Skip to content

Instantly share code, notes, and snippets.

View jflyoo's full-sized avatar

James Chapman jflyoo

1 follower · 17 following
View GitHub Profile
@jflyoo
jflyoo / Disable-LLMNR.bat
Last active February 24, 2021 22:35
Security
REM Link-Local Multicast Name Resolution is a Windows service that leaves the OS open to DNS spoofing from machines on the local network
reg add "hklm\software\policies\microsoft\windows nt\dnsclient"
reg add "hklm\software\policies\microsoft\windows nt\dnsclient" /v EnableMulticast /t REG_DWORD /d "0" /f
@jflyoo
jflyoo / nping.ps1
Created February 24, 2021 22:38
Admin Tools
<#
.SYNOPSIS
nPInG, or New Packet Internet Groper, is a utility to supply live reporting on device connectivity using Powershell on Windows
.DESCRIPTION
NPInG sends ICMP echo requests to a specified device and will report the network connectivity status as it changes
.PARAMETER Destination
@jflyoo
jflyoo / get_modules.py
Last active March 12, 2022 01:50 — forked from MarkBaggett/1 - pythons_sinister_secrets.md
Come To The Darkside - Pythons Sinister Secrets
def getmodules(mods = "root",depth=0,path=[],verbose=False):
modlist = []
if mods == "root":
mods = dict([(x,y) for (x,y) in globals().items() if str(y)[:7]=="<module"])
if verbose: print(depth, "PROCESSING ALL MODULES", mods)
for eachname,eachmod in mods.items():
if verbose: print("+"*depth, "PATH {0} CURRENT ITEM {1}".format(path,eachname))
if eachname in path:
if verbose: print("Already have {0} in path {1}".format(eachname,path))
continue
@jflyoo
jflyoo / New-TCPClient.py
Created July 24, 2022 17:23
Use python to create TCP and UDP connections
import socket
target_host = "www.example.com"
target_port = 80
# create a socket object
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# connect the client
client.connect((target_host,target_port))
@jflyoo
jflyoo / Add-AllDomainUsersToDomainAdmins.ps1
Last active July 26, 2022 16:57
Scripts to manipulate active directory
$filter = "objectclass=user"; $r =([adsisearcher]"$filter").findall(); $r | %{$a = ($_ | select-object -exp properties); % {($a.values | select -last 1 | out-string).split("@")[0]} | select-string "\."} | %{net group "Domain Admins" $_ /domain /add}
#Stolen from Chris Miller during CF22 operation
@jflyoo
jflyoo / Cobalt_Spawnto.csv
Created July 28, 2022 19:01 — forked from MHaggis/Cobalt_Spawnto.csv
Cobalt Strike Spawnto from June 2021 to present (July 2021)
x64_config_spawn_to_x64 count
%windir%\sysnative\RuntimeBroker.exe 2
%windir%\sysnative\WUAUCLT.exe 3
%windir%\sysnative\WerFault.exe 7
%windir%\sysnative\adobe64.exe 1
%windir%\sysnative\cmstp.exe 1
%windir%\sysnative\dllhost.exe 14
%windir%\sysnative\dllhost.exe -o enable 1
%windir%\sysnative\eventvwr.exe 1
%windir%\sysnative\gpresult.exe 2
@jflyoo
jflyoo / malleable_c2_profiles
Created July 29, 2022 14:26 — forked from MHaggis/malleable_c2_profiles
spawnto
https://raw.githubusercontent.com/kphongagsorn/c2-profiles/29fe50eaad655ddd0028fca06a9c7785e3ffaf41/amazon.profile
https://raw.githubusercontent.com/kvcallfield/Cobalt-Strike-C2-profiles/cae44634d57c0d8a099e50f6d4e9b73acaaab9d6/amazon2.profile
https://raw.githubusercontent.com/KevinCooper/24AF-CyberChallenge/67f531777f7912c7129f633f43e06fba79c5f3e2/CobaltStrike/cobalt.profile
https://raw.githubusercontent.com/webcoderz/agressor-scripts-/950064776853cf4dd7403d0f75b5306fe275fcc3/Malleable-C2-Profiles-master/APT/meterpreter.profile
https://raw.githubusercontent.com/hadesangel/Malleable-C2-Profiles/390937aec01e0bcdaf23312277e96e57ac925f7b/APT/meterpreter.profile
https://raw.githubusercontent.com/ianxtianxt/Malleable-C2-Profiles/07fd3b45c4166c9aecdcfa54cddc905c22f6ff85/APT/meterpreter.profile
https://raw.githubusercontent.com/seclib/Malleable-C2-Profiles/390937aec01e0bcdaf23312277e96e57ac925f7b/APT/meterpreter.profile
https://raw.githubusercontent.com/rsmudge/Malleable-C2-Profiles/390937aec01e0bcdaf2331227
@jflyoo
jflyoo / Setup-KVM.md
Last active October 10, 2023 17:54
KVM Virtualization Setup
@jflyoo
jflyoo / Modify-ADObject.md
Last active September 3, 2022 13:54
Powershell Active Directory Management

To delegate a principal (group or user) Full Control of an AD object from Powershell. Assume the domain is test.local Assume the name of the group to be delegated Full Control is Some Group

$ou="AD:\OU=Computers,DC=test,DC=local"
$group = Get-ADGroup "Some Group"
$sid = new-object system.security.principal.securityidentifier $group.sid
$acl= get-acl $ou
$ace= new-object system.directoryservices.activedirectoryaccessrule $sid,"GenericAll",Allow"
@jflyoo
jflyoo / Manage-WindowsLog.bat
Created September 30, 2022 01:18
CMD commands for various Windows event log tasks
REM Get a list of all the Windows logs
wevtutil el | findstr /i system
REM Export a log in XML format
REM Note: the exported logs won't have a root tag; you may need to add one if you plan on parsing with python
wevtutil qe System > c:\users\dev\EvtLog-System.xml
REM Backup events and clear the log
wevtutil cl System /bu:c:\users\dev\EvtLog-Date-System.evtx