Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Added [string] to fix $matches #220

Open
okazymyrov wants to merge 3 commits into
base: dev
Choose a base branch
from
Open

Added [string] to fix $matches #220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4930313
Added [string] to fix
invalid-email-address Feb 14, 2017
5c465a5
Fixed DllCharacteristicsType to int conversio on Windows Windows 10.0…
invalid-email-address Feb 14, 2017
7885f28
Deleted an extra Write-Verbose
okazymyrov Feb 14, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Exfiltration/Get-TimedScreenshot.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ https://github.com/mattifestation/PowerSploit/blob/master/Exfiltration/Get-Timed

$VideoController = Get-WmiObject -Query 'SELECT VideoModeDescription FROM Win32_VideoController'

if ($VideoController.VideoModeDescription -and $VideoController.VideoModeDescription -match '(?<ScreenWidth>^\d+) x (?<ScreenHeight>\d+) x .*$') {
if ($VideoController.VideoModeDescription -and [String] $VideoController.VideoModeDescription -match '(?<ScreenWidth>^\d+) x (?<ScreenHeight>\d+) x .*$') {
$Width = [Int] $Matches['ScreenWidth']
$Height = [Int] $Matches['ScreenHeight']
} else {
Expand Down
5 changes: 2 additions & 3 deletions Exfiltration/Invoke-CredentialInjection.ps1
100644 → 100755
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2416,13 +2416,12 @@ function Invoke-CredentialInjection
$PEInfo = Get-PEBasicInfo -PEBytes $PEBytes -Win32Types $Win32Types
$OriginalImageBase = $PEInfo.OriginalImageBase
$NXCompatible = $true
if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT)
if (([int]$PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT)
{
Write-Warning "PE is not compatible with DEP, might cause issues" -WarningAction Continue
$NXCompatible = $false
}


#Verify that the PE and the current process are the same bits (32bit or 64bit)
$Process64Bit = $true
if ($RemoteLoading -eq $true)
Expand Down Expand Up @@ -2474,7 +2473,7 @@ function Invoke-CredentialInjection
Write-Verbose "Allocating memory for the PE and write its headers to memory"

[IntPtr]$LoadAddr = [IntPtr]::Zero
if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE)
if (([int]$PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE)
{
Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again" -WarningAction Continue
[IntPtr]$LoadAddr = $OriginalImageBase
Expand Down