Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit b450a70

Browse files
author
mattifestation
committed
Added Get-VolumeShadowCopy and Mount-VolumeShadowCopy
1 parent 1df8502 commit b450a70

File tree

3 files changed

+157
-1
lines changed

3 files changed

+157
-1
lines changed

‎Exfiltration/Exfiltration.psd1

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,8 @@ ModuleList = @(@{ModuleName = 'Exfiltration'; ModuleVersion = '1.0.0.0'; GUID =
7575
# List of all files packaged with this module
7676
FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', 'Out-Minidump.ps1',
7777
'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md', 'Invoke-Mimikatz.ps1',
78-
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Invoke-CredentialInjection.ps1'
78+
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Invoke-CredentialInjection.ps1',
79+
'VolumeShadowCopyTools.ps1'
7980

8081
# Private data to pass to the module specified in RootModule/ModuleToProcess
8182
# PrivateData = ''

‎Exfiltration/VolumeShadowCopyTools.ps1

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
function Get-VolumeShadowCopy
2+
{
3+
<#
4+
.SYNOPSIS
5+
6+
Lists the device paths of all local volume shadow copies.
7+
8+
PowerSploit Function: Get-VolumeShadowCopy
9+
Author: Matthew Graeber (@mattifestation)
10+
License: BSD 3-Clause
11+
Required Dependencies: None
12+
Optional Dependencies: None
13+
Version: 2.0.0
14+
#>
15+
16+
$UserIdentity = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent())
17+
18+
if (-not $UserIdentity.IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator'))
19+
{
20+
Throw 'You must run Get-VolumeShadowCopy from an elevated command prompt.'
21+
}
22+
23+
Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.DeviceObject }
24+
}
25+
26+
function Mount-VolumeShadowCopy
27+
{
28+
<#
29+
.SYNOPSIS
30+
31+
Mounts a volume shadow copy.
32+
33+
PowerSploit Function: Mount-VolumeShadowCopy
34+
Author: Matthew Graeber (@mattifestation)
35+
License: BSD 3-Clause
36+
Required Dependencies: None
37+
Optional Dependencies: None
38+
Version: 2.0.0
39+
40+
.DESCRIPTION
41+
42+
Mount-VolumeShadowCopy mounts a volume shadow copy volume by creating a symbolic link.
43+
44+
.PARAMETER Path
45+
46+
Specifies the path to which the symbolic link for the mounted volume shadow copy will be saved.
47+
48+
.PARAMETER DevicePath
49+
50+
Specifies the volume shadow copy 'DeviceObject' path. This path can be retrieved with the Get-VolumeShadowCopy PowerSploit function or with the Win32_ShadowCopy object.
51+
52+
.EXAMPLE
53+
54+
Get-VolumeShadowCopy | Mount-VolumeShadowCopy -Path C:\VSS
55+
56+
Description
57+
-----------
58+
Create a mount point in 'C:\VSS' for each volume shadow copy volume
59+
60+
.EXAMPLE
61+
62+
Mount-VolumeShadowCopy -Path C:\VSS -DevicePath '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4'
63+
64+
.EXAMPLE
65+
66+
Get-WmiObject Win32_ShadowCopy | % { $_.DeviceObject -Path C:\VSS -DevicePath $_ }
67+
#>
68+
69+
Param (
70+
[Parameter(Mandatory = $True)]
71+
[ValidateNotNullOrEmpty()]
72+
[String]
73+
$Path,
74+
75+
[Parameter(Mandatory = $True, ValueFromPipeline = $True)]
76+
[ValidatePattern('^\\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy[0-9]{1,3}$')]
77+
[String[]]
78+
$DevicePath
79+
)
80+
81+
BEGIN
82+
{
83+
$UserIdentity = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent())
84+
85+
if (-not $UserIdentity.IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator'))
86+
{
87+
Throw 'You must run Get-VolumeShadowCopy from an elevated command prompt.'
88+
}
89+
90+
# Validate that the path exists before proceeding
91+
Get-ChildItem $Path -ErrorAction Stop | Out-Null
92+
93+
$DynAssembly = New-Object System.Reflection.AssemblyName('VSSUtil')
94+
$AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
95+
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('VSSUtil', $False)
96+
97+
# Define [VSS.Kernel32]::CreateSymbolicLink method using reflection
98+
# (i.e. none of the forensic artifacts left with using Add-Type)
99+
$TypeBuilder = $ModuleBuilder.DefineType('VSS.Kernel32', 'Public, Class')
100+
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod('CreateSymbolicLink',
101+
'kernel32.dll',
102+
([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),
103+
[Reflection.CallingConventions]::Standard,
104+
[Bool],
105+
[Type[]]@([String], [String], [UInt32]),
106+
[Runtime.InteropServices.CallingConvention]::Winapi,
107+
[Runtime.InteropServices.CharSet]::Auto)
108+
$DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]))
109+
$SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField('SetLastError')
110+
$SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor,
111+
@('kernel32.dll'),
112+
[Reflection.FieldInfo[]]@($SetLastError),
113+
@($true))
114+
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
115+
116+
$Kernel32Type = $TypeBuilder.CreateType()
117+
}
118+
119+
PROCESS
120+
{
121+
foreach ($Volume in $DevicePath)
122+
{
123+
$Volume -match '^\\\\\?\\GLOBALROOT\\Device\\(?<LinkName>HarddiskVolumeShadowCopy[0-9]{1,3})$' | Out-Null
124+
125+
$LinkPath = Join-Path $Path $Matches.LinkName
126+
127+
if (Test-Path $LinkPath)
128+
{
129+
Write-Warning "'$LinkPath' already exists."
130+
continue
131+
}
132+
133+
if (-not $Kernel32Type::CreateSymbolicLink($LinkPath, "$($Volume)\", 1))
134+
{
135+
Write-Error "Symbolic link creation failed for '$Volume'."
136+
continue
137+
}
138+
139+
Get-Item $LinkPath
140+
}
141+
}
142+
143+
END
144+
{
145+
146+
}
147+
}

‎README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,14 @@ Retrieves the plaintext password and other information for accounts pushed throu
184184

185185
A function that takes screenshots at a regular interval and saves them to a folder.
186186

187+
#### `Get-VolumeShadowCopy`
188+
189+
Lists the device paths of all local volume shadow copies.
190+
191+
#### `Mount-VolumeShadowCopy`
192+
193+
Mounts a volume shadow copy.
194+
187195
#### `Out-Minidump`
188196

189197
Generates a full-memory minidump of a process.

0 commit comments

Comments
 (0)