Smallp0wnedShell发布——Small modification version of p0werShell
来源:互联网 发布:淘宝代运营提成几个点 编辑:程序博客网 时间:2024/05/02 02:04
Smallp0wnedShell发布——Small modification version of p0werShell
0x00 p0wnedShell
Author: Cn33liz and Skons
Source: https://github.com/Cn33liz/p0wnedShell
What is it:
p0wnedShell is an offensive PowerShell host application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET). It has a lot of offensive PowerShell modules and binaries included to make the process of Post Exploitation easier. What we tried was to build an “all in one” Post Exploitation tool which we could use to bypass all mitigations solutions (or at least some off), and that has all relevant tooling included. You can use it to perform modern attacks within Active Directory environments and create awareness within your Blue team so they can build the right defense strategies.
0x02 “重复造一个轮子”
p0wnedShell集成了如下功能:• PowerSploit Invoke-Shellcode
• PowerSploit Invoke-ReflectivePEInjection
• PowerSploit Invoke-Mimikatz
• PowerSploit Invoke-TokenManipulation
• PowerSploit PowerUp
• PowerSploit PowerView
• HarmJ0y's Invoke-Psexec
• Besimorhino's PowerCat
• Nishang Invoke-PsUACme
• Nishang Invoke-Encode
• Nishang Get-PassHashes
• Nishang Invoke-CredentialsPhish
• Nishang Port-Scan
• Nishang Copy-VSS
• Kevin Robertson Invoke-Inveigh
• Kevin Robertson Tater
虽然功能全面,但是有以下不足:
1.太大,足有8MB
2.只能在.net 4.0使用
0x03 Smallp0wnedShell
下载地址
p0wnedShell修改版本,如下特点:
1.去掉所有powershell模块
2.将.net 4.0改为2.0
3.体积从8MB缩小至32kb
用途:
用于直接执行powershell脚本,即使系统禁用powershell脚本,或是将powershell.exe加入进程黑名单限制执行
0x04 编译方法
原始代码从.net 4.0版本降到.net 2.0会出现如下错误:错误 1 命名空间“System”中不存在类型或命名空间名称“Linq”(是缺少程序集引用吗?)
解决方法:
需要引用一个LinqBridge.dll
(参考链接)
如果是中文版的 Visual Studio,需要作如下设置:
在控制面板找到:
工具-NuGet包管理器-程序包管理器控制台
输入Install-Package LinqBridge
即可安装LinqBridge
如图
0x05 注
默认win8不包含.net 2.0,只有.net 4.0
---
仅作测试,不许抄作业,后果自负
- Smallp0wnedShell发布——Small modification version of p0werShell
- Modification of Communications Resource Settings
- QuickFlow教程(8)—Step Modification in VS2008 and QF
- QuickFlow教程(9)—Step Modification in QF Designer
- Explanation of Small World Phenomenon
- the small size of t
- Let weblogic check the modification of jsp automatically
- LOSF(Lots of small files)存储问题
- Oil painting collection of small trick
- Restlet version 1.1 发布
- Python Tricks(二十二)—— small tricks
- 异常——(4)Cannot change version of project facet Dynamic Web Module to 3.0
- Worldwide Ubiquity of Adobe Flash Player by Version — December 20074
- version of os
- UUID of Xcode6 version
- Windows Azure Extra Small Instances Public Beta版本发布
- version 3.82 of make to version 3.81.
- cxf 发布webservice报 You have more than one version of 'org.apache.commons.logging.Log' visible
- Android学习之路
- 《疯狂的程序员》经典语录
- HTTP协议的C语言编程实现实例
- Hadoop完全分布式配置
- zookeeper命令行(zkCli.sh&zkServer.sh)使用及四字命令
- Smallp0wnedShell发布——Small modification version of p0werShell
- 栈的应用之算术表达式求值
- PMP 合同管理 PTA讲解
- LeetCode|Min Stack
- UDP包的大小与MTU
- js 冒泡排序与 数字组合 算法
- Java中权限修饰符
- TCP/IP的基本工作原理
- StringUtil方法全集