jborean93

#Requires -Module PSDetour

[CmdletBinding()]
param (
    [Parameter(Mandatory)]
    [string]
    $LogPath
)

$LogPath = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($LogPath)

jborean93

# Copyright: (c) 2022, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

<# Example Code to Run on the Server
$pipeServer = [System.IO.Pipes.NamedPipeServerStream]::new("jordan-test", [System.IO.Pipes.PipeDirection]::InOut)
$pipeServer.WaitForConnection()
try {
    $tokenStat = Get-NamedPipeClientStatistics -Pipe $pipeServer
    $appKey = Get-SMBApplicationKey -LogonId $tokenStat.AuthenticationId
    [System.Convert]::ToBase64String($appKey.Applicationkey)

jborean93

# Copyright: (c) 2022, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Get-LogonSessionData {
    <#
    .SYNOPSIS
    Get LSA logon session data.

    .DESCRIPTION
    Get the logon session information for all or a specific logon session or specific process logon sessions.

jborean93

# Copyright: (c) 2022, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Get-WTSSessionInfo {
    <#
    .SYNOPSIS
    Enumerates sessions on a Windows host.

    .DESCRIPTION
    Enumerates all the sessions available on a Windows host through the WTSEnumerateSessionsExW API.

jborean93

# Copyright: (c) 2022, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Trace-TlsHandshake {
    <#
    .SYNOPSIS
    TLS Handshake Diagnostics.

    .DESCRIPTION
    Performs a TLS handshake and returns diagnostic information about that

jborean93

[Flags()] enum CertCheckMode {
    VerifyClientCertRevocation = 0x00000000
    VerifyRevocationUsingCacheOnly = 0x00000002
    DefaultRevocationFreshnessTimeIsEnabled = 0x00000004
    NoUsageCheck = 0x00010000
}

[Flags()] enum SslFlags {
    None = 0x00000000
    UseDsMapper = 0x00000001

jborean93

<#
.SYNOPSIS
Windows PowerShell SSH Server Subsystem Shim.

.DESCRIPTION
Used as a basic wrapper for Windows PowerShell that allows it to be used as a target for SSH based remoting sessions.
This allows a PowerShell client to target a Windows host through SSH without having PowerShell 7 installed.

.NOTES
This is experimental and used as a POC.

jborean93

class SplatClass : System.Collections.IEnumerable {
    SplatClass() {}
    
    [System.Collections.IEnumerator] GetEnumerator() {
        # This can be any hashtable stored or derived from the class. This is
        # just an example
        $params = @{
            Path = '/tmp'
        }
        

jborean93

# Copyright: (c) 2022, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Install-KDCProxyServer {
    <#
    .SYNOPSIS
    Set up a KDC Proxy server.

    .DESCRIPTION
    Sets up the KDC proxy server on the current host.

jborean93

Add-Type -Namespace LmAccess -Name Native -MemberDefinition @'
[DllImport("Netapi32.dll", CharSet = CharSet.Unicode, EntryPoint = "NetAddServiceAccount")]
private static extern int NativeNetAddServiceAccount(
    IntPtr ServerName,
    string AccountName,
    IntPtr Password,
    AddServiceFlags Flags);

/// <summary>Add a sMSA or gMSA to the current host.</summary>
/// <param name="accountName">The name of the MSA to install.</param>