hadrian3689

import base64
import hashlib
from Crypto.Cipher import AES #pip install pycryptodome

def pwm_cipher():
    #Create a new AES cipher object using AES-128 in ECB mode.
    return AES.new(key=b'0'*16, mode=AES.MODE_ECB)  # Placeholder key, actual key will be set later

def pwm_make_key(key: str) -> bytes:
    #Derive a 16-byte AES key from the given input key.

hadrian3689

# Simple PowerShell process monitor

while($true)
{

  $process = Get-WmiObject Win32_Process | Select-Object CommandLine
  Start-Sleep 1
  $process2 = Get-WmiObject Win32_Process | Select-Object CommandLine
  Compare-Object -ReferenceObject $process -DifferenceObject $process2

hadrian3689

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# PYTHON_ARGCOMPLETE_OK

# Copyright: (c) 2020 Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

"""
Script that can read a Wireshark capture .pcapng for a WinRM exchange and decrypt the messages. Currently only supports
exchanges that were authenticated with NTLM. This is really a POC, a lot of things are missing like NTLMv1 support,

hadrian3689

import hashlib
import hmac
import argparse

#stolen from impacket. Thank you all for your wonderful contributions to the community
try:
    from Cryptodome.Cipher import ARC4
    from Cryptodome.Cipher import DES
    from Cryptodome.Hash import MD4
except Exception: