debe4a565e
Added Get-MicrophoneAudio.ps1 and associated Pester tests
2016-05-12 10:58:27 -04:00
9f183e3651
Set all module versions to 3.0
...
Also cleaned up some module manifest cruft.
2015-12-18 16:28:03 -08:00
8c2411ccf3
Get-VaultCredential now takes the singular form.
2014-06-30 15:20:48 -04:00
890247deec
Issue #43 - Adding Get-VaultCredentials
...
Displays Windows vault credential objects including cleartext web
credentials.
2014-05-30 21:22:31 -04:00
b450a70dbf
Added Get-VolumeShadowCopy and Mount-VolumeShadowCopy
2014-03-01 18:26:31 -05:00
331d54eeaf
Merge pull request #28 from clymb3r/master
...
Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.
2014-02-12 19:40:32 -05:00
b684da050a
Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.
...
Added a check to ensure the script isn't being run from Session0 with
the "NewWinLogon" flag. This flag does not work in Session0 because
winlogon.exe tries to load stuff from user32.dll which requires a
desktop is present. This is not possible in Session0 because there is no
desktop/GUI, so it causes winlogon to load and then immediately close
with error code c0000142 indicating a DLL failed to initialize. There is
no way to fix this that I know of, if you need to run the script from
Session0 use the "ExistingWinLogon" flag.
2014-02-12 13:52:41 -08:00
7de1dd6df7
Merge pull request #21 from clymb3r/master
...
Adding Inject-LogonCredentials
2013-11-18 03:26:55 -08:00
1503375bfb
Adding Inject-LogonCredentials
2013-11-17 21:13:15 -08:00
237d362acf
Normalized all scripts to ASCII encoding
2013-11-13 21:01:02 -05:00
7a6e8a0f20
Adding Invoke-TokenManipulation
2013-11-03 22:54:36 -08:00
59cd183607
Adding Invoke-Mimikatz and Invoke-Ninjacopy
2013-10-01 09:47:05 -07:00
371c65c9a7
Updated Get-GPPPassword
2013-07-03 05:46:44 -04:00
717950d00c
Added Get-Keystrokes
...
Get-Keystrokes is a PowerShell keylogger
2013-06-30 11:15:02 -04:00
af04f7e528
Added Out-Minidump
...
Out-Minidump writes a process dump file with all process memory to disk.
This is similar to running procdump.exe with the '-ma' switch.
2013-05-15 20:54:16 -04:00
b3bbe03e93
Added 'Exfiltration' Module
2013-01-20 21:32:41 -05:00
sixdub
Matt Graeber
clymb3r
bitform