Added Get-VolumeShadowCopy and Mount-VolumeShadowCopy
This commit is contained in:
mattifestation
parent
1df850208e
commit
b450a70dbf
|
|
@ -75,7 +75,8 @@ ModuleList = @(@{ModuleName = 'Exfiltration'; ModuleVersion = '1.0.0.0'; GUID =
|
|||
# List of all files packaged with this module
|
||||
FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', 'Out-Minidump.ps1',
|
||||
'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md', 'Invoke-Mimikatz.ps1',
|
||||
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Invoke-CredentialInjection.ps1'
|
||||
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Invoke-CredentialInjection.ps1',
|
||||
'VolumeShadowCopyTools.ps1'
|
||||
|
||||
# Private data to pass to the module specified in RootModule/ModuleToProcess
|
||||
# PrivateData = ''
|
||||
|
|
|
|||
|
|
@ -0,0 +1,147 @@
|
|||
function Get-VolumeShadowCopy
|
||||
{
|
||||
<#
|
||||
.SYNOPSIS
|
||||
|
||||
Lists the device paths of all local volume shadow copies.
|
||||
|
||||
PowerSploit Function: Get-VolumeShadowCopy
|
||||
Author: Matthew Graeber (@mattifestation)
|
||||
License: BSD 3-Clause
|
||||
Required Dependencies: None
|
||||
Optional Dependencies: None
|
||||
Version: 2.0.0
|
||||
#>
|
||||
|
||||
$UserIdentity = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent())
|
||||
|
||||
if (-not $UserIdentity.IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator'))
|
||||
{
|
||||
Throw 'You must run Get-VolumeShadowCopy from an elevated command prompt.'
|
||||
}
|
||||
|
||||
Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.DeviceObject }
|
||||
}
|
||||
|
||||
function Mount-VolumeShadowCopy
|
||||
{
|
||||
<#
|
||||
.SYNOPSIS
|
||||
|
||||
Mounts a volume shadow copy.
|
||||
|
||||
PowerSploit Function: Mount-VolumeShadowCopy
|
||||
Author: Matthew Graeber (@mattifestation)
|
||||
License: BSD 3-Clause
|
||||
Required Dependencies: None
|
||||
Optional Dependencies: None
|
||||
Version: 2.0.0
|
||||
|
||||
.DESCRIPTION
|
||||
|
||||
Mount-VolumeShadowCopy mounts a volume shadow copy volume by creating a symbolic link.
|
||||
|
||||
.PARAMETER Path
|
||||
|
||||
Specifies the path to which the symbolic link for the mounted volume shadow copy will be saved.
|
||||
|
||||
.PARAMETER DevicePath
|
||||
|
||||
Specifies the volume shadow copy 'DeviceObject' path. This path can be retrieved with the Get-VolumeShadowCopy PowerSploit function or with the Win32_ShadowCopy object.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
Get-VolumeShadowCopy | Mount-VolumeShadowCopy -Path C:\VSS
|
||||
|
||||
Description
|
||||
-----------
|
||||
Create a mount point in 'C:\VSS' for each volume shadow copy volume
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
Mount-VolumeShadowCopy -Path C:\VSS -DevicePath '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4'
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
Get-WmiObject Win32_ShadowCopy | % { $_.DeviceObject -Path C:\VSS -DevicePath $_ }
|
||||
#>
|
||||
|
||||
Param (
|
||||
[Parameter(Mandatory = $True)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[String]
|
||||
$Path,
|
||||
|
||||
[Parameter(Mandatory = $True, ValueFromPipeline = $True)]
|
||||
[ValidatePattern('^\\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy[0-9]{1,3}$')]
|
||||
[String[]]
|
||||
$DevicePath
|
||||
)
|
||||
|
||||
BEGIN
|
||||
{
|
||||
$UserIdentity = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent())
|
||||
|
||||
if (-not $UserIdentity.IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator'))
|
||||
{
|
||||
Throw 'You must run Get-VolumeShadowCopy from an elevated command prompt.'
|
||||
}
|
||||
|
||||
# Validate that the path exists before proceeding
|
||||
Get-ChildItem $Path -ErrorAction Stop | Out-Null
|
||||
|
||||
$DynAssembly = New-Object System.Reflection.AssemblyName('VSSUtil')
|
||||
$AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
|
||||
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('VSSUtil', $False)
|
||||
|
||||
# Define [VSS.Kernel32]::CreateSymbolicLink method using reflection
|
||||
# (i.e. none of the forensic artifacts left with using Add-Type)
|
||||
$TypeBuilder = $ModuleBuilder.DefineType('VSS.Kernel32', 'Public, Class')
|
||||
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod('CreateSymbolicLink',
|
||||
'kernel32.dll',
|
||||
([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),
|
||||
[Reflection.CallingConventions]::Standard,
|
||||
[Bool],
|
||||
[Type[]]@([String], [String], [UInt32]),
|
||||
[Runtime.InteropServices.CallingConvention]::Winapi,
|
||||
[Runtime.InteropServices.CharSet]::Auto)
|
||||
$DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]))
|
||||
$SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField('SetLastError')
|
||||
$SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor,
|
||||
@('kernel32.dll'),
|
||||
[Reflection.FieldInfo[]]@($SetLastError),
|
||||
@($true))
|
||||
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
||||
|
||||
$Kernel32Type = $TypeBuilder.CreateType()
|
||||
}
|
||||
|
||||
PROCESS
|
||||
{
|
||||
foreach ($Volume in $DevicePath)
|
||||
{
|
||||
$Volume -match '^\\\\\?\\GLOBALROOT\\Device\\(?<LinkName>HarddiskVolumeShadowCopy[0-9]{1,3})$' | Out-Null
|
||||
|
||||
$LinkPath = Join-Path $Path $Matches.LinkName
|
||||
|
||||
if (Test-Path $LinkPath)
|
||||
{
|
||||
Write-Warning "'$LinkPath' already exists."
|
||||
continue
|
||||
}
|
||||
|
||||
if (-not $Kernel32Type::CreateSymbolicLink($LinkPath, "$($Volume)\", 1))
|
||||
{
|
||||
Write-Error "Symbolic link creation failed for '$Volume'."
|
||||
continue
|
||||
}
|
||||
|
||||
Get-Item $LinkPath
|
||||
}
|
||||
}
|
||||
|
||||
END
|
||||
{
|
||||
|
||||
}
|
||||
}
|
||||
|
|
@ -184,6 +184,14 @@ Retrieves the plaintext password and other information for accounts pushed throu
|
|||
|
||||
A function that takes screenshots at a regular interval and saves them to a folder.
|
||||
|
||||
#### `Get-VolumeShadowCopy`
|
||||
|
||||
Lists the device paths of all local volume shadow copies.
|
||||
|
||||
#### `Mount-VolumeShadowCopy`
|
||||
|
||||
Mounts a volume shadow copy.
|
||||
|
||||
#### `Out-Minidump`
|
||||
|
||||
Generates a full-memory minidump of a process.
|
||||
|
|
|
|||
Loading…
Reference in New Issue