Skip to content

Commit 3bd108a

Browse files
author
James Forshaw
committed
Updated version to 1.1.8.
1 parent 26876d6 commit 3bd108a

File tree

8 files changed

+101
-58
lines changed

8 files changed

+101
-58
lines changed

‎NtApiDotNet/NtApiDotNet.Core.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
<Authors>James Forshaw</Authors>
88
<Company>Google Inc.</Company>
99
<Product>NtApiDotNet</Product>
10-
<FileVersion>1.1.7.0</FileVersion>
11-
<Copyright>Copyright © Google Inc. 2016, 2017</Copyright>
10+
<FileVersion>1.1.8.0</FileVersion>
11+
<Copyright>Copyright © Google Inc. 2016, 2017, 2018</Copyright>
1212
<AssemblyVersion>1.0.0.0</AssemblyVersion>
1313
<PackageLicenseUrl>https://www.apache.org/licenses/LICENSE-2.0</PackageLicenseUrl>
1414
<RepositoryUrl>https://github.com/google/sandbox-attacksurface-analysis-tools</RepositoryUrl>

‎NtApiDotNet/NtApiDotNet.nuspec‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,17 @@
1111
<requireLicenseAcceptance>false</requireLicenseAcceptance>
1212
<description>A .NET class library to access native NT API system calls</description>
1313
<releaseNotes>
14+
1.1.8
15+
-----
16+
* Better support for relative paths in the cmdlets including supporting ones based on the current directory.
17+
* RenameEx and DispositionEx support from fllombard.
18+
* Added Key value deletion and fixes from rsiestrunck.
19+
* Fixed bug in NtOpenSession prototype.
20+
* Added support for adding additional groups to a token in Get-NtToken if user has SeTcbPrivilege.
21+
* Added Show-NtToken to display a token in the GUI, renamed old whois style token viewer to Show-NtTokenEffective.
22+
* Added PowerShell functions to get and create execution alias reparse points.
23+
* Added section viewer and editor with Show-NtSection function.
24+
1425
1.1.7
1526
-----
1627
* Added projects to build NtObjectManager for PowerShell Core 6.0

‎NtApiDotNet/Properties/AssemblyInfo.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,5 +33,5 @@
3333
// by using the '*' as shown below:
3434
// [assembly: AssemblyVersion("1.0.*")]
3535
[assembly: AssemblyVersion("1.0.0.0")]
36-
[assembly: AssemblyFileVersion("1.1.7.0")]
37-
[assembly: AssemblyInformationalVersion("1.1.7")]
36+
[assembly: AssemblyFileVersion("1.1.8.0")]
37+
[assembly: AssemblyInformationalVersion("1.1.8")]

‎NtObjectManager/NtObjectManager.Core.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
<Authors>James Forshaw</Authors>
88
<Company>Google Inc.</Company>
99
<Product>NtObjectManager</Product>
10-
<FileVersion>1.1.7.0</FileVersion>
11-
<Copyright>Copyright © Google Inc. 2016, 2017</Copyright>
10+
<FileVersion>1.1.8.0</FileVersion>
11+
<Copyright>Copyright © Google Inc. 2016, 2017, 2018</Copyright>
1212
<AssemblyVersion>1.0.0.0</AssemblyVersion>
1313
<PackageLicenseUrl>https://www.apache.org/licenses/LICENSE-2.0</PackageLicenseUrl>
1414
<RepositoryUrl>https://github.com/google/sandbox-attacksurface-analysis-tools</RepositoryUrl>

‎NtObjectManager/NtObjectManager.psd1‎

Lines changed: 20 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
RootModule = 'NtObjectManager.psm1'
1919

2020
# Version number of this module.
21-
ModuleVersion = '1.1.7'
21+
ModuleVersion = '1.1.8'
2222

2323
# Supported PSEditions
2424
# CompatiblePSEditions = @()
@@ -33,54 +33,30 @@ Author = 'James Forshaw'
3333
CompanyName = 'Google Inc.'
3434

3535
# Copyright statement for this module
36-
Copyright = '(c) 2016, 2017 Google Inc. All rights reserved.'
36+
Copyright = '(c) 2016, 2017, 2018 Google Inc. All rights reserved.'
3737

3838
# Description of the functionality provided by this module
3939
Description = 'This module adds a provider and cmdlets to access the NT object manager namespace.'
4040

4141
# Minimum version of the Windows PowerShell engine required by this module
4242
PowerShellVersion = '3.0'
4343

44-
# Name of the Windows PowerShell host required by this module
45-
# PowerShellHostName = ''
46-
47-
# Minimum version of the Windows PowerShell host required by this module
48-
# PowerShellHostVersion = ''
49-
5044
# Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only.
5145
DotNetFrameworkVersion = '4.5'
5246

5347
# Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only.
5448
CLRVersion = '4.0'
5549

56-
# Processor architecture (None, X86, Amd64) required by this module
57-
# ProcessorArchitecture = ''
58-
59-
# Modules that must be imported into the global environment prior to importing this module
60-
# RequiredModules = @()
61-
62-
# Assemblies that must be loaded prior to importing this module
63-
# RequiredAssemblies = @()
64-
65-
# Script files (.ps1) that are run in the caller's environment prior to importing this module.
66-
# ScriptsToProcess = @()
67-
68-
# Type files (.ps1xml) to be loaded when importing this module
69-
# TypesToProcess = @()
70-
7150
# Format files (.ps1xml) to be loaded when importing this module
7251
FormatsToProcess = 'Formatters.ps1xml'
7352

74-
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
75-
# NestedModules = @()
76-
7753
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
7854
FunctionsToExport = 'Get-NtTokenPrimary', 'Get-NtTokenThread', 'Get-NtTokenEffective', 'Get-AccessibleAlpcPort', 'Set-NtTokenPrivilege',
7955
'Set-NtTokenIntegrityLevel', 'Get-NtProcessMitigations', 'New-NtKernelCrashDump', 'New-NtObjectAttributes',
8056
'New-NtSecurityQualityOfService', 'Get-NtLicenseValue', 'Get-NtSystemEnvironmentValue', 'New-Win32Process',
8157
'New-NtEaBuffer', 'New-NtSectionImage', 'New-Win32ProcessConfig', 'Get-NtTokenFromProcess', 'Get-ExecutableManifest',
8258
'New-NtProcess', 'New-NtProcessConfig', 'Get-NtFilePath', 'Show-NtTokenEffective', 'Show-NtSecurityDescriptor', 'Get-NtIoControlCode',
83-
'Import-NtObject', 'Export-NtObject', 'Get-ExecutionAlias', 'New-ExecutionAlias', 'Show-NtToken'
59+
'Import-NtObject', 'Export-NtObject', 'Get-ExecutionAlias', 'New-ExecutionAlias', 'Show-NtToken', 'Show-NtSection'
8460

8561
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
8662
CmdletsToExport = 'Add-NtKey', 'Get-NtDirectory', 'Get-NtEvent', 'Get-NtFile',
@@ -92,28 +68,16 @@ CmdletsToExport = 'Add-NtKey', 'Get-NtDirectory', 'Get-NtEvent', 'Get-NtFile',
9268
'New-NtMailslotFile', 'New-NtMutant', 'New-NtNamedPipeFile',
9369
'New-NtSecurityDescriptor', 'New-NtSemaphore', 'New-NtSymbolicLink',
9470
'Remove-NtFileReparsePoint', 'Start-NtWait', 'Use-NtObject',
95-
'Get-NtFilteredToken', 'Get-NtLowBoxToken', 'Get-NtSid',
96-
'Get-NtSection', 'New-NtSection', 'Get-AccessibleAlpcPort',
97-
'Get-AccessibleKey', 'Get-AccessibleProcess', 'Get-AccessibleFile',
98-
'Get-AccessibleObject', 'Get-NtAccessMask', 'Get-AccessibleDevice',
99-
'Get-AccessibleNamedPipe', 'Get-NtGrantedAccess', 'Get-NtJob', 'New-NtJob',
100-
'Get-AccessibleService', 'Get-AccessibleHandle', 'Remove-NtKey'
101-
102-
# Variables to export from this module
103-
# VariablesToExport = @()
71+
'Get-NtFilteredToken', 'Get-NtLowBoxToken', 'Get-NtSid',
72+
'Get-NtSection', 'New-NtSection', 'Get-AccessibleAlpcPort',
73+
'Get-AccessibleKey', 'Get-AccessibleProcess', 'Get-AccessibleFile',
74+
'Get-AccessibleObject', 'Get-NtAccessMask', 'Get-AccessibleDevice',
75+
'Get-AccessibleNamedPipe', 'Get-NtGrantedAccess', 'Get-NtJob', 'New-NtJob',
76+
'Get-AccessibleService', 'Get-AccessibleHandle', 'Remove-NtKey'
10477

10578
# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
10679
AliasesToExport = @()
10780

108-
# DSC resources to export from this module
109-
# DscResourcesToExport = @()
110-
111-
# List of all modules packaged with this module
112-
# ModuleList = @()
113-
114-
# List of all files packaged with this module
115-
# FileList = @()
116-
11781
# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
11882
PrivateData = @{
11983

@@ -128,11 +92,18 @@ PrivateData = @{
12892
# A URL to the main website for this project.
12993
ProjectUri = 'https://github.com/google/sandbox-attacksurface-analysis-tools'
13094

131-
# A URL to an icon representing this module.
132-
# IconUri = ''
133-
13495
# ReleaseNotes of this module
135-
ReleaseNotes = '1.1.7
96+
ReleaseNotes = '1.1.8
97+
-----
98+
* Better support for relative paths in the cmdlets including supporting ones based on the current directory.
99+
* RenameEx and DispositionEx support from fllombard.
100+
* Added Key value deletion and fixes from rsiestrunck.
101+
* Fixed bug in NtOpenSession prototype.
102+
* Added support for adding additional groups to a token in Get-NtToken if user has SeTcbPrivilege.
103+
* Added Show-NtToken to display a token in the GUI, renamed old whois style token viewer to Show-NtTokenEffective.
104+
* Added PowerShell functions to get and create execution alias reparse points.
105+
* Added section viewer and editor with Show-NtSection function.
106+
1.1.7
136107
-----
137108
* Added projects to build NtObjectManager for PowerShell Core 6.0
138109
* Added additional techniques to open process tokens in access checking cmdlets.

‎NtObjectManager/NtObjectManager.psm1‎

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1292,7 +1292,57 @@ function Show-NtToken {
12921292
}
12931293
}
12941294
}
1295-
}
1295+
}
1296+
}
1297+
1298+
<#
1299+
.SYNOPSIS
1300+
Displays a mapped section in a UI.
1301+
.DESCRIPTION
1302+
This cmdlet displays a section object inside a UI from where the data can be inspected or edited.
1303+
.PARAMETER Section
1304+
Specify a section object.
1305+
.PARAMETER Wait
1306+
Optionally wait for the user to close the UI.
1307+
.PARAMETER ReadOnly
1308+
Optionally force the viewer to be read-only when passing a section with Map Write access.
1309+
.OUTPUTS
1310+
None
1311+
.EXAMPLE
1312+
Show-NtSection $section
1313+
Show the mapped section.
1314+
.EXAMPLE
1315+
Show-NtSection $section -ReadOnly
1316+
Show the mapped section as read only.
1317+
.EXAMPLE
1318+
Show-NtSection $section -Wait
1319+
Show the mapped section and wait for the viewer to exit.
1320+
#>
1321+
function Show-NtSection {
1322+
Param(
1323+
[Parameter(Position = 0, Mandatory = $true)]
1324+
[NtApiDotNet.NtSection]$Section,
1325+
[switch]$ReadOnly
1326+
)
1327+
1328+
if (!$Section.IsAccessGranted("MapRead")) {
1329+
Write-Error "Section doesn't have Map Read access."
1330+
return
1331+
}
1332+
Use-NtObject($obj = $Section.Duplicate()) {
1333+
$obj.Inherit = $true
1334+
$cmdline = [string]::Format("EditSection {0}", $obj.Handle.DangerousGetHandle())
1335+
if ($ReadOnly) {
1336+
$cmdline += " --readonly"
1337+
}
1338+
$config = New-Win32ProcessConfig $cmdline -ApplicationName "$PSScriptRoot\EditSection.exe" -InheritHandles
1339+
$config.InheritHandleList.Add($obj.Handle.DangerousGetHandle())
1340+
Use-NtObject($p = New-Win32Process -Config $config) {
1341+
if ($Wait) {
1342+
$p.Process.Wait() | Out-Null
1343+
}
1344+
}
1345+
}
12961346
}
12971347

12981348
<#

‎NtObjectManager/Properties/AssemblyInfo.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,5 +33,5 @@
3333
// by using the '*' as shown below:
3434
// [assembly: AssemblyVersion("1.0.*")]
3535
[assembly: AssemblyVersion("1.0.0.0")]
36-
[assembly: AssemblyFileVersion("1.1.7.0")]
37-
[assembly: AssemblyInformationalVersion("1.1.7")]
36+
[assembly: AssemblyFileVersion("1.1.8.0")]
37+
[assembly: AssemblyInformationalVersion("1.1.8")]

‎README.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,17 @@ with .NET Core 2.0 by building the specific project files.
2121

2222
Release Notes:
2323

24+
1.1.8
25+
-----
26+
* Better support for relative paths in the cmdlets including supporting ones based on the current directory.
27+
* RenameEx and DispositionEx support from fllombard.
28+
* Added Key value deletion and fixes from rsiestrunck.
29+
* Fixed bug in NtOpenSession prototype.
30+
* Added support for adding additional groups to a token in Get-NtToken if user has SeTcbPrivilege.
31+
* Added Show-NtToken to display a token in the GUI, renamed old whois style token viewer to Show-NtTokenEffective.
32+
* Added PowerShell functions to get and create execution alias reparse points.
33+
* Added section viewer and editor with Show-NtSection function.
34+
2435
1.1.7
2536
-----
2637
* Added projects to build NtObjectManager for PowerShell Core 6.0

0 commit comments

Comments
 (0)