| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [Original HTTPS Page] |
Windows 10 breaks the current version of Invoke-TokenManipulation.ps1 because wininit is now a protected processes. Rather than hardcoding to a specific process to obtain a SYSTEM token, it's better to enumerate all processes running as SYSTEM and find one that works. I have updated the script to version 1.12 and added logic on lines 1689-1696 to make sure it can successfully grab a SYSTEM token necessary to function.
Removed 2 unnecessary lines.
This reverts commit 5a812ce.
This should have only ever been a shellcode runner. Those wishing to integrate this with Metasploit should generate a shellcode payload with msfvenom.
Those who wish to load this project into VS 2015 with Adam Driscoll's PowerShell VS extension may now do so.
This was only ever intended to be a PoC. I'll bring this back if requested but it exhibits duplicate functionality.
Removed the following extraneous parameters: -PEPath -PEUrl -ComputerName The functionality they provided can be easily replicated in code outside of Invoke-ReflectivePEInjection. i.e. it should be up to the user how they might want to download a PE before loading it. That should not be dictated by Invoke-ReflectivePEInjection.
This reverts commit 0eb520e.
Removed extraneous parameters Removed the following extraneous parameters: -PEPath -PEUrl The functionality they provided can be easily replicated in code outside of Invoke-ReflectivePEInjection. i.e. it should be up to the user how they might want to download a PE before loading it. That should not be dictated by Invoke-ReflectivePEInjection.
This reverts commit a0ab599.
Updated README.md's
Added ConvertFrom-UACValue to convert binary UAC values to human readable format. Corrected logic in Set-ADObject.
Incorporates idea from @obscuresec in issue #50.
Fixes issue #70
Updated embedded powerkatz.dll to the latest version of mimikatz - [Commit 1b13057](gentilkiwi/mimikatz@1b13057) This update addresses issue #94.
The test dll I now use is advpack.dll since that is present in all versions of windows.
Addresses issue #95.
This bug fix addresses issue #96. As much as a hate dropping files to disk, this was the easiest way to preserve objects in PSv2+. If someone want to implement the [de]serialization themselves and keep everything in memory, please submit a PR.
Update Invoke-TokenManipulation.ps1 to address Win 10 incompatibility
Easy fix to issue #97
Addresses issue #80. This was a tricky fix because the script should ideally handle Unicode and Ascii encoded scripts. I haven't tested scripts with international characters but I would imagine those script would get mangled since the decrypted output is ultimately normalized to ascii.
This fix addresses issue #99. While I'm not the biggest fan of performing tests based on environment variables, I felt that making additional Win32 API calls would have been overkill.
In some cases, the loaded module would show up as loaded after the check occurred.
Scripts in a module should not be individually versioned. Only the module should be versioned.
A module should maintain a version number not the individual scripts.
Affected test harness PEs were updated to work in XP. Addresses issue #100
This reverts commit 98ebc1b.
Also cleaned up some module manifest cruft.
Merge 3.0 release changes
| Back | FazBrowse Home | New Git URL |
No description provided.