Neo23x0

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
JAB	🗣 Jabber	$.	Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq	📺 Television	MZ	MZ header
SUVY	🚙 SUV	IEX	PowerShell Invoke Expression
SQBFAF	🐣 Squab favorite	I.E.	PowerShell Invoke Expression (UTF-16)
SQBuAH	🐣 Squab uahhh	I.n.	PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA	💪 "Pah!"	<.	Often used by Emotet (UTF-16)

csandker

PS C:\Users\Clark.Kent\Desktop> ## Unconstrained Delegation
PS C:\Users\Clark.Kent\Desktop> ([adsisearcher]'(userAccountControl:1.2.840.113556.1.4.803:=524288)').FindAll()

Path                                                          Properties
----                                                          ----------
LDAP://CN=DC01,OU=Domain Controllers,DC=MonkeyIsland,DC=local {ridsetreferences, logoncount, codepage, objectcategor...
LDAP://CN=HTTPSvc,CN=Users,DC=MonkeyIsland,DC=local           {givenname, codepage, objectcategory, dscorepropagatio...


PS C:\Users\Clark.Kent\Desktop> ## Constrained Delegation

IAmStoxe

Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\Blob_storage\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\cache\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\IndexedDB\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\databases\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\GPUCache\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\Local Storage\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\tmp\") -Recurse -Force

SMSAgentSoftware

[CmdletBinding()]
Param(
    [switch]$ListAllAvailable,
    [switch]$ExcludePreview,
    [switch]$ExcludeOutofBand
)
$ProgressPreference = 'SilentlyContinue'

Function Get-MyWindowsVersion {
    [CmdletBinding()]

Flangvik

PKI Abuse

Some golden links when you are having issues: https://social.technet.microsoft.com/Forums/windows/en-US/96016a13-9062-4842-b534-203d2f400cae/ca-certificate-request-error-quotdenied-by-policy-module-0x80094800quot-windows-server-2008?forum=winserversecurity

Enumerating ADCS On Linux

Download and install Certi