Skip to content

Instantly share code, notes, and snippets.

View ahnospell44's full-sized avatar

Bryan Hoffower ahnospell44

  • Orlando, FL, United States
View GitHub Profile
javascript: (function() {
var scripts = document.getElementsByTagName("script"),
regex = /(?<=(\"|\%27|\`))\/[a-zA-Z0-9_?&=\/\-\#\.]*(?=(\"|\'|\%60))/g;
const results = new Set;
for (var i = 0; i < scripts.length; i++) {
var t = scripts[i].src;
"" != t && fetch(t).then(function(t) {
return t.text()
}).then(function(t) {
var e = t.matchAll(regex);
@LiveOverflow
LiveOverflow / forwarder.py
Created February 17, 2023 15:19
TCP Forwarder
import socket
import select
from logzero import logger
# python forwarder.py localhost:1337 ipinfo.io:80
# curl -v http://localhost.com:1337 -H "Host: ipinfo.io"
# video: https://www.youtube.com/watch?v=32KKwgF67Ho
class Forwarder:
import base64
import re
import xml.dom.minidom
import json
import uuid
import struct
import string
import random
import hashlib
import time
@salaheldinaz
salaheldinaz / defcon29-recon.md
Last active January 12, 2023 00:30
DEFCON29 Recon Village Toots & Resources
@gladiatx0r
gladiatx0r / Workstation-Takeover.md
Last active March 17, 2025 03:05
From RPC to RCE - Workstation Takeover via RBCD and MS-RPChoose-Your-Own-Adventure

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

  • Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
  • Relaying that machine authentication to LDAPS for configuring RBCD
  • RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

uploads/affwp-debug.log
certs/server.key
server.key
.CSV
.PDF
.README.md.bud
.action
.actionScriptProperties
.angular-cli.json
.apport-ignore.xml
#!/usr/bin/env bash
# Script to quickly and easily create non-meterpreter payloads for the OSCP
# @m8sec
# Note: It is recommeneded to create a new directory before running this
# script. All payloads will be placed in the current directory
IP="127.0.0.1" # <YOUR IP HERE>
PORT=443 # You may have to change this if there are outbound restrictions on the target ;)

Hydra

Supported protocols

List1 list2 list3 list4 list5
asterisk icq oracle-listener rexec snmp
cisco imap[s] oracle-sid rlogin socks5
cisco-enable irc pcanywhere rpcap ssh