Gh0st
/
PowerSploit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
543 Commits 2 Branches 2 Tags 16 MiB
Commit Graph

543 Commits

Author SHA1 Message Date
James McGinnigle f9b95c5cf2 Fix build for import and run of Invoke-PrivescAudit 2017-05-07 16:32:55 +01:00
HarmJ0y 095988269b Get-DomainGPO - fixed enumerations of 'enforced' GPOs, and 
bug fix for nested OUs with similar starting names.
 2017-04-28 00:56:52 -04:00
Will 27747f982c Merge pull request #233 from leechristensen/patch-5 
Generalized ACE creation and added LDAP logonhours conversion
 2017-04-27 21:39:49 -07:00
Lee Christensen fc04f97ecf Generalized ACE creation and added LDAP logonhours conversion 
Added ConvertFrom-LDAPLogonHours and New-ADObjectAccessControlEntry
 2017-04-27 00:30:27 -07:00
HarmJ0y 9f4e32e0f3 Renamed Get-DomainPolicy to Get-DomainPolicyData and generalized the 
function to accept any policy.
 2017-04-26 17:24:59 -04:00
Will 92e17e5331 Merge pull request #214 from mbrancato/dev 
Fix for impersonation in Get-NetLocalGroup*
 2017-04-26 14:10:47 -07:00
Will cfc0b647b1 Merge pull request #215 from api0cradle/master 
Invoke-CompareAttributesForClass.ps1
 2017-04-26 14:10:10 -07:00
Will 97382c215d Merge pull request #226 from joncave/dn_commas 
Support for DNs containing commas
 2017-04-26 14:08:32 -07:00
Will 0bbc9db5ab Merge pull request #227 from joncave/dfs_domain 
The DFS subfunctions only accept a single $Domain
 2017-04-26 14:08:01 -07:00
Will cb14cf11ab Merge pull request #231 from leechristensen/patch-4 
Set explicit LDAP SecurityMasks settings
 2017-04-26 14:06:25 -07:00
Lee Christensen 834a80fef3 Set explicit LDAP SecurityMask settings 
Changed the LDAP SecurityMasks settings so that you can change the Owner/DACL if you only have WriteOwner/WriteDacl permissions on the object (Default SecurityMasks is "Owner, Group, Dacl")
 2017-04-17 15:30:06 -07:00
Jon Cave 08b30627d9 Support for DNs containing commas 
If an object's distinguished name contains a comma then it ends up quoted:

    CN=Smith\, John,OU=Admins,DC=example,DC=com

This breaks a number of functions which attempt to identify DOMAIN\name
by matching on a \ anywhere in the specified identity before checking if
the identity was a DN (or SID or GUID).

For example, attempting to list members of "Domain Admins" using
Get-DomainGroupMember gives the following:

    VERBOSE: [Convert-ADName] Error initializing translation for 'CN=Smith\, John,OU=Admins,DC=example,DC=com' : Exception calling "InvokeMember" with "5" argument(s): "The specified domain either does not exist or could not be contacted. (Exception from HRESULT: 0x8007054B)"
    VERBOSE: [Convert-ADName] Error translating 'CN=Smith\, John,OU=Admins,DC=example,DC=com' : The specified domain either does not exist or could not be contacted. (Exception from HRESULT: 0x8007054B)
    VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (objectClass=*)

The fix implemented here is to perform more specific pattern matching
prior to falling back to looking for a \. The order is SID, DN, GUID,
qualified name (DOMAIN\name), and then plain name.
 2017-04-05 14:05:51 +01:00
Jon Cave f2a9cb2ecc The DFS subfunctions only accept a single $Domain 
Specifying the type as an array of strings results in an error when
passing on the parameter to Get-DomainSearcher:

    C:\> Get-DomainDFSShare -Domain test
    Get-DomainSearcher : Cannot process argument transformation on parameter 'Domain'. Cannot convert value to type System.String.
    At PowerView.ps1:10242 char:46
 2017-04-05 13:15:54 +01:00
b33f bd6fe64316 Cast DllCharacteristics to [Int] 
Fix for System.InvalidCastException:
https://github.com/PowerShellMafia/PowerSploit/issues/152
 2017-02-13 22:41:26 +00:00
Oddvar Moe c8cee6455a Added Invoke-CompareAttributesForClass.ps1 2017-01-23 07:12:23 +01:00
HarmJ0y 445f7b2510 Changed -KerberosPreauthNotRequired to -PreauthNotRequired 2017-01-16 23:52:19 -05:00
Mike Brancato 6927a26940 Fix for impersonation in Get-NetLocalGroup* 
Removed unnecessary warning about the 'WinNT' method
Fixed Get-NetLocalGroup* to use impersonation - netapi32 functions weren't working.
 2017-01-16 01:37:34 -05:00
Mike Brancato bda533d6d7 Merge pull request #1 from PowerShellMafia/dev 
update local fork
 2017-01-16 00:52:51 -05:00
HarmJ0y 454e04005d Standardized output from Find-InterestingDomainAcl 2017-01-11 20:39:57 -05:00
HarmJ0y ea60b0e0a4 Merge branch 'dev' of github.com:PowerShellMafia/PowerSploit into dev 2017-01-11 20:16:20 -05:00
HarmJ0y 510cba8bcd Added displayname to the default filter set for Get-DomainObject[ACL] 2017-01-11 20:16:01 -05:00
HarmJ0y 1dd560b371 Merge pull request #210 from leechristensen/patch-3 
Fixed KerberosPreauthNotRequired
 2017-01-11 16:16:25 -08:00
HarmJ0y 8a2e1daaa3 Parenthesis for additional LDAP functions 2017-01-11 19:04:56 -05:00
HarmJ0y fa1baa64a8 Parenthesis escaping for Get-DomainObject DN searches 2017-01-11 18:00:27 -05:00
HarmJ0y d4166f80d4 bug fix for Get-DomainObject/Get-DomainObjectACL 2017-01-11 15:55:35 -05:00
HarmJ0y 6c113b7956 Fixed bug in Convert-ADName that output an array including null values instead of a string 2017-01-11 14:03:46 -05:00
Lee Christensen e08432954e Fixed KerberosPreauthNotRequired 2017-01-11 08:09:49 -08:00
HarmJ0y ce19ebd9ed Merge branch 'dev' of github.com:PowerShellMafia/PowerSploit into dev 2017-01-10 18:32:07 -05:00
HarmJ0y 9ea5c5b7f5 Couple of fixes for Get-DomainSPNTicket 2017-01-10 18:31:30 -05:00
HarmJ0y e4b1930daa Merge pull request #207 from leechristensen/patch-3 
Words :P
 2017-01-09 22:34:41 -08:00
Lee Christensen aecb0b57a4 Words :P 2017-01-09 22:18:36 -08:00
HarmJ0y 215ec25da0 Bug fixes in Get-GPPPassword 2017-01-09 18:11:15 -05:00
HarmJ0y 3f7a32d623 Get-DomainSPNTicket/Invoke-Kerberoast now include 'real' user data in the hash output. 
Added a bit more error handling when requesting the SPN kerberos ticket.
 2017-01-08 22:28:51 -05:00
HarmJ0y 8552033242 Merge pull request #205 from mbrancato/dev 
Fix errors gathering the forest SID
 2017-01-07 18:20:56 -08:00
HarmJ0y 5500a7e131 Fix for issue #170 
Added -SearchForest to search all reachable domain trust \SYSVOL\'s
Each password is now output as a separate object.
 2017-01-07 20:32:14 -05:00
Mike Brancato d1060930c7 Fix errors gathering the forest SID 
Pull the SID directly from the 'krbtgt' user to avoid errors in ConvertTo-SID
 2017-01-04 23:23:25 -05:00
HarmJ0y 94438eda67 Replaced Invoke-WScriptUACBypass with @enigma0x3's Invoke-EventVwrBypass function 2016-12-21 00:41:51 -05:00
HarmJ0y 1118f53dc2 Added "-InformationClass Type" to Get-TokenInformation to enumerate token type and impersonation level 
Added Get-ProcessTokenType to enumerate type/impersonation level of a specified process
 2016-12-21 00:35:38 -05:00
HarmJ0y 96ae5e3f61 type correction 2016-12-20 23:13:46 -05:00
HarmJ0y 1916464092 bug fix in Get-TokenInformation 2016-12-20 23:13:16 -05:00
HarmJ0y 9853900578 Type fix. 
Added -TrustedToAuth to Get-DomainUser
 2016-12-15 19:04:53 -05:00
HarmJ0y 831dde1268 Bug fix for the Find-DomainUserLocation bug fix :) 2016-12-15 12:45:18 -05:00
HarmJ0y 601ad0cf3f Logic bug fix in Get-DomainFileServer 
-Domain bug fix in Find-DomainUserLocation stealth
 2016-12-15 12:32:17 -05:00
HarmJ0y ad32d6c75b For ./Recon/ : 
-(More) PSScriptAnalyzering
    -Tweaking of synopsis blocks in order to support platyPS
    -Code standardization
    -Generated docs
 2016-12-14 19:23:28 -05:00
HarmJ0y 59e6f94e76 For ./ScriptModification/ : 
-PSScriptAnalyzering
    -Tweaking of synopsis blocks in order to support platyPS
    -Code standardization
    -Generated docs
 2016-12-14 18:50:58 -05:00
HarmJ0y 9ed26d65a8 removed whitespace 2016-12-14 18:25:15 -05:00
HarmJ0y cf444398ca For ./Persistence/ : 
-PSScriptAnalyzering
    -Tweaking of synopsis blocks in order to support platyPS
    -Code standardization
    -Generated docs
 2016-12-14 18:24:33 -05:00
HarmJ0y a81faf36a4 For ./Mayhem/ : 
-PSScriptAnalyzering
    -Tweaking of synopsis blocks in order to support platyPS
    -Code standardization
    -Generated docs
 2016-12-14 18:05:22 -05:00
HarmJ0y 1980f403ee For ./CodeExecution/ : 
-PSScriptAnalyzering
    -Tweaking of synopsis blocks in order to support platyPS
    -Code standardization
    -Generated docs
 2016-12-14 17:50:37 -05:00
HarmJ0y 7cdaa3c2d6 For ./Antivirus/ : 
-PSScriptAnalyzering
    -Tweaking of synopsis blocks in order to support platyPS
    -Code standardization
    -Generated docs
 2016-12-14 16:17:00 -05:00