Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 59cd183

Browse files
clymb3rclymb3r
committed
Adding Invoke-Mimikatz and Invoke-Ninjacopy
1 parent b17272e commit 59cd183

File tree

318 files changed

+29481
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

318 files changed

+29481
-1
lines changed

‎Exfiltration/Exfiltration.psd1

+2-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@ ModuleList = @(@{ModuleName = 'Exfiltration'; ModuleVersion = '1.0.0.0'; GUID =
7474

7575
# List of all files packaged with this module
7676
FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', 'Out-Minidump.ps1',
77-
'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md'
77+
'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md', 'Invoke-Mimikatz.ps1',
78+
'Invoke-NinjaCopy.ps1'
7879

7980
# Private data to pass to the module specified in RootModule/ModuleToProcess
8081
# PrivateData = ''

‎Exfiltration/Invoke-Mimikatz.ps1

+2,713
Large diffs are not rendered by default.

‎Exfiltration/Invoke-NinjaCopy.ps1

+2,848
Large diffs are not rendered by default.

‎Exfiltration/NTFSParser/NTFSParser.sln

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 2012
4+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NTFSParserDLL", "NTFSParserDLL\NTFSParserDLL.vcxproj", "{5E42B778-F231-4797-B7FD-7D5BCA9738D0}"
5+
EndProject
6+
Global
7+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
8+
Debug|Win32 = Debug|Win32
9+
Debug|x64 = Debug|x64
10+
Release|Win32 = Release|Win32
11+
Release|x64 = Release|x64
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Debug|Win32.ActiveCfg = Debug|Win32
15+
{5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Debug|Win32.Build.0 = Debug|Win32
16+
{5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Debug|x64.ActiveCfg = Debug|x64
17+
{5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Debug|x64.Build.0 = Debug|x64
18+
{5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Release|Win32.ActiveCfg = Release|Win32
19+
{5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Release|Win32.Build.0 = Release|Win32
20+
{5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Release|x64.ActiveCfg = Release|x64
21+
{5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Release|x64.Build.0 = Release|x64
22+
EndGlobalSection
23+
GlobalSection(SolutionProperties) = preSolution
24+
HideSolutionNode = FALSE
25+
EndGlobalSection
26+
EndGlobal

‎Exfiltration/NTFSParser/NTFSParser/NTFS.h

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/*
2+
* NTFS include files
3+
*
4+
* Copyright(C) 2010 cyb70289 <[email protected]>
5+
*
6+
* This program/include file is free software; you can redistribute it and/or
7+
* modify it under the terms of the GNU General Public License as published
8+
* by the Free Software Foundation; either version 2 of the License, or
9+
* (at your option) any later version.
10+
*
11+
* This program/include file is distributed in the hope that it will be
12+
* useful, but WITHOUT ANY WARRANTY; without even the implied warranty
13+
* of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14+
* GNU General Public License for more details.
15+
*/
16+
17+
#ifndef __NTFS_H_CYB70289
18+
#define __NTFS_H_CYB70289
19+
20+
#pragma pack(8)
21+
22+
#include "NTFS_Common.h"
23+
#include "NTFS_FileRecord.h"
24+
#include "NTFS_Attribute.h"
25+
26+
#pragma pack()
27+
28+
#endif

‎Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
/*
2+
*
3+
* Copyright(C) 2013 Joe Bialek Twitter:@JosephBialek
4+
*
5+
* This program/include file is free software; you can redistribute it and/or
6+
* modify it under the terms of the GNU General Public License as published
7+
* by the Free Software Foundation; either version 2 of the License, or
8+
* (at your option) any later version.
9+
*
10+
* This program/include file is distributed in the hope that it will be
11+
* useful, but WITHOUT ANY WARRANTY; without even the implied warranty
12+
* of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU General Public License for more details.
14+
*/
15+
//
16+
// This code uses libraries released under GPLv2(or later) written by cyb70289 <[email protected]>
17+
18+
#include "stdafx.h"
19+
#include "NTFS.h"
20+
#include "NTFS_Attribute.h"
21+
#include "NTFS_Common.h"
22+
#include "NTFS_DataType.h"
23+
#include "NTFS_FileRecord.h"
24+
25+
using namespace std;
26+
27+
typedef DWORD (CDECL *StealthReadFile_Func)(string, BYTE*, DWORD, ULONGLONG, DWORD*, ULONGLONG*);
28+
29+
int _tmain(int argc, _TCHAR* argv[])
30+
{
31+
HMODULE parserDLLHandle = LoadLibraryA("NTFSParserDLL.dll");
32+
HANDLE procAddress = GetProcAddress(parserDLLHandle, "StealthReadFile");
33+
34+
StealthReadFile_Func StealthReadFile = (StealthReadFile_Func)procAddress;
35+
36+
DWORD buffSize = 1024*1024;
37+
BYTE* buffer = new BYTE[buffSize];
38+
DWORD bytesRead = 0;
39+
ULONGLONG bytesLeft = 0;
40+
DWORD ret = StealthReadFile("c:\\test\\test.txt", buffer, buffSize, 0, &bytesRead, &bytesLeft);
41+
42+
cout << "Return value: " << ret << endl;
43+
44+
ofstream myFile("c:\\test\\test2.txt", ios::out | ios::binary);
45+
myFile.write((char*)buffer, bytesRead);
46+
47+
return 0;
48+
}
49+

‎Exfiltration/NTFSParser/NTFSParser/NTFSParser.vcxproj

+165
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Debug|x64">
9+
<Configuration>Debug</Configuration>
10+
<Platform>x64</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Release|Win32">
13+
<Configuration>Release</Configuration>
14+
<Platform>Win32</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<ProjectGuid>{2F38A7A9-D810-451B-BB19-273770AF4D25}</ProjectGuid>
23+
<Keyword>Win32Proj</Keyword>
24+
<RootNamespace>NTFSParser</RootNamespace>
25+
</PropertyGroup>
26+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
27+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
28+
<ConfigurationType>Application</ConfigurationType>
29+
<UseDebugLibraries>true</UseDebugLibraries>
30+
<PlatformToolset>v110</PlatformToolset>
31+
<CharacterSet>NotSet</CharacterSet>
32+
</PropertyGroup>
33+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
34+
<ConfigurationType>Application</ConfigurationType>
35+
<UseDebugLibraries>true</UseDebugLibraries>
36+
<PlatformToolset>v110</PlatformToolset>
37+
<CharacterSet>NotSet</CharacterSet>
38+
</PropertyGroup>
39+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
40+
<ConfigurationType>Application</ConfigurationType>
41+
<UseDebugLibraries>false</UseDebugLibraries>
42+
<PlatformToolset>v110</PlatformToolset>
43+
<WholeProgramOptimization>true</WholeProgramOptimization>
44+
<CharacterSet>Unicode</CharacterSet>
45+
</PropertyGroup>
46+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
47+
<ConfigurationType>Application</ConfigurationType>
48+
<UseDebugLibraries>false</UseDebugLibraries>
49+
<PlatformToolset>v110</PlatformToolset>
50+
<WholeProgramOptimization>true</WholeProgramOptimization>
51+
<CharacterSet>Unicode</CharacterSet>
52+
</PropertyGroup>
53+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
54+
<ImportGroup Label="ExtensionSettings">
55+
</ImportGroup>
56+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
57+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
58+
</ImportGroup>
59+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
60+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
61+
</ImportGroup>
62+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
63+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
64+
</ImportGroup>
65+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
66+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
67+
</ImportGroup>
68+
<PropertyGroup Label="UserMacros" />
69+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
70+
<LinkIncremental>true</LinkIncremental>
71+
</PropertyGroup>
72+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
73+
<LinkIncremental>true</LinkIncremental>
74+
</PropertyGroup>
75+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
76+
<LinkIncremental>false</LinkIncremental>
77+
</PropertyGroup>
78+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
79+
<LinkIncremental>false</LinkIncremental>
80+
</PropertyGroup>
81+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
82+
<ClCompile>
83+
<PrecompiledHeader>Use</PrecompiledHeader>
84+
<WarningLevel>Level3</WarningLevel>
85+
<Optimization>Disabled</Optimization>
86+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
87+
<SDLCheck>false</SDLCheck>
88+
</ClCompile>
89+
<Link>
90+
<SubSystem>Console</SubSystem>
91+
<GenerateDebugInformation>true</GenerateDebugInformation>
92+
</Link>
93+
</ItemDefinitionGroup>
94+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
95+
<ClCompile>
96+
<PrecompiledHeader>Use</PrecompiledHeader>
97+
<WarningLevel>Level3</WarningLevel>
98+
<Optimization>Disabled</Optimization>
99+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
100+
<SDLCheck>false</SDLCheck>
101+
</ClCompile>
102+
<Link>
103+
<SubSystem>Console</SubSystem>
104+
<GenerateDebugInformation>true</GenerateDebugInformation>
105+
</Link>
106+
</ItemDefinitionGroup>
107+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
108+
<ClCompile>
109+
<WarningLevel>Level3</WarningLevel>
110+
<PrecompiledHeader>Use</PrecompiledHeader>
111+
<Optimization>MaxSpeed</Optimization>
112+
<FunctionLevelLinking>true</FunctionLevelLinking>
113+
<IntrinsicFunctions>true</IntrinsicFunctions>
114+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
115+
<SDLCheck>true</SDLCheck>
116+
</ClCompile>
117+
<Link>
118+
<SubSystem>Console</SubSystem>
119+
<GenerateDebugInformation>true</GenerateDebugInformation>
120+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
121+
<OptimizeReferences>true</OptimizeReferences>
122+
</Link>
123+
</ItemDefinitionGroup>
124+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
125+
<ClCompile>
126+
<WarningLevel>Level3</WarningLevel>
127+
<PrecompiledHeader>Use</PrecompiledHeader>
128+
<Optimization>MaxSpeed</Optimization>
129+
<FunctionLevelLinking>true</FunctionLevelLinking>
130+
<IntrinsicFunctions>true</IntrinsicFunctions>
131+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
132+
<SDLCheck>true</SDLCheck>
133+
</ClCompile>
134+
<Link>
135+
<SubSystem>Console</SubSystem>
136+
<GenerateDebugInformation>true</GenerateDebugInformation>
137+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
138+
<OptimizeReferences>true</OptimizeReferences>
139+
</Link>
140+
</ItemDefinitionGroup>
141+
<ItemGroup>
142+
<Text Include="ReadMe.txt" />
143+
</ItemGroup>
144+
<ItemGroup>
145+
<ClInclude Include="NTFS.h" />
146+
<ClInclude Include="NTFS_Attribute.h" />
147+
<ClInclude Include="NTFS_Common.h" />
148+
<ClInclude Include="NTFS_DataType.h" />
149+
<ClInclude Include="NTFS_FileRecord.h" />
150+
<ClInclude Include="stdafx.h" />
151+
<ClInclude Include="targetver.h" />
152+
</ItemGroup>
153+
<ItemGroup>
154+
<ClCompile Include="NTFSParser.cpp" />
155+
<ClCompile Include="stdafx.cpp">
156+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
157+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
158+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
159+
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
160+
</ClCompile>
161+
</ItemGroup>
162+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
163+
<ImportGroup Label="ExtensionTargets">
164+
</ImportGroup>
165+
</Project>

‎Exfiltration/NTFSParser/NTFSParser/NTFSParser.vcxproj.filters

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<Text Include="ReadMe.txt" />
19+
</ItemGroup>
20+
<ItemGroup>
21+
<ClInclude Include="stdafx.h">
22+
<Filter>Header Files</Filter>
23+
</ClInclude>
24+
<ClInclude Include="targetver.h">
25+
<Filter>Header Files</Filter>
26+
</ClInclude>
27+
<ClInclude Include="NTFS.h">
28+
<Filter>Header Files</Filter>
29+
</ClInclude>
30+
<ClInclude Include="NTFS_Attribute.h">
31+
<Filter>Header Files</Filter>
32+
</ClInclude>
33+
<ClInclude Include="NTFS_Common.h">
34+
<Filter>Header Files</Filter>
35+
</ClInclude>
36+
<ClInclude Include="NTFS_DataType.h">
37+
<Filter>Header Files</Filter>
38+
</ClInclude>
39+
<ClInclude Include="NTFS_FileRecord.h">
40+
<Filter>Header Files</Filter>
41+
</ClInclude>
42+
</ItemGroup>
43+
<ItemGroup>
44+
<ClCompile Include="stdafx.cpp">
45+
<Filter>Source Files</Filter>
46+
</ClCompile>
47+
<ClCompile Include="NTFSParser.cpp">
48+
<Filter>Source Files</Filter>
49+
</ClCompile>
50+
</ItemGroup>
51+
</Project>

0 commit comments

Comments
 (0)