This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
javascript: (function() { | |
var scripts = document.getElementsByTagName("script"), | |
regex = /(?<=(\"|\%27|\`))\/[a-zA-Z0-9_?&=\/\-\#\.]*(?=(\"|\'|\%60))/g; | |
const results = new Set; | |
for (var i = 0; i < scripts.length; i++) { | |
var t = scripts[i].src; | |
"" != t && fetch(t).then(function(t) { | |
return t.text() | |
}).then(function(t) { | |
var e = t.matchAll(regex); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import socket | |
import select | |
from logzero import logger | |
# python forwarder.py localhost:1337 ipinfo.io:80 | |
# curl -v http://localhost.com:1337 -H "Host: ipinfo.io" | |
# video: https://www.youtube.com/watch?v=32KKwgF67Ho | |
class Forwarder: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import base64 | |
import re | |
import xml.dom.minidom | |
import json | |
import uuid | |
import struct | |
import string | |
import random | |
import hashlib | |
import time |
Talks videos 🎬 Watch here
- Acquisitions https://acquiredby.co/apple-acquisitions/
In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;
- Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
- Relaying that machine authentication to LDAPS for configuring RBCD
- RBCD takeover
The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2fd6cemt4gmccflhm6imvdfvli3nf7zn6rfrwpsy7uhxrgbypvwf5fad.onion <-- ExcavaTOR (one of my favorite search engines) | |
tor66sewebgixwhcqfnp5inzp5x5uohhdy3kvtnyfxc2e5mxiuh34iid.onion <- Tor66 fairly decent search engine gives good results but not the best | |
3bbad7fauom4d6sgppalyqddsqbf5u5p56b5k5uk2zxsy3d6ey2jobad.onion <-- OnionLand search engine (gives very good results) | |
xmh57jrknzkhv6y3ls3ubitzfqnkrwxhopf5aygthi7d6rplyvk3noyd.onion <- TORCH one of the oldest search engines around on TOR | |
kx5thpx2olielkihfyo4jgjqfb7zx7wxr3sd4xzt26ochei4m6f7tayd.onion <-- Imperial Library of Trantor (good place to find free Ebooks) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
uploads/affwp-debug.log | |
certs/server.key | |
server.key | |
.CSV | |
.README.md.bud | |
.action | |
.actionScriptProperties | |
.angular-cli.json | |
.apport-ignore.xml |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env bash | |
# Script to quickly and easily create non-meterpreter payloads for the OSCP | |
# @m8sec | |
# Note: It is recommeneded to create a new directory before running this | |
# script. All payloads will be placed in the current directory | |
IP="127.0.0.1" # <YOUR IP HERE> | |
PORT=443 # You may have to change this if there are outbound restrictions on the target ;) |
NewerOlder