Skip to content
This repository has been archived by the owner. It is now read-only.
Permalink
Browse files

Added psr.exe, added function Surveillance

  • Loading branch information...
Oddvar Moe
Oddvar Moe committed Apr 25, 2018
1 parent f3e2157 commit c3c54520e61dba768c20aed76f16b3880af42ac9
Showing with 32 additions and 1 deletion.
  1. +1 −1 Contribute.md
  2. +1 −0 LOLBins.md
  3. +30 −0 OSBinaries/Psr.md
@@ -4,7 +4,7 @@ to send me a tweet and I will add the contribution for you.

## Binary.exe

* Functions: Execute, Download, Copy, Read ADS, Write ADS, UACBypass, Search, Compile, Credentials
* Functions: Execute, Download, Copy, Read ADS, Write ADS, UACBypass, Search, Compile, Credentials, Surveillance

```
Example
@@ -37,6 +37,7 @@ If you are missing from the acknowledgement, please let me know (I did not forge
[Powershell.exe](OSBinaries/Powershell.md)
[Presentationhost.exe](OSBinaries/Presentationhost.md)
[Print.exe](OSBinaries/Print.md)
[Psr.exe](OSBinaries/Psr.md)
[Qprocess.exe](OSBinaries/Qprocess.md)
[Reg.exe](OSBinaries/Reg.md)
[Regedit.exe](OSBinaries/Regedit.md)
@@ -0,0 +1,30 @@
## Psr.exe

* Functions: Surveillance

```
psr.exe /start /gui 0 /output c:\users\user\out.zip
psr.exe /stop
```

Acknowledgements:
*

Code sample:
*

Resources:
* https://www.sans.org/summit-archives/file/summit-archive-1493861893.pdf

Full path:
```
C:\Windows\System32\Psr.exe
C:\Windows\SysWOW64\Psr.exe
```

Notes:
It does not log keystrokes. Only screenshots when something is clicked.



0 comments on commit c3c5452

Please sign in to comment.
You can’t perform that action at this time.