From 4257f936ecf356504889fa1c5ff311a635bb11ae Mon Sep 17 00:00:00 2001 From: Ben0xA Date: Mon, 12 Aug 2013 10:53:42 -0500 Subject: [PATCH] PoshSec Commands for .NET 3.5 Built a dll for .net 3.5 and powershell 2.0 support. Fixed some code that was implicitly handled by .net 4.0 that has to be explicitly handled by 3.5. I just commented out the code instead of replacing the lines that needed to be changed. --- .../PoshSec.PowerShell.Commands.sln | 20 +++ .../PoshSec.PowerShell.Commands.suo | Bin 0 -> 15360 bytes .../PoshSec.PowerShell.Commands.csproj | 65 ++++++++++ .../PowerShell/Commands/GetDateISO8601.cs | 75 ++++++++++++ .../Commands/GetSecFileIntegrity.cs | 114 ++++++++++++++++++ .../Commands/PoshSecHelloCommand.cs | 35 ++++++ .../PowerShell/Nouns.cs | 19 +++ .../Properties/AssemblyInfo.cs | 35 ++++++ .../Scripts/Get-SecSoftwareInstalled.ps1 | 42 +++++++ .../Scripts/Get-SecSoftwareIntegrity.ps1 | 38 ++++++ .../Release/PoshSec.PowerShell.Commands.dll | Bin 0 -> 20480 bytes .../Release/PoshSec.PowerShell.Commands.pdb | Bin 0 -> 19968 bytes ...Shell.Commands.csproj.FileListAbsolute.txt | 5 + .../Release/PoshSec.PowerShell.Commands.dll | Bin 0 -> 20480 bytes .../Release/PoshSec.PowerShell.Commands.pdb | Bin 0 -> 19968 bytes .../Release/ResolveAssemblyReference.cache | Bin 0 -> 13406 bytes .../PoshSec.PowerShell.Commands.v11.suo | Bin 34304 -> 48128 bytes .../PoshSec.PowerShell.Commands.csproj.user | 3 + ...gnTimeResolveAssemblyReferencesInput.cache | Bin 7172 -> 7244 bytes 19 files changed, 451 insertions(+) create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands.sln create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands.suo create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PoshSec.PowerShell.Commands.csproj create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/GetDateISO8601.cs create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/GetSecFileIntegrity.cs create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/PoshSecHelloCommand.cs create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Nouns.cs create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Properties/AssemblyInfo.cs create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Scripts/Get-SecSoftwareInstalled.ps1 create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Scripts/Get-SecSoftwareIntegrity.ps1 create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/bin/Release/PoshSec.PowerShell.Commands.dll create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/bin/Release/PoshSec.PowerShell.Commands.pdb create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/obj/PoshSec.PowerShell.Commands.csproj.FileListAbsolute.txt create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/obj/Release/PoshSec.PowerShell.Commands.dll create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/obj/Release/PoshSec.PowerShell.Commands.pdb create mode 100644 PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/obj/Release/ResolveAssemblyReference.cache diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands.sln b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands.sln new file mode 100644 index 0000000..9dfcad7 --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 9.00 +# Visual Studio 2005 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PoshSec.PowerShell.Commands", "PoshSec.PowerShell.Commands\PoshSec.PowerShell.Commands.csproj", "{87598CD5-263C-41D0-A6E0-AD4851607CCE}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {87598CD5-263C-41D0-A6E0-AD4851607CCE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {87598CD5-263C-41D0-A6E0-AD4851607CCE}.Debug|Any CPU.Build.0 = Debug|Any CPU + {87598CD5-263C-41D0-A6E0-AD4851607CCE}.Release|Any CPU.ActiveCfg = Release|Any CPU + {87598CD5-263C-41D0-A6E0-AD4851607CCE}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands.suo b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands.suo new file mode 100644 index 0000000000000000000000000000000000000000..3e9d01c4d56b7bad63d217c92bd42886a9d7c601 GIT binary patch literal 15360 zcmeI3TWnlM8OLYsBz00~(=<)nG)XX5pG zy?eYd4Nfzw|GCVWGv8dk+kA8O{J9(6_~F@=Z<@Sxzo|4ACKj7TIr$N;1)G){Q^AFB zVPay!Wg5ff)ijSr-~-yafXTZBECibGYd{rP46Xx9z_s9G;N#$W!1S9NzzVPo+z6I~ zo50QBHgGEtZ>$W?tAg`98lEe@sRvA&U)DrTs~O@vV#b)I@M#5H;|EFnQ8az$nHPti zeKk@^p_f15O74SV+8i_OQ19ca)to9?MgGGTXdq8t=lth0-HU&fI?aH|m{HShQYOLO z9+w^ZxZG4kL|1w-EPa)IC!lZ;${BOqbl7%e%>&#e855tMDbbQ@=t~YoTd72G`&e== z`BsvAN{4Gsqz81L3+VuV@8w@QAy)@@`Byo~zs}MD(kapbl7Hy~$^Y$OHCO|pKy0uU ztOM2H4zM0<0C$4Bz$d}o;2y9SsQ!C7*Mg0p4r~JTU^8d{TY$=K<@`9f4{QgY0{4SY zgU^5_&Q|8g1i*xK`;c;L7s1m_#_KPgZz`6B}tOzM}oX@&X0mG zgU5or1>bwW<@KGvi~p*ju`_e;*lRbniYO%BH5=~OD&lO0G8 zWnyjJnWNe6BdMg!%aV?Cckhnwo@{#Ln$F}%h7wir^x$y!NOEMUO2*T@$$cZ~69c`; zkt$^*1|CT+*p(d1Eb8n|jV9@DWu;lT@YTKCS-0?{5@8m?cYO<`!4z zP|0Dbu9TMQPD#(Fq<7+ykjs}e+Lw|#(KiR-rZoER2**=!x%AHoIIqWYWAWP8qJN|d z!~#miOS`A?F{EphTA*IOC!Q{qqJjREZV5|Y3@BekDW85bZAj9F z<7SxA7_c_6SUc{-{z$(`Cx)dj-76VX%BL^;r*R)<6b5L)P>E4kUxxjYKc_Y*iGM~w z+-yTXsWm4+3d+OinxyT2*Ay!mMPJHhi9fo~nQ5+%TCV9aF?)ZK_eRLk9H#iis69<> zgSGeoBiB!h=<61( zszg0cOzf&Kk$2nNDkW0+c;oIq?}Dgc?zQgC%8Jt{r!Ba@TRF#3KT)bfYlN=%2Py8fQl8`86>|HOx<|y_PKRV4fPtYvk9!b3JV! zzmEG&TyN&O!M?5K-p0C3^_NAr(3-2f^}psVEt|3d$4hO=&2`I`q*W?X-($#vB<%l> zx88!+Yx92MX7?+8KBn=?Y0)ge|rf z96?ijOnUhDKdxW)_Jy}5e7=0+4LSL_&lJ1cjipIhJEPS`H)>F8j$xFrQ;3RMIg5WE zBn?AWmZ>i&jxp5iNd_&K?p|nTp)*NUEBvWteA}FNs)sx)WhZ`&fWNtw<}ZsS-fuVw zmcMf0mDL^3eZTk2v#a0UI#aFtqsF{IFXo5Ackz;!=S_PHIY3&IDZOTU5r@Ym3mF^t zNTLh!y--(rrX%|gHkP-X0%85n-1Vo|BU%R!(-y6~UGzvANxpFLr2P-AlC-7>OMjcn z2TQ02kbhC_w(e%{MV;&P+T=QWrdBBaDY`z*R4z9^xBqQOZ?C02gw&*H%??^4y`xbG zMc?+jT>4j%o9)Kko z>N&<)h}YN!+(xuO4R;FKY+|p_Ysu-OL;P>n^!Gqt@p2{gPuK6x8yQG2Gb3=Od{pfu z?1WRZjF$GTdN{f`{z=PEN&8(vhUbc{YH8GK!vYyb*6~dBG!E1rL8o1SY@}?hElJ@S z(&2OR!^%&s@x;E@zwzKx+t;6Odj5@{w(Wm-{MBUy({?r|;@ZP4rI}zGvC39f+KS!O zaIUjIMGmxbX|SlbQ5`iiC&oBLjPY`YPcnHknKO!A41J8rRd~Ko4Cvx#8~+MM$j1uB z5lzhUV4%@7_b!Sjsn)Y$emS#(5NrleyR{?IZd5EIIMa z*xc+y&TX&cJx{g8VdhiD(9h?5<>cw}8KGBKo^R#m(^(t8uiOqF%V$v(KR4j!cWR`S z3QNI9eS9+Ce(3qB-;b2CcvH37N6~Nj*_n-NSJ$CHPn7-Ry=CA%kUrU;WO zA!$_F+1$~tuj1S|7xVx1EnTVPzrWFPI;{VFoU#=`bG&Ek?5niCzAWiSp0xfgokTxM zu^T~H`ook}+*Ro?W0XQRyYT{!bL@w%i+|3%=jq;bN3DNu<5K>7So&WI%BzNA;~xam zRBXmX|Lr%|w@@N1{nM0P7L0$s?-^lzDQz|V%a|D7#VQj?`jk+^63Olr@ZAD z4yd*g>p)i?C%UoroT?q;#6_z&U+w*LtJn00KR%%qm1aYU%Od-8m)qY_Eb6N?@oV7g z;0f>~Q2y0)<&VIndhzA?yVt+>k0<>XBN}6U8(p3se&zX3Q^%oL>`t+p+crqM?3bSo$p*XGPhw?-CbCYt=4i>Q>R-+>06u*tg_;g z`j3XJ^8veR)UKDlSGMS1s%GZ&GSIki>H?3PW2ioUVG)SB+KTO{Q>APV0x7wqS&!PQc`6}8k zxd~|B;$|TGeJjwn#PTQfJ+n66R)aObYa;z4U~)sB_}w)BnZmP3#r%&=A?lI;;oIi; zuk=fO6!HE?G5QUqt1|NcW=sDB^;QM`PciyiLekefY3{=IUw-Xhg1ToH|2+t&k6JDb zUT5E;A|n3rW8m|Popbk}iuK=rBUh}ha_0XlR5%ihf3dp5KJ$GKJN{wo4O?zL)Bi80 CT<#VC literal 0 HcmV?d00001 diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PoshSec.PowerShell.Commands.csproj b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PoshSec.PowerShell.Commands.csproj new file mode 100644 index 0000000..af45fe2 --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PoshSec.PowerShell.Commands.csproj @@ -0,0 +1,65 @@ + + + Debug + AnyCPU + 8.0.50727 + 2.0 + {87598CD5-263C-41D0-A6E0-AD4851607CCE} + Library + Properties + PoshSec.PowerShell.Commands + PoshSec.PowerShell.Commands + + + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + x86 + + + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + x86 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/GetDateISO8601.cs b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/GetDateISO8601.cs new file mode 100644 index 0000000..4af6d3c --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/GetDateISO8601.cs @@ -0,0 +1,75 @@ +// +// Copyright © 2013 and distributed under the BSD license. +// + +namespace PoshSec.PowerShell.Commands +{ + using System; + using System.Management.Automation; + using Microsoft.PowerShell.Commands; + + /// + /// Get a string with a prefix, the current date/time in ISO 8601 format, and a suffix. + /// ISO 8601 Data elements and interchange formats – Information interchange – Representation of dates and time + /// + [System.Management.Automation.Cmdlet( + System.Management.Automation.VerbsCommon.Get, + PoshSec.PowerShell.Nouns.DateISO8601)] + public class GetDateISO8601 : System.Management.Automation.PSCmdlet + { + /// + /// Gets or sets a value indicating the beginning of the string. + /// + [Parameter(Mandatory = true)] + //public string Prefix { get; set; } + public string Prefix; + + /// + /// Gets or sets a value indicating the ending of the string. + /// + [Parameter(Mandatory = true)] + //public string Suffix { get; set; } + public string Suffix; + + /// + /// Gets or sets the value indicating whether to include seconds. + /// + [Parameter(Mandatory = false)] + //public System.Management.Automation.SwitchParameter Seconds { get; set; } + public System.Management.Automation.SwitchParameter Seconds; + + /// + /// Gets or sets the value indicating whether to include milliseconds. + /// + [Parameter(Mandatory = false)] + //public System.Management.Automation.SwitchParameter Milliseconds { get; set; } + public System.Management.Automation.SwitchParameter Milliseconds; + + /// + /// Provides a record-by-record processing functionality for the cmdlet. + /// + protected override void ProcessRecord() + { + DateTime now = DateTime.Now; + + string year = now.Year.ToString("0000"); + string month = now.Month.ToString("00"); + string day = now.Day.ToString("00"); + string hour = now.Hour.ToString("00"); + string minute = now.Minute.ToString("00"); + string second = now.Second.ToString("00"); + string millisecond = now.Millisecond.ToString("000"); + + string result = string.Format("{0}-{1}-{2}-{3}-{4}-{5}", this.Prefix, year, month, day, hour, minute); + + if (this.Seconds) + { + result = string.Concat(result, "-", second); + if (this.Milliseconds) result = string.Concat(result, "-", millisecond); + } + + result = string.Concat(result, this.Suffix); + this.WriteObject(result); + } + } +} diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/GetSecFileIntegrity.cs b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/GetSecFileIntegrity.cs new file mode 100644 index 0000000..d2f4638 --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/GetSecFileIntegrity.cs @@ -0,0 +1,114 @@ +// +// Copyright © 2013 and distributed under the BSD license. +// + +namespace PoshSec.PowerShell.Commands +{ + using System; + using System.Collections.Generic; + using System.IO; + using System.Management.Automation; + using System.Security.Cryptography; + using Microsoft.PowerShell.Commands; + using Microsoft.Win32; + + /// + /// Get a string with a prefix, the current date/time in ISO 8601 format, and a suffix. + /// ISO 8601 Data elements and interchange formats – Information interchange – Representation of dates and time + /// + [System.Management.Automation.Cmdlet( + System.Management.Automation.VerbsCommon.Get, + PoshSec.PowerShell.Nouns.SecFileIntegrity)] + public class GetSecFileIntegrity : System.Management.Automation.PSCmdlet + { + /// + /// Provides a record-by-record processing functionality for the cmdlet. + /// + protected override void ProcessRecord() + { + string registryKeyName = @"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths"; + // RegistryKey baseKey = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Default); + RegistryKey baseKey = Registry.LocalMachine; + RegistryKey subKey = baseKey.OpenSubKey(registryKeyName); + + SHA1 sha = new SHA1CryptoServiceProvider(); + + foreach (string app in subKey.GetSubKeyNames()) + { + PoshSecFileIntegrity fileIntegrity = new PoshSecFileIntegrity(); + + RegistryKey fileKey = subKey.OpenSubKey(app); + fileIntegrity.RegistryPath = fileKey.Name; + + // Enumerate the value names, find the default (string.Empty), get the path, and exit + foreach (string name in fileKey.GetValueNames()) + { + if (name == string.Empty) + { + string value = fileKey.GetValue(name).ToString(); + value = value.Trim(); + value = value.Trim('"'); + value = value.Trim(); + + fileIntegrity.FilePath = value; + fileIntegrity.Exists = File.Exists(fileIntegrity.FilePath); + break; + } + } + + // If the file exists, read the bytes and get the hash + if (fileIntegrity.Exists) + { + BinaryReader fileStream = new BinaryReader(File.Open(fileIntegrity.FilePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite)); + byte[] fileBytes = fileStream.ReadBytes((int)fileStream.BaseStream.Length); + byte[] fileHash = sha.ComputeHash(fileBytes); + fileIntegrity.Sha1Hash = Convert.ToBase64String(fileHash); + } + + // Send the file integrity object onto the pipeline. For baselining, consume with Export-Clixml. + this.WriteObject(fileIntegrity); + } + } + + /// + /// PowerShell Security project File Integrity checker. + /// + private class PoshSecFileIntegrity + { + /// + /// Initializes a new instance of the class. + /// + public PoshSecFileIntegrity() + { + this.Exists = false; + this.FilePath = string.Empty; + this.RegistryPath = string.Empty; + this.Sha1Hash = string.Empty; + } + + /// + /// Gets or sets a value indicating whether the file exists on the file system. + /// + //public bool Exists { get; set; } + public bool Exists; + + /// + /// Gets or sets a value indicating the file system path. + /// + //public string FilePath { get; set; } + public string FilePath; + + /// + /// Gets or sets a value indicating the registry path. + /// + //public string RegistryPath { get; set; } + public string RegistryPath; + + /// + /// Gets or sets a value containing the SHA hash in Base64 encoding. + /// + //public string Sha1Hash { get; set; } + public string Sha1Hash; + } + } +} diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/PoshSecHelloCommand.cs b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/PoshSecHelloCommand.cs new file mode 100644 index 0000000..154b296 --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Commands/PoshSecHelloCommand.cs @@ -0,0 +1,35 @@ +// +// Copyright © 2013 and distributed under the BSD license. +// + +namespace PoshSec.PowerShell.Commands +{ + using System; + using System.Management.Automation; + using Microsoft.PowerShell.Commands; + + /// + /// Sample Hello World cmdlet. + /// + [System.Management.Automation.Cmdlet( + System.Management.Automation.VerbsCommon.Get, + PoshSec.PowerShell.Nouns.PoshSecHello)] + public class PoshSecHelloCommand : System.Management.Automation.PSCmdlet + { + /// + /// Gets or sets the person's name. + /// + [Parameter(Position = 0, Mandatory = true)] + //public string Name { get; set; } + public string Name; + + /// + /// Provides a record-by-record processing functionality for the cmdlet. + /// + protected override void ProcessRecord() + { + string result = string.Format("Hello world. Hello {0}.", this.Name); + this.WriteObject(result); + } + } +} diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Nouns.cs b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Nouns.cs new file mode 100644 index 0000000..622aec0 --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/PowerShell/Nouns.cs @@ -0,0 +1,19 @@ +// +// Copyright © 2013 and distributed under the BSD license. +// + +namespace PoshSec.PowerShell +{ + using System; + + /// + /// Defines the common noun names that can be used to name PoshSec cmdlets. + /// + [System.Diagnostics.CodeAnalysis.SuppressMessage("StyleCop.CSharp.DocumentationRules", "SA1600:ElementsMustBeDocumented", Scope = "module", Justification = "Reviewed. The element names are self-explanatory.")] + internal static class Nouns + { + public const string PoshSecHello = "PoshSecHello"; + public const string DateISO8601 = "DateISO8601"; + public const string SecFileIntegrity = "SecFileIntegrity"; + } +} \ No newline at end of file diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Properties/AssemblyInfo.cs b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..45d389e --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Properties/AssemblyInfo.cs @@ -0,0 +1,35 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +[assembly: AssemblyTitle("PoshSec")] +[assembly: AssemblyDescription("PoshSec -- PowerShell Security Module")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("")] +[assembly: AssemblyCopyright("Copyright © 2013")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from +// COM, set the ComVisible attribute to true on that type. +[assembly: ComVisible(false)] + +// The following GUID is for the ID of the typelib if this project is exposed to COM +[assembly: Guid("4d6b9b02-3c79-4387-97ea-f8c26e352245")] + +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Revision and Build Numbers +// by using the '*' as shown below: +[assembly: AssemblyVersion("0.1.0.0")] +[assembly: AssemblyFileVersion("0.1.0.0")] diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Scripts/Get-SecSoftwareInstalled.ps1 b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Scripts/Get-SecSoftwareInstalled.ps1 new file mode 100644 index 0000000..ef12f0f --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Scripts/Get-SecSoftwareInstalled.ps1 @@ -0,0 +1,42 @@ +function Get-SecSoftwareInstalled +{ + <# + .Synopsis + Baselines the installed software to an XML file. + .Description + Baselines the installed software to an XML file. + + CSIS 20 Critical Security Controls for Effective Cyber Defense excerpt: + Devise a list of authorized software that is required in the enterprise for each type of system, including servers, workstations, and laptops of various kinds and uses. This list should be tied to file integrity checking software to validate that the software + .Example + Get-InstalledSoftware + .Link + https://github.com/organizations/PoshSec + #> + + + [string]$computer = Get-Content env:ComputerName + + [string]$filename = Get-DateISO8601 -Prefix ".\$computer-Software" -Suffix ".xml" + + + Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |Select @{name="ComputerName";expression={"$env:computername"}}, DisplayName, DisplayVersion, Publisher, InstallDate, HelpLink, UninstallString | Export-Clixml $filename + + + + if(-NOT(Test-Path ".\Baselines\$computer-Installed-Baseline.xml")) + { + Rename-Item $filename "$computer-Installed-Baseline.xml" + Move-Item ".\$computer-Installed-Baseline.xml" .\Baselines + Write-Warning "The baseline file for this computer has been created, now running the script again." + Invoke-Expression $MyInvocation.MyCommand + + } + else + { + Compare-SecSoftwareInstalled + Compare-SecSoftwareVersion + + } + +} diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Scripts/Get-SecSoftwareIntegrity.ps1 b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Scripts/Get-SecSoftwareIntegrity.ps1 new file mode 100644 index 0000000..a779f1c --- /dev/null +++ b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/Scripts/Get-SecSoftwareIntegrity.ps1 @@ -0,0 +1,38 @@ +function Get-SecSoftwareIntegrity +{ + <# + .Synopsis + Baselines the installed software to an XML file. + .Description + Baselines the installed software to an XML file. + + CSIS 20 Critical Security Controls for Effective Cyber Defense excerpt: + Devise a list of authorized software that is required in the enterprise for each type of system, including servers, workstations, and laptops of various kinds and uses. This list should be tied to file integrity checking software to validate that the software + .Example + Get-InstalledSoftware + .Link + https://github.com/organizations/PoshSec + #> + + [string]$computer = Get-Content env:ComputerName + [string]$filename = Get-DateISO8601 -Prefix ".\$computer-Integrity" -Suffix ".xml" + Get-SecFileIntegrity | Export-Clixml -Path $filename + + [System.Array]$approved = Import-Clixml -Path ".\$computer-Integrity-Baseline.xml" + [System.Array]$installed = Import-Clixml -Path $filename + + + if(-NOT(Test-Path ".\Baselines\$computer-Integrity-Baseline.xml")) + { + Rename-Item $filename "$computer-Integrity-Baseline.xml" + Move-Item ".\$computer-Integrity-Baseline.xml" .\Baselines + Write-Warning "The baseline file for this computer has been created, please run this script again." + Invoke-Expression $MyInvocation.MyCommand + + } + else + { + Compare-SecSoftwareIntegrity + } + +} diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/bin/Release/PoshSec.PowerShell.Commands.dll b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/bin/Release/PoshSec.PowerShell.Commands.dll new file mode 100644 index 0000000000000000000000000000000000000000..556963678596838fff40f41be6b7c42c7f0e9d14 GIT binary patch literal 20480 zcmeHOZEPGz8GiTf_Iy6u7w=u`#I2pIn-82czSxfQMJe@X5;y*;&$Sbxafk3=h-gMLnU9}2%)yS*egDEv7gE?J}F3_ zm&%8Wy}eF>h6*V{q(Z_M!ayrP#nq0BK}A&U+KrU3pJSTG1v!TxwLc&-A`kH7UgRpF z-9wyeM^z?bc{oN?30YqYQQh*gYvolUj9?)|kUzMPBT72@NeB6nH~?kE@gTJjRH9=^ z%eK;x2;16`VB?!{m4tR!pS1L>2}QP*j^Sdxc3dT)ov5=U>nD8%dd$Z46okrnwACmQRaaT=bH(9P&;?cu~4WsMR$XSCiA1r~4b_B3nP);6w( zvb}-ZELZR|RV2*@fMMRm(rCF7HNkE)QGp&R8sPzno-RWx0Yz@yjEqu+E~=C&rShC{ z+n?UMdUf0SK;sq^Z2MuL@dJnhHNu#H7_czaOENiLk{jHHsY^5m2;;?^Vjc|4L*NwL z5uwJdXeSy7iw+ms7y2P;!AxKVltwfVjmD|*X2gl|c)4{R4K!{?t^(2~mPX@I>xrVY z64E3~E8-Q4(ke)Iu(UE>xhPG9Acg}Yny89bm561C;bXz<#$zSoFvM7*(Zrhg8tX!_ z!$g^N5$U?Ku-Ki_z^QT!@2g7n+A_ep2%xqcaD&3a8xMD^HJa(pT@057;Bd{;#L~F7+xvP0k>mHWK zlm#Bf+Sz!9=q1FDW1($KIhK*n*sL*$_TNIh@y-vhZ#Uv`lE(zT7QBq~hR`L*2L;|08VQ9dEif-|R^WXC9}@VOz@LV=?whC; zrFTQza+Q1;y~JfsZr|A1aevz&OFG3OteGjOF zF4Bv%C6oYe4?PFT-q4T0cLz#eq}x4wnSKfWeh&O>=ofSa?fe$_Wav$jq)VYcBK<<> zFH|o5D)cu}q_;!wQmrIm3Kh{~xxlRwTlFGsmdB+QX_x$E;H~nL(mtspbOGr;q+6s> zfp-ba2($#A26EkRO0{%W{w~tz<>v)nmSULy8j8Woy8~EB`zc8qsV0!5Q*;JcL9a}2#I}Uw7ODewiS!|XDS;oQHptU-6nLDnK${AIG<}lJ(i6bV(vN{tk|cFWw@3}Z zQ&NXO4R}_%SD-9SNI#K6^E}TIgBQjS^G+`YiJlV4Qk^LFI|p9j2p{SbcWv&k+qm(%i-c5*VCr2(^$w^z}k1GdNhHoUgqg#aDOb|-_MmB5MUdA0y za#)|rVnA$mhi&V*iR>JAII3GVWE~C;j){V!FBGmQD7I6`J4Q}V@@!bWEAt$^fF!!{g|)z?D-h-l>sjrjNZE_V47+n62Iv?QMi!f5vD96Yi}`*dZJD+? ze<+YGFq|Z^GnbxxXT6)^Z>oho{=Tn6VmV2gRWfgeqCA+M-8Hc~h%}k^4 zU`LB9@Jz>CoG>P_5_#8(26)xll+m4|V*Nrss$~nhD|Vk&s3$jrO>NE`?YXC*@mRRJ zP@@sk(;2ah9Cb}=Sma`VCVL0Ph7kZAUCW6i6D$%PY2IgUF{-(PqD~{PS#!fW78+V| ztFdvNnyr^)`}BN9Y(#CcbI!p4cn5Z5GbT8gh8>tN>=m&sv6xQimIF(Ea^tpse*!e(8ZpZ%tV`-!-1j9_QEWSO%fKB8m9*lL(IHnZQ%!z@m9YjYw#XcjED z$jI~d6QUo4p1Wz6vG)z4-PW@!y1hL4(*mFaQskMBjgQv0z5ba<%L{u)pWZ#ND-e#Y8-igr3{Jt=bcta#-C`s< z^`dBy_Tm}18U3rS-hK=`iyFOx3`_wAXJFuS6jVtHgag5_QWa7qDaH_x0ZI=iBeEKh zVzF9086MD`YE0YGQ;UM(_z|ebkDw;i$Ix6%ra&OZ4b{a^5~~m5!7>o5pin#)Q|?g; z%3K&N$LH^rRRW?)6ngb?1mb$RUX}@!WbVCgLzxnbAHi?_p;){coy6j&S*1P};eWyF zUArp1quV{)@F;|5fRRW9QbU|3IORtIy87!W4`lh+bkfWeOBI&mrQ5`npPq%9@iccwfQ- z+A7hew#nTS`zD%On|7x6>}zVx1Ln`U!lypW(-paU8$6nX0%c8R>D)nAM)Xu32VI+&zvHNXMP+T6)Qu$qDgt z4KqaeF#Cd3H@zH-ej=iyU8dEY#i?WD-N!Fo7texR#L}-9Eaq>a5?a;ZvMF`r zOu-SvVUwsef>I669UE>Q_Gr0&E}=l*3f+&FZwWRz!tIlX`)6fK$ApgS!(wcs3HEKl z1GWWqyU<$>Ki8YaUkH~vqEz^~n(#W!(phN1a|tJv>rYdWW@i=q<6Nhc3J;!%mJ7lu zMetTd&_~gxZfM)Wzh}TlS2~uZeexWY)?4c1>Tv!v0szzEb_y-|Bk(Fg1;g3g-~d-56Z8SokK d8SokK8SokK8SokK8SokK8SokK8F;@K_!mVRvYh|` literal 0 HcmV?d00001 diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/bin/Release/PoshSec.PowerShell.Commands.pdb b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/bin/Release/PoshSec.PowerShell.Commands.pdb new file mode 100644 index 0000000000000000000000000000000000000000..fbde304d093bb3707629ecb2c241b6d9163c75a5 GIT binary patch literal 19968 zcmeHO3v5)!6`fr#U>iGl`8Yr*EMR_4x?USF1_Cy=F?PWP$9yA~u&f{UiuJCuABfea zEUDCxmR3kjTOtLCDx|5@G=es2BtBA9QPiR;v`JMVq$pOBMrnisp^chI$nH7w-t0cF z*B_`q!Mw5Vp7-X?_s*R=cjk@j{l0K0651DaRTWh|{IILOvBtH+?eXMh&#Z0~2zDWC zfJLC!`HoPagY`QGByfDb@N{-t;eM5X>tgqn`?c>@zq`99UM{wk(T?RA1aOM(ZU-H|M3h_l|-Gx2B3|3reerD6}Z&v>OaQKxMXf_z~f9O5^$ERbC zqnVp#tm&-XF&=RPmJNCUGzrAAoS?~|DWIvKX`p=2bkKt! zD-5j!(%FBmi)Q=Jch;JUL)#Low9$~jaLxbG=!;e7ol9V-#{b}N+OO0edGgGSai5<% z@#syObSvBg5*VuSe`#{V{$qvz_19cGzpZ1^TNmzuu3Jrn1cqw-!@s)SS@+tZPfi?J zow@7Gvvl38a1ThJ>qgfNp6}kmIj^W%)l{t=&;p_MHZ2%!+U}3Uya89GH{$m-Z3#tM z8#SMMOX#2$Zfw;80e4lXt<4*3jtsz4>6;SiH)v55RpSq6b-}3C681+s+`fnqzEw@l zruq-)_3xGSx1;_D>ThTL5m~=a)!#o)rEf~4Z_%PCY9H$No9iE`?i-@4g$zT6OxXRA z>b)T?iZEn|gw>B!?=kq*-l$gBxVfyMw`}a~orDY|=3bxq9x*afii`2gvTcVNChf#C zr5gv5rvX(sj0crg)OyRAmSx33-j%|a z`Ij1eo`t3GJuH72;^!ehz{D3KthM+f(QwB`t>c^CHVx-)E+_K$NP~q`17GrJ=#u3N zan`VW3R%86P+#gtxsN@fps=DDy?6?*gB4VS2Wm z2hQfYxezBD0r1#%!=@z4WE!@eCY2=xXJiG7? zPeZna_3#|hoacZy5Mw4gtQtwxcN}@E5&waamt)BDOLJbfu`wFfylwgz^K3JfU)d4W zSU>Y~^-1N|dLylfPSmg3Q7RmcKbL=U>36&SQFnepmi^qXU*E%Y^=K7!%7KD74s^U7 zrge(>Zz1kD_zX7utuvlocvtrS+Y|nf7l!>e)PP9`6(E*=?f<*>+$V;^{x==@iCkAG zz&P5FYX2(`Jp;UTz(v6Iz#`zMH@f1>fdzQ40B!*0if`dudL^g^R0iH^lqhu@2A~17 z7PML{5hxX5rdWV;X*bTdzX2i^8(0S13YsI+EyQZ&6op889JB{i3EGS}&ITdoiupJL z&ldl|v!RDFp3e-kbQsoO>P)F9l=G~UgNdN@gU=8Vry>!PEgbS`k;r43FBERp=N0px zLOzv;>9UhH9D1I#=a&8Vc)qIkKN8zZ^9p>uE3XEbS*g1jV^86=g@RE!7;2u= ze!C6(50frKk%0u1JD#?kbqKdF8bZnL!T2J!Svfh#f_&qZ53&dEdRaE1>Y&bT1u-;W z%=q32q<@Y0_;lbl;C$eAAoNG70{71l*z*9hY4)OPZYk=2*)W_Sv z3SbuMBT_G`fQy0EKo5}qNiJqjE^5-L7`PO)!k|iE1T-6cT?1N#IkyY%^jjA8@FTiV z9z!PRdC+OT^bt7zYW>eK^35=%1%G@y;w7t(_5UK$GmlDVUjNN|wSM<=$$eOw6GmN^ z*(~UDLjS{BBo>J3zH;S2I*E+z>r{|~T5SY}{kxB+>M7Sby)QP|FD7LU*en_5V64~( z7m)fn7nlp}O&teaX!R{ypG2Ankt@@HVg-Nc&Hu{pY@u_8(6?h5v8 zUS7O@1E;Vet8rw$p{bAitnOH4dZDYhc=fP1njkKNc5 znA6&YkrqNRm!Fa1K$!Dns61Fq&3PRC=&f3X$C>uWqUWuB$t>u24c*|;JisPjK~ z&MG;iyGAtkMIpY~<9JA@;BD@OXae?*!AC$&@6lmiQW);ite%QYr znIsln$`hNW+=jwLA%{mmFB-~2vE+kvoBipVd}rw2@5mM(!j>>7|Ic&2HL>g%hH04m zzlpv4zlyuBdkFl$oL>H4{M_JVk;Z`Eq5qfL%m4f9AnWdVV=Hz2*T*)w{_F4jrP?q) zx&HU$@r*6G{`chZEGfDECwbQTe^)my)2Po#x}QBYh&8Kwr_>RXTdq4GG)mpwlch7F zKPMHydKyv*Jnt^H)!DKh+ErVcNDy?cKudz>RsAVXvtmre;9VU^_KrP zq_gVYDQpUw%Cji7|9geI0)%w?zmw3E>)>(S{un-807irU;h#V>(~E)JPs|0)1977< z8#D*x0;&BXoj)oaHz)jN!cEC!5Zf{pGz~;Q^Fh#b5Pbyx4>9i{@EeL1hE4+Whps5A RBufI81S|xafk3=h-gMLnU9}2%)yS*egDEv7gE?J}F3_ zm&%8Wy}eF>h6*V{q(Z_M!ayrP#nq0BK}A&U+KrU3pJSTG1v!TxwLc&-A`kH7UgRpF z-9wyeM^z?bc{oN?30YqYQQh*gYvolUj9?)|kUzMPBT72@NeB6nH~?kE@gTJjRH9=^ z%eK;x2;16`VB?!{m4tR!pS1L>2}QP*j^Sdxc3dT)ov5=U>nD8%dd$Z46okrnwACmQRaaT=bH(9P&;?cu~4WsMR$XSCiA1r~4b_B3nP);6w( zvb}-ZELZR|RV2*@fMMRm(rCF7HNkE)QGp&R8sPzno-RWx0Yz@yjEqu+E~=C&rShC{ z+n?UMdUf0SK;sq^Z2MuL@dJnhHNu#H7_czaOENiLk{jHHsY^5m2;;?^Vjc|4L*NwL z5uwJdXeSy7iw+ms7y2P;!AxKVltwfVjmD|*X2gl|c)4{R4K!{?t^(2~mPX@I>xrVY z64E3~E8-Q4(ke)Iu(UE>xhPG9Acg}Yny89bm561C;bXz<#$zSoFvM7*(Zrhg8tX!_ z!$g^N5$U?Ku-Ki_z^QT!@2g7n+A_ep2%xqcaD&3a8xMD^HJa(pT@057;Bd{;#L~F7+xvP0k>mHWK zlm#Bf+Sz!9=q1FDW1($KIhK*n*sL*$_TNIh@y-vhZ#Uv`lE(zT7QBq~hR`L*2L;|08VQ9dEif-|R^WXC9}@VOz@LV=?whC; zrFTQza+Q1;y~JfsZr|A1aevz&OFG3OteGjOF zF4Bv%C6oYe4?PFT-q4T0cLz#eq}x4wnSKfWeh&O>=ofSa?fe$_Wav$jq)VYcBK<<> zFH|o5D)cu}q_;!wQmrIm3Kh{~xxlRwTlFGsmdB+QX_x$E;H~nL(mtspbOGr;q+6s> zfp-ba2($#A26EkRO0{%W{w~tz<>v)nmSULy8j8Woy8~EB`zc8qsV0!5Q*;JcL9a}2#I}Uw7ODewiS!|XDS;oQHptU-6nLDnK${AIG<}lJ(i6bV(vN{tk|cFWw@3}Z zQ&NXO4R}_%SD-9SNI#K6^E}TIgBQjS^G+`YiJlV4Qk^LFI|p9j2p{SbcWv&k+qm(%i-c5*VCr2(^$w^z}k1GdNhHoUgqg#aDOb|-_MmB5MUdA0y za#)|rVnA$mhi&V*iR>JAII3GVWE~C;j){V!FBGmQD7I6`J4Q}V@@!bWEAt$^fF!!{g|)z?D-h-l>sjrjNZE_V47+n62Iv?QMi!f5vD96Yi}`*dZJD+? ze<+YGFq|Z^GnbxxXT6)^Z>oho{=Tn6VmV2gRWfgeqCA+M-8Hc~h%}k^4 zU`LB9@Jz>CoG>P_5_#8(26)xll+m4|V*Nrss$~nhD|Vk&s3$jrO>NE`?YXC*@mRRJ zP@@sk(;2ah9Cb}=Sma`VCVL0Ph7kZAUCW6i6D$%PY2IgUF{-(PqD~{PS#!fW78+V| ztFdvNnyr^)`}BN9Y(#CcbI!p4cn5Z5GbT8gh8>tN>=m&sv6xQimIF(Ea^tpse*!e(8ZpZ%tV`-!-1j9_QEWSO%fKB8m9*lL(IHnZQ%!z@m9YjYw#XcjED z$jI~d6QUo4p1Wz6vG)z4-PW@!y1hL4(*mFaQskMBjgQv0z5ba<%L{u)pWZ#ND-e#Y8-igr3{Jt=bcta#-C`s< z^`dBy_Tm}18U3rS-hK=`iyFOx3`_wAXJFuS6jVtHgag5_QWa7qDaH_x0ZI=iBeEKh zVzF9086MD`YE0YGQ;UM(_z|ebkDw;i$Ix6%ra&OZ4b{a^5~~m5!7>o5pin#)Q|?g; z%3K&N$LH^rRRW?)6ngb?1mb$RUX}@!WbVCgLzxnbAHi?_p;){coy6j&S*1P};eWyF zUArp1quV{)@F;|5fRRW9QbU|3IORtIy87!W4`lh+bkfWeOBI&mrQ5`npPq%9@iccwfQ- z+A7hew#nTS`zD%On|7x6>}zVx1Ln`U!lypW(-paU8$6nX0%c8R>D)nAM)Xu32VI+&zvHNXMP+T6)Qu$qDgt z4KqaeF#Cd3H@zH-ej=iyU8dEY#i?WD-N!Fo7texR#L}-9Eaq>a5?a;ZvMF`r zOu-SvVUwsef>I669UE>Q_Gr0&E}=l*3f+&FZwWRz!tIlX`)6fK$ApgS!(wcs3HEKl z1GWWqyU<$>Ki8YaUkH~vqEz^~n(#W!(phN1a|tJv>rYdWW@i=q<6Nhc3J;!%mJ7lu zMetTd&_~gxZfM)Wzh}TlS2~uZeexWY)?4c1>Tv!v0szzEb_y-|Bk(Fg1;g3g-~d-56Z8SokK d8SokK8SokK8SokK8SokK8SokK8F;@K_!mVRvYh|` literal 0 HcmV?d00001 diff --git a/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/obj/Release/PoshSec.PowerShell.Commands.pdb b/PoshSec.PowerShell.Commands 3.5/PoshSec.PowerShell.Commands/obj/Release/PoshSec.PowerShell.Commands.pdb new file mode 100644 index 0000000000000000000000000000000000000000..fbde304d093bb3707629ecb2c241b6d9163c75a5 GIT binary patch literal 19968 zcmeHO3v5)!6`fr#U>iGl`8Yr*EMR_4x?USF1_Cy=F?PWP$9yA~u&f{UiuJCuABfea zEUDCxmR3kjTOtLCDx|5@G=es2BtBA9QPiR;v`JMVq$pOBMrnisp^chI$nH7w-t0cF z*B_`q!Mw5Vp7-X?_s*R=cjk@j{l0K0651DaRTWh|{IILOvBtH+?eXMh&#Z0~2zDWC zfJLC!`HoPagY`QGByfDb@N{-t;eM5X>tgqn`?c>@zq`99UM{wk(T?RA1aOM(ZU-H|M3h_l|-Gx2B3|3reerD6}Z&v>OaQKxMXf_z~f9O5^$ERbC zqnVp#tm&-XF&=RPmJNCUGzrAAoS?~|DWIvKX`p=2bkKt! zD-5j!(%FBmi)Q=Jch;JUL)#Low9$~jaLxbG=!;e7ol9V-#{b}N+OO0edGgGSai5<% z@#syObSvBg5*VuSe`#{V{$qvz_19cGzpZ1^TNmzuu3Jrn1cqw-!@s)SS@+tZPfi?J zow@7Gvvl38a1ThJ>qgfNp6}kmIj^W%)l{t=&;p_MHZ2%!+U}3Uya89GH{$m-Z3#tM z8#SMMOX#2$Zfw;80e4lXt<4*3jtsz4>6;SiH)v55RpSq6b-}3C681+s+`fnqzEw@l zruq-)_3xGSx1;_D>ThTL5m~=a)!#o)rEf~4Z_%PCY9H$No9iE`?i-@4g$zT6OxXRA z>b)T?iZEn|gw>B!?=kq*-l$gBxVfyMw`}a~orDY|=3bxq9x*afii`2gvTcVNChf#C zr5gv5rvX(sj0crg)OyRAmSx33-j%|a z`Ij1eo`t3GJuH72;^!ehz{D3KthM+f(QwB`t>c^CHVx-)E+_K$NP~q`17GrJ=#u3N zan`VW3R%86P+#gtxsN@fps=DDy?6?*gB4VS2Wm z2hQfYxezBD0r1#%!=@z4WE!@eCY2=xXJiG7? zPeZna_3#|hoacZy5Mw4gtQtwxcN}@E5&waamt)BDOLJbfu`wFfylwgz^K3JfU)d4W zSU>Y~^-1N|dLylfPSmg3Q7RmcKbL=U>36&SQFnepmi^qXU*E%Y^=K7!%7KD74s^U7 zrge(>Zz1kD_zX7utuvlocvtrS+Y|nf7l!>e)PP9`6(E*=?f<*>+$V;^{x==@iCkAG zz&P5FYX2(`Jp;UTz(v6Iz#`zMH@f1>fdzQ40B!*0if`dudL^g^R0iH^lqhu@2A~17 z7PML{5hxX5rdWV;X*bTdzX2i^8(0S13YsI+EyQZ&6op889JB{i3EGS}&ITdoiupJL z&ldl|v!RDFp3e-kbQsoO>P)F9l=G~UgNdN@gU=8Vry>!PEgbS`k;r43FBERp=N0px zLOzv;>9UhH9D1I#=a&8Vc)qIkKN8zZ^9p>uE3XEbS*g1jV^86=g@RE!7;2u= ze!C6(50frKk%0u1JD#?kbqKdF8bZnL!T2J!Svfh#f_&qZ53&dEdRaE1>Y&bT1u-;W z%=q32q<@Y0_;lbl;C$eAAoNG70{71l*z*9hY4)OPZYk=2*)W_Sv z3SbuMBT_G`fQy0EKo5}qNiJqjE^5-L7`PO)!k|iE1T-6cT?1N#IkyY%^jjA8@FTiV z9z!PRdC+OT^bt7zYW>eK^35=%1%G@y;w7t(_5UK$GmlDVUjNN|wSM<=$$eOw6GmN^ z*(~UDLjS{BBo>J3zH;S2I*E+z>r{|~T5SY}{kxB+>M7Sby)QP|FD7LU*en_5V64~( z7m)fn7nlp}O&teaX!R{ypG2Ankt@@HVg-Nc&Hu{pY@u_8(6?h5v8 zUS7O@1E;Vet8rw$p{bAitnOH4dZDYhc=fP1njkKNc5 znA6&YkrqNRm!Fa1K$!Dns61Fq&3PRC=&f3X$C>uWqUWuB$t>u24c*|;JisPjK~ z&MG;iyGAtkMIpY~<9JA@;BD@OXae?*!AC$&@6lmiQW);ite%QYr znIsln$`hNW+=jwLA%{mmFB-~2vE+kvoBipVd}rw2@5mM(!j>>7|Ic&2HL>g%hH04m zzlpv4zlyuBdkFl$oL>H4{M_JVk;Z`Eq5qfL%m4f9AnWdVV=Hz2*T*)w{_F4jrP?q) zx&HU$@r*6G{`chZEGfDECwbQTe^)my)2Po#x}QBYh&8Kwr_>RXTdq4GG)mpwlch7F zKPMHydKyv*Jnt^H)!DKh+ErVcNDy?cKudz>RsAVXvtmre;9VU^_KrP zq_gVYDQpUw%Cji7|9geI0)%w?zmw3E>)>(S{un-807irU;h#V>(~E)JPs|0)1977< z8#D*x0;&BXoj)oaHz)jN!cEC!5Zf{pGz~;Q^Fh#b5Pbyx4>9i{@EeL1hE4+Whps5A RBufI81S|72a#FcX!54)=m>}AqftB(AMs5%*KxG;yTXyfmJ)WUN=q1Mw{{O-Oa@7 zon&Tg$5q={YMZu@253tIZKb9~f&@V*NNGx?f=Y_i{@^8wg!oY*9s&X47Zra%aK5{< z<2&)RO;Y%?+Od50elzF3&i(GWXYQQ<3j_lHp$osbn(9dGnb5PQVHtTlwsT%D=3>*D zHEVUW?dGPX8>RkF#M7}G( zJ>S`x>)NU%v<6hO#kcfWYRR(sT*}sL4lO0G7r8+78_SPkNuyZgS({p5#XhZB2W@Sp z$kASq@%~ zGI=alEQVl>J^#y+_skVz<9g|cC_O@@+f@49dMRftT4}A^!lm@+U@|k28XK>)XF@A! z1wO}1c5HCoHs&;pZ@RP0uuLY=Ig?NHbaiXFME5qHaJ%7~4K+8zelVS)K&TKfZUbPu zYaN-`GWFVFU_mA19_)InlcF6Io>5{ei;YV#826DSmJoAz168Sp(S-o!Kg=Jz;wC5`qHM~CAzC4>CD8(l;9@X>Fw{pV5&9^JDW_o- z?ymSanlhK^C%Y8H=V9LK*l1BX0VEEuM4ADnCT z!V$wv8YSB_it94OW200+b+iynYPz|hQikyNwmzd5b$cn487XQ7D=G?F$zulzdAO=;pSs-kIPLdXz^4M) zB?$A>g>IqIYjmqIxzbKIlnxTd=s$ETi8Pk~zIZ&I?2G%XeR03FFYfx#xV!envG&EK zy0AtlF{&Z>3krL#&W!L+;RQqknM@!OT&C&qb1Do4(vyH1{28S_kR81>2!HrfD)Vy8 z>&*(sp)z~+WB!DRv$9Y7DLw?86;5r8GwYm|WL%7%b%6@A+wG~s0h925}# zR=}MC!t)B46tIn?FvJigHadpz^}5P1G6;)|Q0iXEB2GLM*PM7LUWtb)9Q7?Q{;u)R zdu9{X8l@Jnm&pR4XKtuwpHEZef6Np$Q)@;Dmti<^t{#5Pn_2 z&j<()FW{tr@bv=TDImPQfKvj({|lG`jKUpY6-8ViE(8O(q8%i#4Aot@C%yaHZNGgq zh^c&uM}>AMGoc+aO#0DF_z~|hN@j{L=m@z;BM_krfg%FN$`!-}skXJJuD15j%I&N@ z(=@=5IV)?JMSVt9?jneZsw%rlva{0EU}q$tvTw-qi$s`;&)F}#Smg6vRV}%?Vy`A?o~1O4$}a;OWhFyWp`y# ziajP#jh&Ey%04gi?sGElf_S&8QKpJ1vq%Fhh15q~(ky{A$0eSyha{k~2W8Sc;2{m( zz-y$bV$$4C1MFGj;AhIdW|>m#n8XxzzXVivA0an1x|hI8Xq2R^HQH1$Z62ZlmbZ>o zyPuzk39R@!1@h;JwNcRmdks3-Cx(;ZKmY!=2X9>8 zf9}n9o_fGI^~OI(C;xaVo%>zubHi`{WA>Kzb)(UU}>3sj9{7fCn?2_NK|KsC7?1x=6y-#eGogjHPTcuX`Y|~cEfo%wK8SC z49XmmSi*D(sO+FjnSzHhyK0oF>~L1+>Fm=qz?I`I@1gWq$+ER#QB|ICiS#Upl$E%{ zW+b38O(xO-50P+ARP#Mm?0cT40lvoB#+o*@l0~20;p073dBNq+*TA2&L>abE0xJ8g z%%8m;{@`G-#-A$Y&lwtE&nx0tmp0!7ZSIno!loslvXo4lDGzOM09~U^71QQBG{7yZ zKF?5<7hU#z7wp+35r$1jKxN}Hd+zYC2j45y*i*&qd5H$N)nU(&ZqoPWhPjmD=7OH( zv~pc=N%S&EG%E3ijYvRc!!n76JS4(bE;SNWF^OKK0j}&)4QaNfDnD>}^F#1vheQ=N zAOV%#PRQNe>?h#vZbtF3iuarjAFW_F2s>5s6~#viUR8Xo;H!!=X`%Y!K;~G>uhc$< zvuR&doI`p`#d)N!Dvpl4syIUORmFjUR}}{bzN&b8^{Otvn=1ANy{gzBM5&h^YDTe@ z;#EEAsIIarUZK6Jc$M~TD_)X>s%uxgEcvP;9`=@sxY$<}F_2dkv5>DS7CdhQu<-e+ W!mW8#;of{z!DMd(z-T|!#{UABiFzym literal 0 HcmV?d00001 diff --git a/PoshSec.PowerShell.Commands/PoshSec.PowerShell.Commands.v11.suo b/PoshSec.PowerShell.Commands/PoshSec.PowerShell.Commands.v11.suo index 67d0c07d6f1cde7295b202ebb0fdc547243c4ed0..b0b99d9d279d413babdb1d80b15f8d518533d7e9 100644 GIT binary patch delta 5905 zcmc&&eN>az8NW9qAz(ryAX1tD0YSthBoH7dxR?Y%#Q+A;)tt�BiV=Bv=(8)46Wb zRmjt>>&K4O*4B2`soC1O(iyAk*6y5s9na2oPEY^X+U}g4{n4HsI_sIb=XsL|RQc%I zp5C0_d+&YjbMJlcbD!sTZ{EORQQ)d*w32JiRuzeo&b+eugy-;EJdH6HHo_j!9{xH^ zNbBVa6p-*HCTPrB!q0&}u3o+bMM+b{inCaeBPb;T7iX0&!qP&-0)z~414kf@OazUZ zfVc}ma!T=7R>CH6t~eP>FeL6zsKi1Q!U`H$3dnTXn)O(#Lu^1e5cP-#L?dD&!U;U# z<)ElXvCWat_2^rCDayjdxSq8NPLte?b;^aMya^McdU+m-mQ5AEfh%+<1huJ4%=;rM z#g<58P|85rbPJPLqS@4)_2XDf@ z>!CrCo9%VV1n8zQJh zT}z!j4i!j7NeIzrVIq5kp8&t6UQUD&X^J#T$$9rPxVFe4i;uPmot^}L+6X@a6KOXk zKf#73_*}7+mxD&(lwQPoK8MET>q3_cD|ygfDs zd>)i0Efo5TRh{@&w2hSha^NHPyZ4WOp4xKc~IL2aEf6}9LL zASa}q1eeyNqzV~^a#}GwrCkD-txC9}HOWb6k2XT8&Lk!Q)Y%%~Nu5FLBlUM|S{{Jw zdH>W<2nu>mT2KdrZl!mSsEBOSy1XKB7Tp&#U|#(EgZn7 zi>+oIxVhVLbGKvNhtgJj_OStQmMnwI<_vheWE})eda#%r&|KOZ%)X@HbRM9|ge3U% z2@C{>f^(G9xj+qq{23uMa!@3mB3|$$R`w$>fo7`{9R0FTra2rJ`k*q0gTvegjw&rY zw5Ck`8K2#97ofnQf|i_G^?P$@J{`=kDVP$cjJ$XB4I_j?t}=~K=*UeZLb)cVgZs~k z_`nogVpDKpmlze`Dhqfm>|XLGISotkNx882KY%}PB>Qy~(c&qQeaP3Q0#dD&%BlXF zj!MvCHK&sn`7Y&!m@h|Ysqu_;3Hq@?@MBw40hBR6uC>+4D1y33b*e*40x0Q)qg(Sr z|6G&C;mnRv7`;~;{~(Id%5bx4g4@yC>*Z3EP*~x_k)>D#_fJ(xs@Vffpejv-s!$2j z7W5$x-gH`7JKKTJF7&T@Se&*DR>>1(w7A$v5;`^>MuJ-pmkY;(g|)J&^nOQvquW@l z`xp2P8FN;ClM4Js9K2S+L^w{2q=o%?B1XiuHx&XAqXH!>aD7F*LD(%0*L77=1FN<< z8{qr;%J?mB3$6efLj?r%1+d?cK2J^{SIy)J@ag)qYSA3ddW&VVG`W%c>0CWlf~DR9 ztqm&3E*jO)fpcXJ(s>RX893{GxUg~so_Dq0zJNSx~1dYSi?b%HBQKEPj0g!6D4Uv~g{HLQn>aL7{U8o$2tMse zfz$V;Lw2{G^H6oBJ)XYyzMh`e-VWH;xt!0?!4C&I^YHR^$I%+WP^8DB+zdB1)P7@;eqPkTDAKY5(AuXk@q)SwOM@-~xy`XP6q28u*7(M%dM8Y*N7 zSU9}u&7tmb_StC10JQ^YwRBp=5|!z;PC4D`B59X?ZLiNg(AnDV_G+`6-2+}cCaR1^ zy@7t@R+K|*J-&;>(5_@i9@YmBTHw9m-q7h`6NkTLX2wUa>|iX-18r7n zF7+Qo%>H*o%|C$EnU|t}N?Le3oHbO4T{Lfhj+JxJh*H3pqYYX12Sf?C_6O7h<$^`X z;w+tUT-D^la>8_Nr8K9VaujqPP!end#|9VW|KD~AB@e%Y#^|3kM*L1Se3+@4r!l@u zU%A+HgD^5k92x{J?p++U#9utw)gwIt{S&bhYilYPT#K90r%QoudmhPad+tZy+(QgX=Sh9<5`9OIf}pR*Nw06 z-GXMG{@o(au&~%N_;>%Q%{62H^(+Rjq)rU)mKTBLU_g1>XO70@UT9g~5k=|$0GkTw A8UO$Q delta 3293 zcmcImeN0=|6@T|(z<>>g7;uOO384u!e(-F+XKV(mF(x4&<(qtT?qbInY#>Qvaxq7m3p`nJ&P4?96J=1fO6fq2wtb}9iF>)Ff zGum`|WKiaPZ19_s3i3RRrM2mF$l9=qtv`hXWzv=hL{lcx8Tm+2ZWf{dVMG`Z*@$~6 zr`mH6bS$Map+~bBq-zG4(e!3Dpd=U34kOog={m62iRePW?kX#(M|RuUfGfccPTYmO=ZRirK=E+H->?k#jokc3Xk zpey=@296nzku+G;O+oyU29D?_AvvOf&-CruG#o&;L0tz@?nhc0u`d{T*TI-$L>ny+ zxAA7BL`V^gZ9bjYX$G^=&nnh_3GcBs#m14sU3x-eygC>e#mIQW3`@nWTADekJtD!F zX^MOc7ESll{V3>`|GxD&Ax3Hd;_D4yC=hgcC@`;{^-UNnXwy+8G>ED)#mLXnV5wjS zG_8LOrq_9OG<&G+l`(cC%vrFcZ(ZXFS=u;DAYSSL&xKFG`kGNm*}$|BZkL$J$M9}! zD&c&OZju~<#iA)P0b|8&I+_R6^SL;7F>0fzPY{Mk-;^Iz_g?7}u&NG+9juRXIrO&5A$hrq=kQ z|Ka|illwHV4ivWF%@>nzbL6E3CnH+%|%)s=syMceJ&mC zY)vuYqNPHkNItZ9v`xtMA;8cq=+wj9O&RT3CPf(?`lLGdNL9CyGAPDVOhwo2s*T`l zuY!K=ftrTR;C<2q z7aA(k#u?ODZ-d)U_~erMa*}BIlvtI(S}?Gu6Gc8vCN2s-E-MF~%?7EcT|*Cy${?qd z44a`DreRkJvYtai$u6t|>%d^~tT>qFxZ=lv&t;;Kszf}RVpgfbH`K`e&cd&WoK}q- zmf?1-8X&k@RkyUk5q?UaQ#5iAH|=DuIki-m!c)ozGaV+459N_yN#etN1;X1b0`a~*P#3Yto)_a-USgg^;>U%Y;NwNk<#fA5TpBIE8fF^qz+tw(4w6r|JU$wV zMTezPeV5A!2uUPhZ=l_2u^(m8sVJQ@p;0D-P->TI5Iwb3NLWRiy z-nw7OZ$|?fxM9`FTLw$hVEC#8-Ml$RxvC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command Import-Module .\PoshSec.PowerShell.Commands.dll%3b Get-Command | Where-Object { %24_.ModuleName -eq %27PoshSec.PowerShell.Commands%27 } + + ShowAllFiles + \ No newline at end of file diff --git a/PoshSec.PowerShell.Commands/PoshSec.PowerShell.Commands/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache b/PoshSec.PowerShell.Commands/PoshSec.PowerShell.Commands/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache index 98b758640e355d4aa4d7d2b463037cb0c4d0b2a4..928de7d0944616c1ca69e77dc1693dc6e0bc3f7e 100644 GIT binary patch delta 173 zcmZp%IAgJ)oLiui(b+1-CABOyC%+&!HLqlI6}K28e-*0WOl5|XAM#0TuH!qx#T?>cwK-7oHxmFVp&jV}