Neo23x0

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
JAB	🗣 Jabber	$.	Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq	📺 Television	MZ	MZ header
SUVY	🚙 SUV	IEX	PowerShell Invoke Expression
SQBFAF	🐣 Squab favorite	I.E.	PowerShell Invoke Expression (UTF-16)
SQBuAH	🐣 Squab uahhh	I.n.	PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA	💪 "Pah!"	<.	Often used by Emotet (UTF-16)

azet

# long running queries:
SELECT
  pid,
  now() - pg_stat_activity.query_start AS duration,
  query,
  state
FROM pg_stat_activity
WHERE (now() - pg_stat_activity.query_start) > interval '5 minutes';

## active queries and killing them:

TarlogicSecurity

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Krazybug

#!/usr/bin/env python3

'''
calisuck: index, filter-out smartly and download ebooks from Calibre open directories

Installation:

    You need python 3.5 installed

    Download the file as a zip and unzip-it and get into the dir

Krazybug

'''
O'Meirrcy !!!! Download free ebooks from O'Reilly

Usage:
> git clone  https://gist.github.com/Krazybug/1ae50814d25b0a1d862dfdf7161ee503
> mv 1ae50814d25b0a1d862dfdf7161ee503 omercy
> cd omercy
> pip install requests
> pip install bs4
> python omercy.py

chunter

To make Pageant automatically run and load keys at startup:

- Find the location of pageant.exe

- Windows key + R to open the 'run' dialog box

- Type: 'shell:startup' in the dialog box

- Create a shortcut to the pageant.exe and put into this startup folder.

noopkat

⚠️ this is now stupidly out of date

Computers

• 13" Macbook Pro 3.3 GHz i7 (late 2016)
• Microsoft Surface Book (2016)

Peripherals

• Dell up3216q 32" monitor

angel333

#!/bin/bash

#
# Certbot hook for Hurricane Electric DNS service
#
# Usage:
#
# Renew all certificates:
# HE_SESSID=<session_id> certbot renew \
#   --preferred-challenges dns \

rain-1

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

• Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
• Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
• Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
• Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
• Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

troyfontaine

Resize root partition (or how to remove the default /home partition) on CentOS 7 online

This process requires that you are able to ssh OR log in locally using the root user account and that no services be running as users out of /home on the target machine.

The examples are from a default installation with no customization-you NEED to know what you're working with for volumes/partitions to not horribly break things.

By default, CentOS 7 uses XFS for the file system and Logical Volume Manager (LVM), creating 3 partitions: /,/home and swap.

NOTE: If you want to be sure that nothing is writing to /home you can either modify the host to boot into single-user mode OR try to use the systemctl isolate runlevel1.target command to switch (not tested! should work).