v1.2.1

What's Changed

Bug Fixes - Post-Exploitation Modules (adtriage.py, sessions.py, shares.py, pwnshell.py)

• !adtriage / !sessions / !shares - [bool]::Parse FormatException (100% failure rate): Template substitution in all three resource loaders was replacing '__QUICK__' (with surrounding single quotes) instead of the inner token __QUICK__, stripping the quotes the .ps1 template already provides. The emitted PowerShell was [bool]::Parse($false) / [bool]::Parse(True) depending on attempt - both are invalid inputs to the CLR static method, which strictly requires "True" or "False" as quoted string literals. Fixed by targeting __QUICK__ (no quotes) in all three loaders so the template's existing single quotes are preserved, producing well-formed [bool]::Parse('True') / [bool]::Parse('False') output. Affected adtriage.py:16, sessions.py:15, shares.py:18.

• !shares - Silent no-op on default invocation (@('') array clobber): When !shares is called without explicit targets, shares.py substituted an empty string into @('__TARGETS__'), producing @('') - a one-element PowerShell array containing an empty string. $Targets.Count evaluated to 1, satisfying the Count -gt 0 branch and bypassing both AD domain controller discovery and local WMI share enumeration entirely - zero output, zero error. Fixed by replacing the entire @('__TARGETS__') expression with @() on the no-target path, correctly producing an empty array and allowing the intended discovery branches to execute. Affected shares.py:18–25, shares.ps1:210.

• !amsi - Silent bypass failure via [ref]$null in VirtualProtect out-parameter: amsi_bypass() passed [ref]$null as the lpflOldProtect out-parameter to VirtualProtect. $null is a read-only automatic variable in PowerShell - the CLR marshaler cannot write the returned uint into it, throwing Cannot set the Value property for a Reference object whose Value is not a variable. As a result, VirtualProtect failed to mark AmsiScanBuffer as writable, the subsequent Marshal::Copy hit a write-protected page, and the bypass silently failed while the shell still printed [+] AMSI bypass applied. Fixed by declaring a typed mutable variable $old = [uint32]0 before each call and passing [ref]$old. Affected pwnshell.py:431–435.

• !netrun - TargetParameterCountException on zero-argument invocation: When !netrun was called with a URL and no trailing arguments, the no-args branch selected EntryPoint.Invoke($null, $null). For any assembly with a standard Main(string[] args) entry point (one parameter), the CLR reflection API requires exactly one argument - passing $null throws System.Reflection.TargetParameterCountException: Parameter count mismatch, aborting execution before the assembly runs. Fixed by dynamically inspecting EntryPoint.GetParameters().Length: zero-parameter entry points use Invoke($null, $null); one-parameter entry points use Invoke($null, [object[]](,[string[]]@())), supplying a valid empty string array. Affected pwnshell.py:494.

Full Changelog: v1.2.0...v1.2.1