New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added Invoke-PasswordFilterImplant powershell module #1183

Open
wants to merge 4 commits into
base: dev
from

Conversation

Projects
None yet
2 participants
@Le-non

Le-non commented Jul 6, 2018

Added the Invoke-PasswordFilterImplant module. This module drops a custom password filter DLL that allows the capture of a user's credentials. Each password change event on a domain will trigger the registered DLL in order to exfiltrate the username and new password value prior successfully changing it in the Active Directory (AD).

Here is the link to the DLL in the code: https://github.com/GoSecure/DLLPasswordFilterImplant

Le-non added some commits Apr 26, 2018

Added password filter implant module
Added password filter implant module to exfiltrate usernames and passwords by DNS when a password change is made.
Added Invoke-PasswordFilterImplant script
Added Invoke-PasswordFilterImplant powershell script for the password filter implant module.
Updated module description
Updated module description to specify its x64 architecture requirement.

@xorrior xorrior force-pushed the EmpireProject:dev branch from 799c8e8 to 78f9e91 Aug 13, 2018

@phra

phra approved these changes Sep 6, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment