mattifestation

#Requires -Version 3
# -shr and [PSCustomObject] are only available in PSv3+

function ConvertFrom-IOControlCode {
<#
.SYNOPSIS

Converts an IO control code to its respective arguments.

Author: Matthew Graeber (@mattifestation)

mattifestation

# Yes I know I should do this with the CIM cmdlets too...
function Get-WmiNamespace {
<#
.SYNOPSIS

Returns a list of WMI namespaces present within the specified namespace.

.PARAMETER Namespace

Specifies the WMI repository namespace in which to list sub-namespaces. Get-WmiNamespace defaults to the ROOT namespace.

mattifestation

$EventFilterArgs = @{
    EventNamespace = 'root/cimv2'
    Name = 'PowerShellProcessStarted'
    Query = 'SELECT FileName, ProcessID FROM Win32_ModuleLoadTrace WHERE FileName LIKE "%System.Management.Automation%.dll"'
    QueryLanguage = 'WQL'
}

$Filter = New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $EventFilterArgs

$CommandLineConsumerArgs = @{

mattifestation

<#
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
#>

function Get-WmiNamespace {
    [OutputType([String])]
    Param (
        [String]
        [ValidateNotNullOrEmpty()]

mattifestation

function Invoke-UACBypass {
<#
.SYNOPSIS

Bypasses UAC on Windows 10 by abusing the SilentCleanup task to win a race condition, allowing for a DLL hijack without a privileged file copy.

Author: Matthew Graeber (@mattifestation), Matt Nelson (@enigma0x3)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None

mattifestation

#region Win10IoT Audit Code
$CimSession = New-CimSession -ComputerName Win10IoT -Credential Administrator -Authentication Negotiate
Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $CimSession
Get-CimInstance -ClassName Win32_Service -Filter 'Name = "InputService"' -CimSession $CimSession | Format-List *

# Run the service audit function in CimSweep
$ServicePermissions = Get-CSVulnerableServicePermission -CimSession $CimSession
$ServicePermissions | Where-Object { $_.GroupName -eq 'NT AUTHORITY\Authenticated Users' }

# The fact that Authenticated Users can change the service configuration means that

mattifestation

<?xml version="1.0" encoding="utf-8"?>
<xs:schema
    targetNamespace="urn:schemas-microsoft-com:sipolicy"
    elementFormDefault="qualified"
    xmlns="urn:schemas-microsoft-com:sipolicy"
    xmlns:ps="urn:schemas-microsoft-com:sipolicy"
    xmlns:xs="http://www.w3.org/2001/XMLSchema"
>
  <!-- A {00000000-0000-0000-0000-000000000000} GUID type -->
  <xs:simpleType name="GuidType">

mattifestation

# Ensure System.Security assembly is loaded.
Add-Type -AssemblyName System.Security

function ConvertTo-CIPolicy {
<#
.SYNOPSIS

Converts a binary file that contains a Code Integrity policy into XML format.

Author: Matthew Graeber (@mattifestation)

mattifestation

<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events">
 <instrumentation xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">
  <events>
   <provider name="Microsoft-Windows-CodeIntegrity" guid="{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}" resourceFileName="Microsoft-Windows-CodeIntegrity" messageFileName="Microsoft-Windows-CodeIntegrity" symbol="MicrosoftWindowsCodeIntegrity" source="Xml" >
    <keywords>
    </keywords>
    <tasks>
     <task name="CreateSection" message="$(string.task_CreateSection)" value="1">
>
      <opcodes>

mattifestation

function ConvertTo-Oid {
<#
.SYNOPSIS

Decodes a DER encoded ASN.1 object identifier (OID)

Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause

.DESCRIPTION