This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # If a script needs to be run elevated, then you can ensure it will only | |
| # ever be run elevated by including the logic within the script. | |
| ## Check privileges | |
| If(-not([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) | |
| { | |
| ## Not-ADMIN = Relaunch as an elevated process: | |
| Start-Process powershell.exe "-File",('"{0}"' -f $MyInvocation.MyCommand.Path) -Verb RunAs | |
| exit | |
| } |
r00t-3xp10it
/ BrowserLogger.ps1
Last active
December 20, 2025 06:20
Browser active tab title enumeration
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Active browser tab title enumeration | |
| Author: @r00t-3xp10it | |
| Tested Under: Windows 10 (19044) x64 bits | |
| Required Dependencies: Get-Process | |
| Optional Dependencies: none | |
| PS cmdlet Dev version: v1.0.2 | |
r00t-3xp10it
/ Invoke-VaultCmd.ps1
Last active
January 31, 2025 11:38
Manage Windows Password Vault Items
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Manage Windows Password Vault Items | |
| Author: @r00t-3xp10it | |
| Tested Under: Windows 10 (19044) x64 bits | |
| Required Dependencies: VaultSvc, VaultCmd | |
| Optional Dependencies: none | |
| PS cmdlet Dev version: v1.3.8 | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Search for Strings\Regex inside files | |
| Author: @r00t-3xp10it (ssa redteam) | |
| Tested Under: Windows 10 (19044) x64 bits | |
| Required Dependencies: none | |
| Optional Dependencies: VaultSvc, VaultCmd | |
| PS cmdlet Dev version: v1.1.21 |
r00t-3xp10it
/ DumpLsass.ps1
Created
December 13, 2022 20:29
Dumps LSASS, SAM, SYSTEM, SECURITY metadata
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Dumps LSASS, SAM, SYSTEM, SECURITY metadata | |
| Author: @r00t-3xp10it | |
| Tested Under: Windows 10 (19044) x64 bits | |
| Required Dependencies: None | |
| Optional Dependencies: Administrator, WinDefend | |
| PS cmdlet Dev version: v2.1.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // How to Compile\Run | |
| // C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe /target:library /out:dumper.dll dump.cs | |
| // [Reflection.Assembly]::Load([IO.File]::ReadAllBytes("$pwd\dumper.dll")) | |
| // [dumper.Program]::Main("$pwd\l5455.dmp") | |
| using System; | |
| using System.Diagnostics; | |
| using System.IO; | |
| using System.Runtime.InteropServices; |
r00t-3xp10it
/ Invoke-WebCamAvi.ps1
Last active
January 31, 2023 14:08
Capture video (AVI) using default webcam
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Capture video (AVI) using default webcam | |
| Author: @r00t-3xp10it | |
| Credits: @AHLASaad \ @AvinabSaha | |
| Tested Under: Windows 10 (19044) x64 bits | |
| Required Dependencies: python3 | |
| Optional Dependencies: opencv-python | |
| PS cmdlet Dev version: v1.2.8 |
r00t-3xp10it
/ Get-ComputerGeolocation.ps1
Last active
July 30, 2026 14:12
Retrieves the Computer's geographical location
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Retrieves the Computer's geographical location | |
| Author: @r00t-3xp10it | |
| Addapted from: @colsw {stackoverflow} | |
| Tested Under: Windows 10 (19044) x64 bits | |
| Required Dependencies: Device.Location.GeoCoordinateWatcher | |
| Optional Dependencies: Curl\ipapi.co {native} | |
| PS cmdlet Dev version: v1.0.3 |
r00t-3xp10it
/ Invoke-Exclusions.ps1
Last active
July 21, 2023 23:32
[MITRE T1562.001] Manage Windows Defender Exclusions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| [MITRE T1562.001] Manage Windows Defender Exclusions. | |
| Author: @r00t-3xp10it (ssa redteam) | |
| Tested Under: Windows 10 (19043) x64 bits | |
| Required Dependencies: Administrator privileges | |
| Optional Dependencies: Iwr, Get-MpPreference, Set-MpPreference, | |
| Get-MpComputerStatus, Remove-MpPreference. | |
| PS cmdlet Dev version: v1.0.4 |
r00t-3xp10it
/ Invoke-LazySign.ps1
Last active
July 21, 2023 23:45
Sign a Windows binary with a self-signed certificate
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Sign a Windows binary with a self-signed certificate | |
| Author: @r00t-3xp10it (ssa redteam) | |
| Tested Under: Windows 10 (19043) x64 bits | |
| Required Dependencies: Administrator privileges | |
| Optional Dependencies: New-SelfSignedCertificate | |
| PS cmdlet Dev version: v1.0.6 |