This repository was archived by the owner on Jan 21, 2021. It is now read-only.
Merge 3.0 release changes #102
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Windows 10 breaks the current version of Invoke-TokenManipulation.ps1 because wininit is now a protected processes. Rather than hardcoding to a specific process to obtain a SYSTEM token, it's better to enumerate all processes running as SYSTEM and find one that works. I have updated the script to version 1.12 and added logic on lines 1689-1696 to make sure it can successfully grab a SYSTEM token necessary to function.
Removed 2 unnecessary lines.
This reverts commit 5a812ce.
This should have only ever been a shellcode runner. Those wishing to integrate this with Metasploit should generate a shellcode payload with msfvenom.
Those who wish to load this project into VS 2015 with Adam Driscoll's PowerShell VS extension may now do so.
This was only ever intended to be a PoC. I'll bring this back if requested but it exhibits duplicate functionality.
Removed the following extraneous parameters: -PEPath -PEUrl -ComputerName The functionality they provided can be easily replicated in code outside of Invoke-ReflectivePEInjection. i.e. it should be up to the user how they might want to download a PE before loading it. That should not be dictated by Invoke-ReflectivePEInjection.
This reverts commit 0eb520e.
Removed extraneous parameters Removed the following extraneous parameters: -PEPath -PEUrl The functionality they provided can be easily replicated in code outside of Invoke-ReflectivePEInjection. i.e. it should be up to the user how they might want to download a PE before loading it. That should not be dictated by Invoke-ReflectivePEInjection.
This reverts commit a0ab599.
Updated README.md's
Added ConvertFrom-UACValue to convert binary UAC values to human readable format. Corrected logic in Set-ADObject.
Incorporates idea from @obscuresec in issue #50.
Fixes issue #70
Updated embedded powerkatz.dll to the latest version of mimikatz - [Commit 1b13057](gentilkiwi/mimikatz@1b13057) This update addresses issue #94.
The test dll I now use is advpack.dll since that is present in all versions of windows.
Addresses issue #95.
This bug fix addresses issue #96. As much as a hate dropping files to disk, this was the easiest way to preserve objects in PSv2+. If someone want to implement the [de]serialization themselves and keep everything in memory, please submit a PR.
Update Invoke-TokenManipulation.ps1 to address Win 10 incompatibility
Easy fix to issue #97
Addresses issue #80. This was a tricky fix because the script should ideally handle Unicode and Ascii encoded scripts. I haven't tested scripts with international characters but I would imagine those script would get mangled since the decrypted output is ultimately normalized to ascii.
This fix addresses issue #99. While I'm not the biggest fan of performing tests based on environment variables, I felt that making additional Win32 API calls would have been overkill.
In some cases, the loaded module would show up as loaded after the check occurred.
Scripts in a module should not be individually versioned. Only the module should be versioned.
A module should maintain a version number not the individual scripts.
Affected test harness PEs were updated to work in XP. Addresses issue #100
This reverts commit 98ebc1b.
Also cleaned up some module manifest cruft.
PowerShellMafia
pushed a commit
that referenced
this pull request
Dec 19, 2015
Merge 3.0 release changes
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.