Skip to content

Latest commit

 

History

History
52 lines (35 loc) · 3.12 KB

README.md

File metadata and controls

52 lines (35 loc) · 3.12 KB
Raw

Get-KapeModuleBinaries

Downloads binaries used by KAPE

This script will discover and download all available EXE, ZIP, and PS1 files referenced in KAPE Module files and download them to $Des. Optionally it can be fed a txt file containing URLs to download or used to view the list of binaries to be downloaded. See examples below for usage.

This was created from Eric Zimmerman's Get-ZimmermanTools script. I just modified a few things to have it parse the KAPE module (mkape) files and download binaries.

Rerunning the script will download a new copy of Eric's tools only if a newer version exists. All other tools will be download again even if a newer version is not available. To force Eric's tools to download a new copy, delete the line for that tool in the "!!!RemoteFileDetails.csv" file from the directory specified in the -Dest parameter.

Prerequisites

Installation

Download and extract zip. Set PowerShell execution policy to allow execution of scripts by launching PowerShell as an administrator and running the following:

PS C:\Tools> Set-ExecutionPolicy -executionpolicy bypass

Examples

Example 1

Downloads/extracts and saves binaries and binary details to "C:\Forensic Program Files\Zimmerman\Kape\Modules\Bin" directory.

PS C:\Tools> .\Get-KapeModuleBinaries.ps1 -Dest "C:\Forensic Program Files\Zimmerman\Kape\Modules\Bin" -ModulePath "C:\Forensic Program Files\Zimmerman\Kape\Modules"

Example 2

Scans modules directory for mkape files, extracts URLs and dumps to console. This can be used to create a text file for use with the -UseBinaryList and -BinaryList path parameters or just to verify which tools will be downloaded prior to running .\Get-KapeModuleBinaries.ps1 -Dest -ModulePath ""

PS C:\Tools> .\Get-KapeModuleBinaries.ps1 -ModulePath "C:\Forensic Program Files\Zimmerman\Kape\Modules" -CreateBinaryList

Example 3

Downloads/extracts and saves binaries and binary details for files specified in C:\tools\binarylist.txt to C:\Forensic Program Files\Zimmerman\Kape\Modules\Bin directory.

PS C:\Tools> .\Get-KapeModuleBinaries.ps1 -Dest "C:\Forensic Program Files\Zimmerman\Kape\Modules\Bin" -UseBinaryList -BinaryListPath C:\tools\binarylist.txt

Change log

  • 10/2/19

    • Updated script to support new module sub-folder paths (thanks @mattnotmax)
    • Added check for illegal file name charcters prior to saving files
    • Fixed path typo in examples

  • 7/5/19

    • Modified path files are extracted to for more consistency with KAPE module paths
    • Added -CreateBinary list parameter to dump list of URLs avaialble to donwload to console
    • Added -UseBinaryList and -BinaryList parameters to provide greater control over which binaries are donwloaded
    • Added Example_BinaryList.txt as an example of format of files used by -UseBinaryList and -BinaryList parameters
    • Added additional error handling
    • Removed 7Zip dependency- Now uses Expand-Archive cmdlet instead of 7zip to extract files