DOCSEARCHbyAlgolia
Submit Docs

PowerSploit

repository·master·Indexed 11 days ago

https://github.com/powershellmafia/powersploit

A collection of Microsoft PowerShell modules for penetration testers to assist in reconnaissance, code execution, persistence, and privilege escalation. Includes specialized tools such as PowerUp for identifying Windows privilege escalation vectors and PowerView for gaining network situational awareness on Windows domains. Key modules include CodeExecution, ScriptModification, Persistence, AntivirusBypass, Exfiltration, Mayhem, Privesc, and Recon.

Tokens
95K
Snippets
328
Records
439
Agent score
92%

What's inside PowerSploit

  1. Overview of PowerSploit modules

    master

    PowerSploit is a collection of Microsoft PowerShell modules designed for penetration testers. It is organized into several functional modules:

    • CodeExecution: Execute code on target machines (e.g., Invoke-DllInjection, Invoke-ReflectivePEInjection, Invoke-Shellcode, Invoke-WmiCommand).
    • ScriptModification: Prepare or modify scripts (e.g., Out-EncodedCommand, Out-CompressedDll, Out-EncryptedScript, Remove-Comment).
    • Persistence: Add persistence capabilities (e.g., Add-Persistence, Install-SSP, New-UserPersistenceOption, New-ElevatedPersistenceOption).
    • AntivirusBypass: Locate AV signatures (e.g., Find-AVSignature).
    • Exfiltration: Data theft and credential manipulation (e.g., Invoke-Mimikatz, Invoke-NinjaCopy, Invoke-TokenManipulation, Get-GPPPassword, Get-Keystrokes, Get-TimedScreenshot, New-VolumeShadowCopy).
    • Mayhem: Destructive actions (e.g., Set-MasterBootRecord, Set-CriticalProcess).
    • Privesc: Privilege escalation (e.g., PowerUp).
    • Recon: Network and domain enumeration (e.g., Invoke-Portscan, PowerView, Get-HttpStatus, Invoke-ReverseDnsLookup).
    • Recon\Dictionaries: A collection of wordlists for reconnaissance.

  2. Overview of the NTFSParser console application

    master

    NTFSParser is a C++ console application designed to parse NTFS file systems. The project is structured as a Visual C++ project and consists of the following core components:

    • NTFSParser.cpp: The main application source file containing the primary logic.
    • StdAfx.h / StdAfx.cpp: Precompiled header (PCH) files used to accelerate the build process.
    • NTFSParser.vcxproj: The main Visual C++ project file defining platforms, configurations, and project features.

    Developers looking to customize the tool should look for TODO: comments within the source code to identify areas intended for extension or modification.

  3. Overview of PowerView

    master

    PowerView is a tool within the Recon module designed for gaining network situational awareness on Windows domains. It provides pure-PowerShell replacements for various net * commands by utilizing PowerShell AD hooks and Win32 API functions.

    Key Capabilities:

    • Domain Enumeration: Replaces standard Windows commands for domain functionality.
    • Meta-functions: Includes custom user-hunting functions to identify where specific users are logged in or where the current user has local administrator access.
    • Domain Trust Abuse: Functions for enumerating and abusing domain trusts.
    • Pipeline Support: Most "meta" functions accept an array of hosts from the pipeline.

    Usage Tips:

    • Use -Verbose to see progress status when enumerating multiple machines.
    • Use -Verbose or -Debug for detailed output of underlying functionality.

  5. Overview of the logon DLL project

    master

    The logon project is a C++ Dynamic Link Library (DLL) project generated via the Visual Studio Application Wizard. It is designed to serve as a template for creating a logon DLL. The project includes the main source file logon.cpp and standard Visual C++ project files (.vcxproj, .vcxproj.filters) and precompiled header files (StdAfx.h, StdAfx.cpp).

    Note: By default, this DLL does not export any symbols. This means building it will not produce a .lib file. If you intend to use this DLL as a dependency for another project, you must either:

    1. Add code to export symbols from the DLL.
    2. Set the Ignore Input Library property to Yes in the Linker folder of the project's Property Pages dialog box.

  6. Overview of PowerView for Network Situational Awareness

    master

    PowerView is a PowerShell tool designed to gain network situational awareness within Windows domains. It provides pure-PowerShell replacements for various Windows net * commands by utilizing PowerShell AD hooks and underlying Win32 API functions.

    Key capabilities include:

    • Enumerating Active Directory objects (users, groups, computers, OUs, etc.).
    • Identifying where specific users are logged into the network.
    • Checking which domain machines the current user has local administrator access on.
    • Enumerating and analyzing domain trusts.
    • Performing Kerberoasting attacks.

    Usage Tips:

    • For functions that enumerate multiple machines, use the -Verbose flag to see progress status.
    • Most 'meta' functions accept an array of hosts from the pipeline.
    • Use -Verbose or -Debug flags for detailed output of underlying functionality.

  7. Use Invoke-Portscan for port scanning

    master

    The Invoke-Portscan function performs a simple port scan using regular sockets, loosely based on nmap. It can scan specific hosts, CIDR ranges, or hosts provided via a file or pipeline. You can target specific ports, use a predefined list of top ports, or perform a ping-only scan to discover active hosts.

    Invoke-Portscan -Hosts "webstersprodigy.net,google.com,microsoft.com" -TopPorts 50

  8. Project Overview for NTFSParserDLL

    master

    NTFSParserDLL is a C++ Dynamic Link Library (DLL) project designed to parse NTFS file systems. The project is structured as a standard Visual C++ project generated via AppWizard.

    Key Components:

    • NTFSParserDLL.cpp: The primary source file containing the DLL implementation.
    • NTFSParserDLL.vcxproj: The main Visual C++ project file defining platforms, configurations, and features.
    • NTFSParserDLL.vcxproj.filters: IDE filter configuration for grouping files (e.g., Source Files, Header Files).
    • StdAfx.h / StdAfx.cpp: Precompiled header (PCH) files used to optimize build times.

  9. Use Get-DomainTrust to enumerate domain trusts

    master

    The Get-DomainTrust function is used to identify trust relationships within an Active Directory environment. It supports three distinct execution modes (parameter sets) depending on the desired method of communication with the domain controller:

    1. NET (Default): Uses standard .NET methods. This is the simplest way to run the command without additional configuration.
    2. API: Uses specific API calls. Requires the -API switch and can target a specific -Server.
    3. LDAP: Uses direct LDAP queries. This provides the most granular control, allowing for custom filters, search bases, and specific property retrieval.

    Outputs are returned as objects of type PowerView.DomainTrust.NET, PowerView.DomainTrust.LDAP, or PowerView.DomainTrust.API depending on the mode used.

    # NET (Default)
Get-DomainTrust [[-Domain] <String>] [-FindOne]

# API
Get-DomainTrust [[-Domain] <String>] [-API] [-Server <String>] [-FindOne]

# LDAP
Get-DomainTrust [[-Domain] <String>] [-LDAP] [-LDAPFilter <String>] [-Properties <String[]>] [-SearchBase <String>] [-Server <String>] [-SearchScope <String>] [-ResultPageSize <Int32>] [-ServerTimeLimit <Int32>] [-Tombstone] [-FindOne] [-Credential <PSCredential>]

  10. Understand the DemoDLL_RemoteProcess project structure

    master

    The DemoDLL_RemoteProcess project is a Visual C++ DLL project used as a resource for Invoke-ReflectivePEInjection. It consists of the following key files:

    • DemoDLL_RemoteProcess.cpp: The main DLL source file containing the logic.
    • DemoDLL_RemoteProcess.vcxproj: The main VC++ project file defining platforms, configurations, and features.
    • DemoDLL_RemoteProcess.vcxproj.filters: IDE filter associations for grouping files (e.g., .cpp files under "Source Files").
    • StdAfx.h / StdAfx.cpp: Precompiled header (PCH) files used to speed up build times.

  11. Search for domain processes with Find-DomainProcess

    master

    The Find-DomainProcess function searches for processes across computers in a domain using WMI. It can identify processes based on specific user identities, group memberships, or process names.

    How it works:

    1. It enumerates machines in the domain (or a specified domain) using Get-DomainComputer.
    2. It identifies target users (defaulting to 'Domain Admins') using Get-DomainGroupMember.
    3. It queries each machine via WMI using Get-WMIProcess to find processes matching the specified -ProcessName or running under the target user contexts.

    Required Dependencies:

    • Get-DomainComputer
    • Get-DomainUser
    • Get-DomainGroupMember
    • Get-WMIProcess
    • New-ThreadedFunction
    Find-DomainProcess

  12. Get-DomainComputer Output Formats

    master

    The Get-DomainComputer command returns data in one of two formats depending on the flags used:

    1. PowerView.Computer (Default): A custom PSObject with translated and human-readable computer property fields.
    2. PowerView.Computer.Raw: If the -Raw switch is used, the command returns the raw DirectoryServices.SearchResult object directly from the LDAP query.