NtApiDotNet 1.1.13
See the version list below for details.
dotnet add package NtApiDotNet --version 1.1.13
NuGet\Install-Package NtApiDotNet -Version 1.1.13
<PackageReference Include="NtApiDotNet" Version="1.1.13" />
paket add NtApiDotNet --version 1.1.13
#r "nuget: NtApiDotNet, 1.1.13"
// Install NtApiDotNet as a Cake Addin #addin nuget:?package=NtApiDotNet&version=1.1.13 // Install NtApiDotNet as a Cake Tool #tool nuget:?package=NtApiDotNet&version=1.1.13
A .NET class library to access native NT API system calls
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET Framework | net45 is compatible. net451 was computed. net452 was computed. net46 was computed. net461 was computed. net462 was computed. net463 was computed. net47 was computed. net471 was computed. net472 was computed. net48 was computed. net481 was computed. |
This package has no dependencies.
NuGet packages (1)
Showing the top 1 NuGet packages that depend on NtApiDotNet:
| Package | Downloads |
|---|---|
|
NtApiDotNet.Forms
A .NET class library to access native NT API system calls |
GitHub repositories (11)
Showing the top 5 popular GitHub repositories that depend on NtApiDotNet:
| Repository | Stars |
|---|---|
|
CCob/SweetPotato
Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019
|
|
|
CCob/BeaconEye
Hunts out CobaltStrike beacons and logs operator command output
|
|
|
lowleveldesign/wtrace
Command line tracing tool for Windows, based on ETW.
|
|
|
cyberark/RPCMon
RPC Monitor tool based on Event Tracing for Windows
|
|
|
CCob/okta-terrify
Okta Verify and Okta FastPass Abuse Tool
|
| Version | Downloads | Last updated |
|---|---|---|
| 1.1.33 | 5,753 | 1/22/2022 |
| 1.1.32 | 6,730 | 8/18/2021 |
| 1.1.31 | 2,330 | 3/16/2021 |
| 1.1.30 | 641 | 1/15/2021 |
| 1.1.29 | 1,343 | 11/23/2020 |
| 1.1.28 | 3,613 | 6/30/2020 |
| 1.1.27 | 3,094 | 2/10/2020 |
| 1.1.26 | 949 | 1/21/2020 |
| 1.1.25 | 710 | 1/2/2020 |
| 1.1.24 | 732 | 12/10/2019 |
| 1.1.23 | 923 | 10/18/2019 |
| 1.1.22 | 2,208 | 4/30/2019 |
| 1.1.21 | 1,326 | 4/23/2019 |
| 1.1.20 | 1,020 | 3/9/2019 |
| 1.1.19 | 2,032 | 2/4/2019 |
| 1.1.18.1 | 737 | 2/4/2019 |
| 1.1.18 | 694 | 2/4/2019 |
| 1.1.17 | 2,304 | 9/9/2018 |
| 1.1.16 | 1,225 | 8/1/2018 |
| 1.1.15 | 1,238 | 6/18/2018 |
| 1.1.14 | 1,295 | 5/1/2018 |
| 1.1.13 | 1,137 | 4/4/2018 |
| 1.1.12 | 1,319 | 3/19/2018 |
| 1.1.11 | 1,164 | 3/4/2018 |
| 1.1.10 | 1,509 | 3/1/2018 |
| 1.1.9 | 1,571 | 2/22/2018 |
| 1.1.8 | 1,315 | 2/6/2018 |
| 1.1.7 | 1,710 | 1/11/2018 |
| 1.1.6 | 1,061 | 12/3/2017 |
| 1.1.5 | 1,055 | 11/23/2017 |
| 1.1.4 | 1,136 | 11/14/2017 |
| 1.1.3 | 1,256 | 11/5/2017 |
| 1.1.2 | 1,359 | 10/11/2017 |
| 1.1.1 | 1,203 | 8/30/2017 |
| 1.1.0 | 954 | 8/30/2017 |
| 1.0.9 | 994 | 8/19/2017 |
| 1.0.8 | 1,108 | 8/7/2017 |
| 1.0.7 | 1,072 | 6/14/2017 |
| 1.0.4 | 1,039 | 5/17/2017 |
1.1.13
------
* Fixed bug in Get-NtToken for sandboxed tokens.
* Extended support for Job objects.
* Added Set-NtFileReparsePoint cmdlet.
* Added support for viewing a file with Show-NtSection
* Added support for DuplicateTo methods from rosalie.lecart.
* Improved support for Win32 Desktop and WindowStation objects.
* ScriptBlock support for the $_ argument.
* Added SID -> Name cache to improve performance.
* Fixed user marshallers in NDR for Windows 7.
* Added internal security descriptor viewer control.
1.1.12
------
* Added basic NDR parser.
* Added basic symbol resolver.
* Added method to read a security descriptor from another process.
* Improved process memory read and writing methods.
* Added virtual memory cmdlets to allocate, release and modify memory.
* Added Get-EmbeddedAuthenticodeSignature function.
* Added Get and Set NtSecurityDescriptor functions.
* Added ProcessTrustLabel to basic security information set.
* Added Get-NtFileChild cmdlet.
* Added Get-NtKeyChild cmdlet.
* Added Get-NtDirectoryChild cmdlet.
* Added name lookup to NtIoControlCode.
* Added NtNamedPipeFile type with implementations of basic pipe functions.
* Added ADd-DosDevice and Remove-DosDevice cmdlets.
* Added file directory and stream visitors.
* Merged Get-NtLowBoxToken and Get-NtFilteredToken into Get-NtToken.
* Modified Show-NtSection to also display an arbitrary byte array.
* Added an Invoke-NtToken cmdlet to run a script block under impersonation.
* Added Remove-NtFile cmdlet.
* Added case sensitive property for RS4.
* Added flags for NtCreateDirectoryObjectEx.
* Added pseudo option to Get-NtToken.
* Improved conditional ACE support.
1.1.11
------
* Improved New-NtToken including adding missing IL
* Added new NTSTATUS codes from 1709
* Changes to native process creation
* Added OverrideChildProcessCreation for Win32 process
* Added display of process trust labels from tokens.
* Fixed IsChildProcessRestricted on 1709 and above (changed structure)
* Fixed named pipe server in TokenViewer
* Added -All parameter to Show-NtToken to display list of tokens.
1.1.10
------
* Added support for extended handle information to allow for PIDs > 64k.
* Added basic New-NtToken cmdlet and system call.
* Added Resolve-NtObjectAdddress cmdlet to resolve the addresses of a list of objects.
* Added generic object ReOpen method.
* Added vistor method to object directories to enumerate recursively with a callback.
* Added display of process trust labels.
1.1.9
-----
* Fix for bug when querying extended process information on Windows 7/8.
* Add OneDrive file attributes from thierry.franzetti.
* Added support for displaying child AppContainer names.
* Various improvements to section editor including integer data inspectors.
1.1.8
-----
* Better support for relative paths in the cmdlets including supporting ones based on the current directory.
* RenameEx and DispositionEx support from fllombard.
* Added Key value deletion and fixes from rsiestrunck.
* Fixed bug in NtOpenSession prototype.
* Added support for adding additional groups to a token in Get-NtToken if user has SeTcbPrivilege.
* Added Show-NtToken to display a token in the GUI, renamed old whois style token viewer to Show-NtTokenEffective.
* Added PowerShell functions to get and create execution alias reparse points.
* Added section viewer and editor with Show-NtSection function.
1.1.7
-----
* Added projects to build NtObjectManager for PowerShell Core 6.0
* Added additional techniques to open process tokens in access checking cmdlets.
* Fixed issues with Add-NtKey and added Remove-NtKey cmdlets.
* Minor fixes from fllombard
* Added change notify key with asynchronous support
* Added kernel LUID allocation
1.1.6
-----
* Added support for child process policy and desktop app policy to Win32ProcessConfig.
* Added new mitigation options from Win10 1709.
* Fix a couple of crashes.
1.1.5
-----
* Fixed crash on 32 bit Windows when enumerating NT types.
* Merged ManagedHandleUtils assembly into main NtApiDotNet under the Win32 namespace.
1.1.4
-----
* Added Show-NtSecurityDescriptor function.
* Added support for modifying security descriptors in the UI.
* Cleanup of access mask when being displayed in the UI.
* Added opaque reparse buffer.
1.1.3
-----
* Added Show-NtToken function.
* Added basic version checking for certain functions which can't be accessed on Windows 7.
* Fixed referenced System.Management.Automation assembly version to run properly with no PS2.
* Fixed some bugs in token structures which preventing being used with multiple values.
* Added support to Win32Process for LPAC.
1.1.2
-----
* Added Get-AccessibleHandle cmdlet.
* Support for oplock levels.
* Added support to set inherit and protect on close flags to objects.
* Added Get-NtFilePath function.
1.1.1
-----
* Fix to native protected process creation.
* Added functions to create native NT processes.
1.1.0
-----
* Removed check tools, excluding CheckNetworkAccess.
* Added basic Job object cmdlets.
* Added creation of protected processes in Win32Process.
* Added service access checking cmdlet.
* Added get executable manifest cmdlet.
1.0.9
-----
* Made New-Win32Process more generic and added support for Win32k filter enable.
* Added function to capture token from a process using impersonation.
* Added basic support for Desktop and WindowStation objects using Win32u.dll exports.
* Added file locking implementation including async.
* Added hardlink enumeration.
* Added NTFS stream enumeration.
* Deprecated most of the old standalone utilities in favour of PS cmdlets.
1.0.8
-----
* Added cmdlets to create a kernel memory dump, system environment and licensing.
* Additional system calls implemented.
* Added access to secure boot policies and code integrity policies.
* Made Win32 Process creation more generic and added cmdlet.
* Added access check by type including SELF SID.
1.0.7
-----
* Added new cmdlets to do access checking. Many of the old standalone utilities are now deprecated.
* Added cmdlets to create lowbox tokens
* Added list of known capability SIDs and resolve them during name lookup
* Added cmdlet to get a SID
* Added cmdlet to do a standalone access checking
* Reworked the APIs to include non-throwing versions of many of the core Open/Create methods.
* Made NtType more inspectable, includes access enumeration and rationalizes the opening methods.
* Various additional properties such as extended process flags, checking for LPAC
* Rework of access mask handling. Now all low-level APIs use an AccessMask structure which has
conversion operators to and from other enumerations.
* Various other bug fixes.
1.0.6
-----
* Added cmdlet to filter a Token object.
* Cleanups to various components to make them easier to use from PS
1.0.5
-----
* Added additional Known SIDs
* Unified the variant Get-NtToken* cmdlets into one.
* Added additional token cmdlets such as Logon and Clipboard.
* Added initial support for IO Completion Ports
* Added object creation time property
* Added support to set a process device map
* Added top level CanSynchronize property to NtObject
* Bugs fixes from Rustam Agametov
* Made process list in token viewer a list rather than a tree and made a separate handle tab.
1.0.4
-----
* First NUGET release.