Chris Farrell seajaysec

Low Hanging Hacker Fruit

This gist focuses on (relatively) free and (relatively) easy things organizations can do to better protect their networks without buying yet another black box with blinking lights.

Got some ideas of your own that should be on this list? Please leave a comment below!

Implementing a stronger AD password policy

Microsoft has a great paper on the topic that gives some nice high level recommendations:

Use a unique password per site
Enable complexity

Ripgrep is a very fast way to search your text based files. The pre flag is a significantly slower way to search a bunch of your other files as well.

The scripts below have been superseded by rgpipe.

TL;DR

Good: rg --pre somescripthere yoursearchtermhere

Better: rg ---pre-glob '*.{comma,seperated,extensions,to,preprocess}' --pre somescripthere yoursearchtermhere

	#!/usr/bin/env python

	import argparse
	import sys
	import string
	import random

	# https://support.microsoft.com/en-au/help/243327/default-limit-to-number-of-workstations-a-user-can-join-to-the-domain
	# create machine account utility by @3xocyte
	# with thanks to Kevin Robertson for https://github.com/Kevin-Robertson/Powermad/blob/master/Powermad.ps1

	#!/usr/bin/python
	import sys, json, urllib, urllib2

	#Define the Bloodhound Database
	url = 'http://bloodhound-server:7474/db/data/cypher/'
	#Define the Bloodhound Credentials
	#echo neo4j:bloodhound \| base64
	base64auth = 'bmVvNGo6Ymxvb2Rob3VuZA=='

	request = urllib2.Request(url)

	#!/usr/bin/env python

	import argparse
	import sys
	import binascii
	import socket
	import re
	from ldap3 import Server, Connection, NTLM, ALL, SUBTREE, ALL_ATTRIBUTES

	# get /etc/hosts entries for domain-joined computers from A and AAAA records (via LDAP/ADIDNS) (@3xocyte)

	0
	1
	11
	12
	13
	14
	15
	16
	17
	2

	from datetime import datetime
	import time
	import threading
	###########################
	from multiprocessing import Process
	import random
	###########################
	import dns.resolver
	import dns.reversename
	import ftplib

	/
	$$$lang-translate.service.js.aspx
	$367-Million-Merger-Blocked.html
	$defaultnav
	${idfwbonavigation}.xml
	$_news.php
	$search2
	£º
	.0
	/0

	#!/usr/bin/env python3
	import secrets
	import sys
	from ldap3 import Server, Connection, ALL, NTLM

	try:
	username = sys.argv[1]
	except IndexError:
	exit('please provide a username: {} <name>'.format(sys.argv[0]))

	#!/bin/bash

	# this script was written by viss as a challenge from @random_robbie
	# This one-liner replaces a fairly lengthy python script
	# if you want to be walked through it, sign up for square cash, send $viss 20 dollars. Otherwise, flex your google fu!
	# oh, ps: you need to pip install shodan, and then configure the shodan cli client by giving it your api key.
	# then you're off to the races.

	shodan search --fields ip_str --limit 1000 'product:"Oracle Weblogic" port:"7001" country:"US"' \| sort -u \| nmap -sT -Pn -n -oG - -iL - -p 7001 \| grep open \| awk '{print $2}' \| xargs -I % -n 1 -P 30 bash -c 'RESULT=`curl -s -I -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko0100101 Firefox/54.0" -H "Connection":"close" -H "Accept-Language":"en-US -H en;q=0.5" -H "Accept":"text/html -H application/xhtml+xml -H application/xml;q=0.9 -H /;q=0.8" -H "Upgrade-Insecure-Requests":"1" %:7001/ws_utc/config.do \| egrep HTTP`; echo "%: $RESULT";'