Commit Graph

118 Commits (82fed97485dd4dd943288b1712142abed7d7041b)

Author SHA1 Message Date
HarmJ0y da439c441b Merge pull request #118 from jamcut/trusted-document-store
Add module to enumerate trusted documents and locations for MS Office.
2015-12-27 13:03:54 -08:00
Jeff McCutchan b7eb2852f3 Removed more commented lines 2015-12-27 00:08:27 -05:00
Jeff McCutchan a66d2e536e Implemented @Harmj0y changes 2015-12-27 00:04:38 -05:00
Jeff McCutchan ffa6ca6cd0 Added reference to original .ps1 file here too... 2015-12-24 08:40:12 -05:00
Jeff McCutchan 3c7c4278fa Change verbiage in module description 2015-12-23 14:00:06 -05:00
Jeff McCutchan c51b33b74c Add module to enumerate trusted documents and locations for MS Office. 2015-12-23 13:45:56 -05:00
HarmJ0y c6ff79d7b8 Merge pull request #117 from stufus/add_egress_busting
Add Egress Checking Traffic Generator Module
2015-12-22 11:40:32 -08:00
HarmJ0y ffe76b3828 Merge pull request #110 from Kevin-Robertson/master
Added Inveigh's HTTP NTLMv2 to SMB relay as an Empire module
2015-12-22 11:40:14 -08:00
Stuart Morgan c2d6172587 Fixed author array 2015-12-21 23:01:38 +00:00
Stuart Morgan 4c87700c6d Fix up verbosity 2015-12-21 22:47:54 +00:00
Stuart Morgan cea0826222 Rework this to remove the -verbosity parameter now that Ive realised that Write-Verbose exists....:) 2015-12-21 22:18:52 +00:00
Stuart Morgan dc9808b06b Merge branch 'master' of https://github.com/PowerShellEmpire/Empire into add_egress_busting 2015-12-21 20:50:11 +00:00
Harmj0y c95d8786aa hop.php redirector fix
removed requirement for credentials from lateral_movement/invoke_psremoting
2015-12-21 00:33:03 -05:00
Harmj0y c12eac3200 Added trollsploit/rick_ascii 2015-12-16 20:36:07 -05:00
Harmj0y bcb2f4677f Fix for issue #112 2015-12-16 17:42:51 -05:00
Stuart Morgan 8f88c5bdce This works! Amazingly....just needs tidying up and polishing (and sorting out the Write-Hosts) 2015-12-15 23:49:09 +00:00
Stuart Morgan 8ff5f7723a turns out that you need commas in the options dict....:) 2015-12-15 23:38:33 +00:00
Stuart Morgan b4ed0ceadb Added the options to the python side 2015-12-15 23:34:38 +00:00
Stuart Morgan d1572d325b Continuing work 2015-12-15 23:29:00 +00:00
Kevin Robertson 6186502749 Added Inveigh's HTTP NTLMv2 to SMB relay as an Empire module
This module is a direct copy/paste of the Invoke-InveighRelay function
from the standalone version of Inveigh. The module will relay incoming
HTTP NTLMv2 authentication requests to an SMB target. If authentication
is successful and the user is a local administrator on the target
system, the specified command should be executed on the target PSexec
style. This module can be used with or without collection/inveigh. If
collection/inveigh is used, ensure that HTTP is disabled in
collection/inveigh. If this module is used without collection/inveigh,
another method will need to be employed to trigger incoming HTTP
requests.

This module has been successfully tested with Empire's  launcher
one-liner to establish additional agents. In testing I observed a delay
(30 seconds or so) between the service creation message and Empire's
agent active message.

harmj0y: As I mentioned in the collection/inveigh pull request comments,
the length of the parameter names is throwing off Empire's options
command column display alignment. I'm not sure if there is an easy fix
for this. Also, I used the same code that you added to inveigh.py after
the pull request. With this code, I did not observe that the
SMBRelayCommand value needed to be wrapped in quotes.
2015-12-14 21:48:49 -05:00
Harmj0y c1043156e1 Module argument tweaks to collection/inveigh.py 2015-12-14 16:04:49 -05:00
Kevin Robertson e2209606aa Synced collection/inveigh with current standalone Inveigh code
Direct copy/paste of Invoke-Inveigh function from current standalone
version of Inveigh.  This version contains a number of
additions/changes/bug fixes. There are two primary additions that may be
useful to Empire users. The first is that 1122334455667788 is no longer
used as the default challenge over HTTP since it's now getting flagged
by SEP and maybe others. The default behavior is a random challenge for
each request. A specific challenge can also be specified through the
'challenge' parameter. The second is the ability to set a run time so
that collection/inveigh will auto-exit after a specified number of
minutes. On the python side, I have added the additional relevant
parameters and flipped the module to opsec safe since no files are
created on disk.
2015-12-13 19:31:52 -05:00
Harmj0y 93c1d46236 Updated powerview.ps1
Added situational_awareness/network/powerview/get_cached_rdpconnection
Added situational_awareness/network/powerview/set_ad_object
Added management/downgrade_account
2015-12-11 17:56:25 -05:00
Stuart Morgan 767d1f97a2 Merge branch 'master' of https://github.com/PowerShellEmpire/Empire into add_egress_busting 2015-12-11 10:04:53 +00:00
Stuart Morgan 21ae58cea0 Added template python script (on the python side) for the egresscheck ps1 2015-12-10 19:30:07 +00:00
Harmj0y 788747fa92 Added lsadump::cache and lsadump::sam Mimikatz modules. 2015-12-09 15:20:13 -05:00
HarmJ0y 9d9389d0a1 Merge pull request #104 from monoxgas/master
Added Hashdump using Invoke-DCSync
2015-12-01 10:28:45 -05:00
Nick Landers 7ab8cf4e94 I knew that... 2015-12-01 00:00:51 -07:00
Nick Landers e8337f47f4 Fixing small things 2015-11-30 22:19:24 -07:00
Harmj0y 1ba56acc13 Added persistence/userland/backdoor_lnk 2015-11-30 23:20:49 -05:00
Nick Landers d6443b9399 Update dcsync-hashdump.py 2015-11-30 18:27:19 -07:00
Monox Gas 5a85be3d37 Update Fixes 2015-11-30 18:21:22 -07:00
Nick Landers 63ea2f842c Create dcsync-hashdump.py 2015-11-30 17:39:30 -07:00
Harmj0y 6df2841ff7 Combined persistence/debugger/* into persistence/misc/debugger 2015-11-30 00:54:55 -05:00
Harmj0y 1d1fa61116 Added SysWow64 option to management/spawn to spawn a 32-bit powershell.exe 2015-11-29 15:20:16 -05:00
Harmj0y 41cc316406 Added MailRaider's disable_security.py module 2015-11-29 12:48:06 -05:00
Harmj0y 66b7aa17f1 Added several modules in management/mailraider/* to integrate @xorrior's MailRaider.ps1 2015-11-29 11:58:16 -05:00
xorrior 42c7eb901d Merge branch 'master' of https://github.com/xorrior/Empire 2015-11-28 16:34:19 -05:00
xorrior 104166f8e8 Added 64-bit version of Assembly in ChromeDump. Removed unnecessary functions in FoxDump 2015-11-28 16:34:13 -05:00
Harmj0y f853e6d750 Added option parsing and cred store support to lateral_movement/invoke_sshcommand 2015-11-28 16:00:16 -05:00
HarmJ0y ebc023d560 Merge pull request #101 from rvrsh3ll/master
Add Invoke-SSHCommand
2015-11-28 15:50:57 -05:00
rvrsh3ll 6c867048c4 Add Invoke-SSHCommand 2015-11-25 15:49:36 -05:00
xorrior c65498371f Merge branch 'master' of https://github.com/xorrior/Empire 2015-11-25 11:55:44 -05:00
xorrior acb9d1bb2f Added ChromeDump and FoxDump modules 2015-11-25 11:55:36 -05:00
HarmJ0y ddb47c3cdb Merge pull request #98 from PowerShellEmpire/script_autorun
Script autorun
2015-11-24 17:07:14 -05:00
Harmj0y 79400a329f Fixup for recon/http_login 2015-11-24 00:22:42 -05:00
HarmJ0y cf9f2f0cbf Merge pull request #96 from rvrsh3ll/master
Added HTTP-Login Recon Module
2015-11-23 23:16:14 -05:00
Harmj0y 6de27d4846 Corrected /dc flag in credentials/mimikatz/dcsync 2015-11-23 21:06:06 -05:00
rvrsh3ll b703e13614 Added HTTP-Login Recon Module 2015-11-23 08:50:58 -05:00
Harmj0y aa9c9e804e Added management/invoke_script 2015-11-22 17:36:57 -05:00