powershellmafia/powersploit

How powershellmafia/powersploit works

PowerSploit is a PowerShell penetration-testing toolkit; the README describes capabilities across execution, script modification, persistence, exfiltration, reconnaissance, and other phases. This tree is only a native-code subset, so the graph emphasizes the demonstrated reflective-loading examples and NTFS file-reading path, plus the listed logon-token component. Source excerpts do not establish how the logon programs connect or how the broader PowerShell commands are implemented; those links are omitted.

Main entry points: NTFSParser.cpp Parser harness · NTFSParserDLL.cpp Parser DLL API · LogonUser.cpp Logon token tool · DemoDLL.cpp Demo DLL

Components 17

Reflective PE examples

Reflective PE injection
Demo DLL CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL/DemoDLL/DemoDLL.cpp
Remote DLL demo CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoDLL_RemoteProcess/DemoDLL_RemoteProcess/dllmain.cpp
Demo executables CodeExecution/Invoke-ReflectivePEInjection_Resources/DemoExe
Injection target demo CodeExecution/Invoke-ReflectivePEInjection_Resources/ExeToInjectInTo/ExeToInjectInTo/ExeToInjectInTo.cpp

NTFS file access

Raw NTFS file copy
Parser harness Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp
Parser DLL API Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp
Copied output file

NTFS parsing internals

Volume access Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h
File records Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h
NTFS attributes Exfiltration/NTFSParser/NTFSParser/NTFS_Attribute.h
DLL file records Exfiltration/NTFSParser/NTFSParserDLL/NTFS_FileRecord.h
DLL attributes Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Attribute.h

Logon components

Logon token tool Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp
Logon support DLL Exfiltration/LogonUser/LogonUser/logon/logon.cpp

Other components

PowerShell operator

Connections 12

PowerShell operator → Reflective PE injection: invokes README.md
Reflective PE injection → Demo DLL: loads example README.md
Reflective PE injection → Remote DLL demo: injects example README.md
Parser harness → Parser DLL API: loads and calls Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp
Parser harness → Copied output file: writes bytes Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp
Parser DLL API → Volume access: opens volume Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp
Parser DLL API → DLL file records: parses records Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp
Parser DLL API → DLL attributes: reads stream Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp
Parser harness → File records: includes parser types Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp
Parser harness → NTFS attributes: includes parser types Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp
Raw NTFS file copy → Parser harness: uses parser README.md
Logon token tool → Logon support DLL

More PowerShell diagrams: sycnex/windows10debloater · yerongai/office-tool · actions/runner-images · microsoft/sql-server-samples · specterops/bloodhound-legacy

Drawn by GitDiagram on November 9, 2026 from the repository's file tree, README and source files. Read as Markdown ·