Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit b783b45

Browse files
clymb3rclymb3r
committed
Conflicts: Recon/Get-ComputerDetails.ps1 Recon/Recon.psd1
2 parents 47b9064 + 946328c commit b783b45

File tree

364 files changed

+1688
-17271
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

364 files changed

+1688
-17271
lines changed

‎.gitignore

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ local.properties
4545

4646
[Dd]ebug/
4747
[Rr]elease/
48-
x64/
4948
build/
5049
[Bb]in/
5150
[Oo]bj/

‎AntivirusBypass/AntivirusBypass.psd1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
@{
1+
@{
22

33
# Script module or binary module file associated with this manifest.
44
ModuleToProcess = 'AntivirusBypass.psm1'
@@ -84,4 +84,4 @@ FileList = 'AntivirusBypass.psm1', 'AntivirusBypass.psd1', 'Find-AVSignature.ps1
8484
# Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
8585
# DefaultCommandPrefix = ''
8686

87-
}
87+
}

‎AntivirusBypass/AntivirusBypass.psm1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}
1+
Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}

‎AntivirusBypass/Find-AVSignature.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,4 +183,4 @@ http://heapoverflow.com/f0rums/project.php?issueid=34&filter=changes&page=2
183183
#During testing using large binaries, memory usage was excessive so lets fix that
184184
[System.GC]::Collect()
185185
Write-Verbose "Completed!"
186-
}
186+
}

‎Capstone/Capstone.psd1

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
@{
2+
3+
# Script module or binary module file associated with this manifest.
4+
ModuleToProcess = 'Capstone.psm1'
5+
6+
# Version number of this module.
7+
ModuleVersion = '2.0.0.0'
8+
9+
# ID used to uniquely identify this module
10+
GUID = 'bc335667-02fd-46c4-a3d9-0a5113c9c03b'
11+
12+
# Author of this module
13+
Author = 'Matthew Graeber'
14+
15+
# Copyright statement for this module
16+
Copyright = 'see LICENSE.TXT'
17+
18+
# Description of the functionality provided by this module
19+
Description = 'Capstone Disassembly Framework Binding Module'
20+
21+
# Minimum version of the Windows PowerShell engine required by this module
22+
PowerShellVersion = '3.0'
23+
24+
# Minimum version of the common language runtime (CLR) required by this module
25+
CLRVersion = '4.0'
26+
27+
# Assemblies that must be loaded prior to importing this module
28+
RequiredAssemblies = 'lib/capstone.dll'
29+
30+
# Format files (.ps1xml) to be loaded when importing this module
31+
FormatsToProcess = 'Get-CSDisassembly.format.ps1xml'
32+
33+
# Functions to export from this module
34+
FunctionsToExport = '*'
35+
36+
# List of all modules packaged with this module.
37+
ModuleList = @(@{ModuleName = 'Capstone'; ModuleVersion = '1.0.0.0'; GUID = 'bc335667-02fd-46c4-a3d9-0a5113c9c03b'})
38+
39+
# List of all files packaged with this module
40+
FileList = 'Capstone.psm1',
41+
'Capstone.psd1',
42+
'Get-CSDisassembly.format.ps1xml',
43+
'LICENSE.TXT',
44+
'README',
45+
'lib/capstone.dll',
46+
'lib/x86/libcapstone.dll',
47+
'lib/x64/libcapstone.dll'
48+
}

‎Capstone/Capstone.psm1

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
#Requires -Modules Capstone
2+
3+
function Get-CSDisassembly
4+
{
5+
<#
6+
.SYNOPSIS
7+
8+
Disassembles a byte array using the Capstone Engine disassembly framework.
9+
10+
PowerSploit Function: Get-CSDisassembly
11+
Author: Matthew Graeber (@mattifestation)
12+
License: See LICENSE.TXT
13+
Required Dependencies: lib\capstone.dll, lib\[x86|x64]\libcapstone.dll
14+
Optional Dependencies: None
15+
16+
.DESCRIPTION
17+
18+
Get-CSDisassembly is compatible on 32 and 64-bit.
19+
20+
.PARAMETER Architecture
21+
22+
Specifies the architecture of the code to be disassembled.
23+
24+
.PARAMETER Mode
25+
26+
Specifies the mode in which to disassemble code. For example, to disassemble Amd64 code, architecture is set to 'X86' and Mode is set to 'MODE_64'.
27+
28+
.PARAMETER Code
29+
30+
A byte array consisting of the code to be disassembled.
31+
32+
.PARAMETER Offset
33+
34+
Specifies the starting address of the disassembly listing.
35+
36+
.PARAMETER Count
37+
38+
Specifies the maximum number of instructions to disassemble.
39+
40+
.PARAMETER Syntax
41+
42+
Specifies the syntax flavor to be used (INTEL vs. ATT).
43+
44+
.PARAMETER DetailOn
45+
46+
Specifies that detailed parsing should be performed - i.e. provide detailed information for each disassembled instruction.
47+
48+
.PARAMETER Verstion
49+
50+
Prints the running Capstone Framework version.
51+
52+
.EXAMPLE
53+
54+
$Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 )
55+
Get-CSDisassembly -Architecture X86 -Mode Mode16 -Code $Bytes -Offset 0x1000
56+
57+
$Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 )
58+
Get-CSDisassembly -Architecture X86 -Mode Mode32 -Code $Bytes
59+
60+
$Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 )
61+
Get-CSDisassembly -Architecture X86 -Mode Mode32 -Code $Bytes -Syntax ATT
62+
63+
$Bytes = [Byte[]] @( 0x55, 0x48, 0x8b, 0x05, 0xb8, 0x13, 0x00, 0x00 )
64+
Get-CSDisassembly -Architecture X86 -Mode Mode64 -Code $Bytes -DetailOn
65+
66+
$Bytes = [Byte[]] @( 0xED, 0xFF, 0xFF, 0xEB, 0x04, 0xe0, 0x2d, 0xe5, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x83, 0x22, 0xe5, 0xf1, 0x02, 0x03, 0x0e, 0x00, 0x00, 0xa0, 0xe3, 0x02, 0x30, 0xc1, 0xe7, 0x00, 0x00, 0x53, 0xe3 )
67+
Get-CSDisassembly -Architecture Arm -Mode Arm -Code $Bytes
68+
69+
$Bytes = [Byte[]] @( 0x4f, 0xf0, 0x00, 0x01, 0xbd, 0xe8, 0x00, 0x88, 0xd1, 0xe8, 0x00, 0xf0 )
70+
Get-CSDisassembly -Architecture Arm -Mode Thumb -Code $Bytes
71+
72+
$Bytes = [Byte[]] @( 0x10, 0xf1, 0x10, 0xe7, 0x11, 0xf2, 0x31, 0xe7, 0xdc, 0xa1, 0x2e, 0xf3, 0xe8, 0x4e, 0x62, 0xf3 )
73+
Get-CSDisassembly -Architecture Arm -Mode Arm -Code $Bytes
74+
75+
$Bytes = [Byte[]] @( 0x70, 0x47, 0xeb, 0x46, 0x83, 0xb0, 0xc9, 0x68 )
76+
Get-CSDisassembly -Architecture Arm -Mode Thumb -Code $Bytes -DetailOn
77+
78+
$Bytes = [Byte[]] @( 0x21, 0x7c, 0x02, 0x9b, 0x21, 0x7c, 0x00, 0x53, 0x00, 0x40, 0x21, 0x4b, 0xe1, 0x0b, 0x40, 0xb9 )
79+
Get-CSDisassembly -Architecture Arm64 -Mode Arm -Code $Bytes
80+
81+
$Bytes = [Byte[]] @( 0x0C, 0x10, 0x00, 0x97, 0x00, 0x00, 0x00, 0x00, 0x24, 0x02, 0x00, 0x0c, 0x8f, 0xa2, 0x00, 0x00, 0x34, 0x21, 0x34, 0x56 )
82+
Get-CSDisassembly -Architecture Mips -Mode 'Mode32, BigEndian' -Code $Bytes
83+
84+
$Bytes = [Byte[]] @( 0x56, 0x34, 0x21, 0x34, 0xc2, 0x17, 0x01, 0x00 )
85+
Get-CSDisassembly -Architecture Mips -Mode 'Mode64, LittleEndian' -Code $Bytes
86+
87+
$Bytes = [Byte[]] @( 0x80, 0x20, 0x00, 0x00, 0x80, 0x3f, 0x00, 0x00, 0x10, 0x43, 0x23, 0x0e, 0xd0, 0x44, 0x00, 0x80, 0x4c, 0x43, 0x22, 0x02, 0x2d, 0x03, 0x00, 0x80, 0x7c, 0x43, 0x20, 0x14, 0x7c, 0x43, 0x20, 0x93, 0x4f, 0x20, 0x00, 0x21, 0x4c, 0xc8, 0x00, 0x21 )
88+
Get-CSDisassembly -Architecture PPC -Mode BigEndian -Code $Bytes
89+
90+
.INPUTS
91+
92+
None
93+
94+
You cannot pipe objects to Get-CSDisassembly.
95+
96+
.OUTPUTS
97+
98+
Capstone.Instruction[]
99+
100+
Get-CSDisassembly returns an array of Instruction objects.
101+
#>
102+
103+
[OutputType([Capstone.Instruction])]
104+
[CmdletBinding(DefaultParameterSetName = 'Disassemble')]
105+
Param (
106+
[Parameter(Mandatory, ParameterSetName = 'Disassemble')]
107+
[Capstone.Architecture]
108+
$Architecture,
109+
110+
[Parameter(Mandatory, ParameterSetName = 'Disassemble')]
111+
[Capstone.Mode]
112+
$Mode,
113+
114+
[Parameter(Mandatory, ParameterSetName = 'Disassemble')]
115+
[ValidateNotNullOrEmpty()]
116+
[Byte[]]
117+
$Code,
118+
119+
[Parameter( ParameterSetName = 'Disassemble' )]
120+
[UInt64]
121+
$Offset = 0,
122+
123+
[Parameter( ParameterSetName = 'Disassemble' )]
124+
[UInt32]
125+
$Count = 0,
126+
127+
[Parameter( ParameterSetName = 'Disassemble' )]
128+
[ValidateSet('Intel', 'ATT')]
129+
[String]
130+
$Syntax,
131+
132+
[Parameter( ParameterSetName = 'Disassemble' )]
133+
[Switch]
134+
$DetailOn,
135+
136+
[Parameter( ParameterSetName = 'Version' )]
137+
[Switch]
138+
$Version
139+
)
140+
141+
if ($PsCmdlet.ParameterSetName -eq 'Version')
142+
{
143+
$Disassembly = New-Object Capstone.Capstone([Capstone.Architecture]::X86, [Capstone.Mode]::Mode16)
144+
$Disassembly.Version
145+
146+
return
147+
}
148+
149+
$Disassembly = New-Object Capstone.Capstone($Architecture, $Mode)
150+
151+
if ($Disassembly.Version -ne [Capstone.Capstone]::BindingVersion)
152+
{
153+
Write-Error "capstone.dll version ($([Capstone.Capstone]::BindingVersion.ToString())) should be the same as libcapstone.dll version. Otherwise, undefined behavior is likely."
154+
}
155+
156+
if ($Syntax)
157+
{
158+
switch ($Syntax)
159+
{
160+
'Intel' { $SyntaxMode = [Capstone.OptionValue]::SyntaxIntel }
161+
'ATT' { $SyntaxMode = [Capstone.OptionValue]::SyntaxATT }
162+
}
163+
164+
$Disassembly.SetSyntax($SyntaxMode)
165+
}
166+
167+
if ($DetailOn)
168+
{
169+
$Disassembly.SetDetail($True)
170+
}
171+
172+
$Disassembly.Disassemble($Code, $Offset, $Count)
173+
}

‎Capstone/Get-CSDisassembly.format.ps1xml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<Configuration>
3+
<ViewDefinitions>
4+
<View>
5+
<Name>InstructionView</Name>
6+
<ViewSelectedBy>
7+
<TypeName>Capstone.Instruction</TypeName>
8+
</ViewSelectedBy>
9+
<TableControl>
10+
<AutoSize/>
11+
<TableHeaders>
12+
<TableColumnHeader>
13+
<Label>Address</Label>
14+
</TableColumnHeader>
15+
<TableColumnHeader>
16+
<Label>Mnemonic</Label>
17+
</TableColumnHeader>
18+
<TableColumnHeader>
19+
<Label>Operands</Label>
20+
</TableColumnHeader>
21+
</TableHeaders>
22+
<TableRowEntries>
23+
<TableRowEntry>
24+
<TableColumnItems>
25+
<TableColumnItem>
26+
<PropertyName>Address</PropertyName>
27+
<FormatString>0x{0:X8}</FormatString>
28+
</TableColumnItem>
29+
<TableColumnItem>
30+
<PropertyName>Mnemonic</PropertyName>
31+
</TableColumnItem>
32+
<TableColumnItem>
33+
<PropertyName>Operands</PropertyName>
34+
</TableColumnItem>
35+
</TableColumnItems>
36+
</TableRowEntry>
37+
</TableRowEntries>
38+
</TableControl>
39+
</View>
40+
</ViewDefinitions>
41+
</Configuration>

‎Capstone/LICENSE.TXT

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
This is the software license for Capstone disassembly framework.
2+
Capstone has been designed & implemented by Nguyen Anh Quynh <[email protected]>
3+
See http://www.capstone-engine.org for further information.
4+
5+
Copyright (c) 2013, COSEINC.
6+
All rights reserved.
7+
8+
Redistribution and use in source and binary forms, with or without
9+
modification, are permitted provided that the following conditions are met:
10+
11+
* Redistributions of source code must retain the above copyright notice,
12+
this list of conditions and the following disclaimer.
13+
* Redistributions in binary form must reproduce the above copyright notice,
14+
this list of conditions and the following disclaimer in the documentation
15+
and/or other materials provided with the distribution.
16+
* Neither the name of the developer(s) nor the names of its
17+
contributors may be used to endorse or promote products derived from this
18+
software without specific prior written permission.
19+
20+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
21+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22+
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23+
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
24+
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25+
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26+
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27+
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28+
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29+
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30+
POSSIBILITY OF SUCH DAMAGE.

‎Capstone/README

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
This module has three dependencies:
2+
* lib\x86\libcapstone.dll (the 32-bit unmanaged Capstone library)
3+
* lib\x64\libcapstone.dll (the 64-bit unmanaged Capstone library)
4+
* lib\capstone.dll (the managed C# bindings to the Capstone Framework)
5+
6+
To install this module, drop the entire ScriptModification folder into one of your module directories. The default PowerShell module paths are listed in the $Env:PSModulePath environment variable.
7+
8+
The default per-user module path is: "$Env:HomeDrive$Env:HOMEPATH\Documents\WindowsPowerShell\Modules"
9+
The default computer-level module path is: "$Env:windir\System32\WindowsPowerShell\v1.0\Modules"
10+
11+
To use the module, type `Import-Module Capstone`
12+
13+
To see the commands imported, type `Get-Command -Module Capstone`
14+
15+
For help on each individual command, Get-Help is your friend.
16+
17+
Note: The tools contained within this module were all designed such that they can be run individually. Including them in a module simply lends itself to increased portability.

‎Capstone/lib/capstone.dll

89 KB
Binary file not shown.

0 commit comments

Comments
 (0)