PowerSploit - PowerSploit - A PowerShell Post-Exploitation Framework

Age	Commit message (Collapse)	Author	Files	Lines
2016-12-12	PowerUp update:	HarmJ0y	1	-69/+197
	-Standardized documentation, including adding output object types and required dependencies to all functions -Added Get-ProcessTokenPrivilege to enumerate the current (or remote) process token privileges, replacing Get-CurrentUserTokenGroupSid -Added Enable-Privilege to enable privileges using RtlAdjustPrivilege -Added @enigma0x3's Invoke-WScriptUACBypass function -Renamed Invoke-AllChecks to Invoke-PrivescAudit, added alias mapping -Added tests for Get-ProcessTokenPrivilege, Enable-Privilege, and Invoke-WScriptUACBypass -Renamed helper functions for consistency -Passes PSScriptAnalyzer!
2016-06-23	Fixed bug in Get-ModifiablePath that resulted in spaces being expanded to ↵	Harmj0y	1	-6/+47
	the current directory location Fixed other logic bugs in Get-ModifiablePath Fixed bug in Add-ServiceDacl when the [ServiceProcess.ServiceController] wasn't loaded yet by Get-Service Error handling for Get-CachedGPPPassword Changed some Write-Warnings to Write-Verbose Updated Privesc Pester tests for PowerUp
2016-06-06	Addded Get-CachedGPPPassword to PowerUp, based almost entirely on ↵	Harmj0y	1	-0/+26
	Get-GPPPassword. Added Pester tests for Get-CachedGPPPassword.
2016-06-04	Get-ModifiablePath now also checks parent folders of files for modification	Harmj0y	1	-79/+94
	Bug fixes Corrected PowerUp Pester tests Changed 'Path' field to 'ModifiablePath' in 'Get-ModifiablePath' Get-ServiceUnquoted now filters paths through Get-ModifiablePath
2016-06-04	Renamed Get-RegistryAutoRun to Get-ModifiableRegistryAutoRun	Harmj0y	1	-16/+16
	Renamed Find-PathHijack to Find-PathDLLHijack Fixed exposed functions in PowerSploit.psd1
2016-06-04	Overhauled and completed PowerUp/Privesc Pester tests	Harmj0y	1	-213/+622

2016-03-11	Added Get-System to Privesc/	Harmj0y	1	-0/+42
	Added Pester tests for Get-System
2016-02-12	Added Pester tests for Get-SiteListPassword	Harmj0y	1	-0/+88
	Encrypted password check for Get-SiteListPassword fields
2016-01-13	Add 'CanRestart' to output and Pester tests	sagishahar	1	-0/+131
	Pester tests to the function 'Test-ServiceDaclPermission' were added in order to increase confidence in its reliability. In general, my intention was to replace the current functionality of the service management functions such as Invoke-ServiceStart, to not use blindly 'sc.exe start' but rather consult with the DACL permissions and base the decision on that. Unforunately, further investigation lead me to the conclusion that retrieval of the service's DACL permissions requires that an additional DACL permission (RC) be set. This may lead to an edge case that could miss a potential privilege escalation condition and thereby the original idea was discarded. Nonetheless, 'Test-ServiceDaclPermission' can be used for less critical tasks. Therefore, a 'CanRestart' property was added to the output of the service enumeration functions such as 'Get-ServiceUnquoted' as I think that it will add value to redteamers/pentesters by helping them prioritise which service should be abused for escalation of privileges. Services that can be restarted by a low privileged user will probably be prioritised first. Additionally, manual checking whether the vulnerable service can be restarted would not be required in most cases.
2015-12-14	Added admin rights check for existing Privesc Pester tests	Harmj0y	1	-1/+45

2015-12-14	Modified Tests/Privesc.tests.ps1 to ensure file artifacts are not left on disk.	Harmj0y	1	-62/+103

2015-12-03	Privesc/PowerUp Pester tests	Harmj0y	1	-0/+485