PowerSploit - PowerSploit - A PowerShell Post-Exploitation Frame

项目说明

This project is no longer supported

PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following modules and scripts:

CodeExecution

Execute code on a target machine.

#### In

Injects a Dll into the process ID of your choosing.

#### Inon

Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.

#### In

Injects shellcode into the process ID of your choosing or within PowerShell locally.

#### In

Executes a PowerShell ScriptBlock on a target computer and returns its formatted output using WMI as a C2 channel.

ScriptModification

Modify and/or prepare scripts for execution on a compromised machine.

#### Out-EncodedCommand

Compresses, Base-64 encodes, and generates command-line output for a PowerShell payload script.

#### Out-CompressedDll

Compresses, Base-64 encodes, and outputs generated 代码 to load a managed dll in memory.

#### Out-EncryptedScript

Encrypts text files/scripts.

#### Remo

Strips comments and extra whitespace from a script.

Persistence

Add persistence capabilities to a PowerShell script

#### New-UserPersistenceOption

Configure user-le options for the Add-Persistence function.

#### New-Ele

Configure elevated persistence options for the Add-Persistence function.

#### Add-Persistence

Add persistence capabilities to a script.

#### Install-SSP

Installs a security support provider (SSP) dll.

#### Get-SecurityPackages

Enumerates all loaded security packages (SSPs).

Anti

A't stand a chance against PowerShell!

#### Find-A

Locates single Byte A utilizing the same method as DSplit from "class101".

Exfiltration

All your data belong to me!

#### In

Lists a logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread.

#### In

Create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon).

#### In

Copies a file from an NTFS partitioned by reading the raw and parsing the NTFS structures.

#### In

Reflectively loads Mimikatz 2.0 in memory using PowerShell. Can be used to dump credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz.

#### Get-Keystrokes

Logs keys pressed, time and the acti.

#### Get-GPPPassword

Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.

#### Get-GPPAutologon

Retrie username and password from registry.xml if pushed through Group Policy Preferences.

#### Get-TimedScreenshot

A function that takes screenshots at a regular interval and saves them to a folder.

#### New-

Creates a new shadow copy.

#### Get-

Lists the device paths of all local shadow copies.

#### Mount-

Mounts a shadow copy.

#### Remo

Deletes a shadow copy.

#### Get-

Displays Windows vault credential objects including cleartext web credentials.

#### Out-Minidump

Generates a full-memory minidump of a process.

#### Get-MicrophoneAudio

Records audio from system microphone and saves to disk

Mayhem

Cause general mayhem with PowerShell.

#### Set-MasterBootRecord

Proof of concept 代码 that o the master boot record with the
message of your choice.

#### Set-CriticalProcess

Causes your machine to blue screen upon exiting PowerShell.

Privesc

Tools to help with escalating pri on a target.

#### PowerUp

Clearing house of common pri escalation checks, along with some weaponization .

Recon

Tools to aid in the reconnaissance phase of a penetration test.

#### In

Does a simple port scan using regular sockets, based (pretty) loosely on nmap.

#### Get-HttpStatus

Returns the HTTP Status Codes and full URL for specified paths when provided with a dictionary file.

#### In

Scans an IP address range for DNS PTR records.

#### PowerView

PowerView is series of functions that performs 网络 and Windows domain enumeration and exploitation.

Recon\Dictionaries

A collection of dictionaries used to aid in the reconnaissance phase of a penetration test. Dictionaries were taken from the following sources.

* admin.txt - <
* generic.txt - <
* sharepoint.txt - <

License

The PowerSploit project and all indi scripts are under the BSD 3-Clause license unless explicitly noted otherwise.

Usage

Refer to the comment-based help in each indi script for detailed usage information.

To install this module, drop the entire PowerSploit folder into one of your module directories. The default PowerShell module paths are listed in the $En en .

The default per-user module path is: "$En$En\Documents\WindowsPowerShell\Modules"
The default computer-le path is: "$En\System32\WindowsPowerShell\v1.0\Modules"

To use the module, type Import-Module PowerSploit

To see the commands imported, type Get-Command -Module PowerSploit

If you're running PowerShell v3 and you want to remove the annoying 'Do you really want to run scripts downloaded from the Internet' warning, once you' PowerSploit into your module path, run the following one-liner:
$En.Split(';') |
% { if ( Test-Path (Join-Path $_ PowerSploit) )
{Get-ChildItem $_ -Recurse | Unblock-File} }

For help on each indi command, Get-Help is your friend.

Note: The tools contained within this module were all designed such that they can be run indi. Including them in a module simply lends itself to increased portability.

Contribution Rules

We need contributions! If you have a great idea for PowerSploit, we'd love to add it. New additions will require the following:

* The script must adhere to the style guide. Any exceptions to the guide line would need an explicit, valid reason.
* The module manifest needs to be updated to reflect the new function being added.
* A brief description of the function should be added to this README.md
* Pester tests must accompany all new functions. See the Tests folder for examples but we are looking for tests that at least cover the basics by testing for expected/unexpected input/output and that the function exhibits desired functionality. Make sure the function is passing all tests (preferably in mutiple OSes) prior to submitting a pull request. Thanks!

Script Style Guide

For all contributors and future contributors to PowerSploit, I ask that you follow this style guide when writing your scripts/modules.

* Avoid Write-Host at all costs. PowerShell functions/cmdlets are not command-line utilities! Pull requests containing 代码 that uses Write-Host will not be considered. You should output custom objects instead. For more information on creating custom objects, read these articles:
* <
* <

* If you want to display relevant debugging information to the screen, use Write-. The user can always just tack on '-'.

* Always provide descripti help for every script. Also, be sure to include your name and a BSD 3-Clause license (unless there are extenuating circumstances that prevent the application of the BSD license).

* Make sure all functions follow the proper PowerShell agreement. Use Get-Verb to list the default verbs used by PowerShell. Exceptions to supported verbs will be considered on a case-by-case basis.

* I prefer that names be capitalized and be as descriptive as possible.

* Provide logical spacing in between your 代码. Indent your 代码 to make it more readable.

* If you find yourself repeating 代码, write a function.

* Catch all anticipated errors and provide meaningful output. If you have an error that should stop execution of the script, use 'Throw'. If you have an error that doesn't need to stop execution, use Write-Error.

* If you are writing a script that interfaces with the Win32 API, try to avoid compiling C# inline with Add-Type. Try to use the PSReflect module, if possible.

* Do not use hardcoded paths. A script should be useable right out of the box. No one should have to modify the 代码 unless they want to.

* PowerShell v2 compatibility is highly desired.

* Use positional parameters and make parameters mandatory when it makes sense to do so. For example, I'm looking for something like the following:
* [Parameter(Position = 0, Mandatory = $True)]

* Don't use any aliases unless it makes sense for receiving pipeline input. They make 代码 more difficult to read for people who are unfamiliar with a particular alias.

* Try not to let commands run on for too long. For example, a pipeline is a natural place for a line break.

* Don't go o with inline comments. Only use them when certain aspects of the 代码 might be confusing to a reader.

* Rather than using Out-Null to suppress unwanted/irrelevant output, save the unwanted output to $null. Doing so provides a slight performance enhancement.

* Use default for your parameters when it makes sense. Ideally, you want a script that will work without requiring any parameters.

* If a script creates complex custom objects, include a ps1xml file that will properly format the object's output.

项目信息

开发语言：PowerShell

Star 数：13076

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PowerSploit - A PowerShell Post-Exploitation 框架展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。