ReverseEngineering and made it a module. * Slight consistency modifications were made to documentation. * This is one step in the process of modularizing all of PowerSploit.