fzxcp3

fzxcp3 / osx_extract_hash.py

Created September 7, 2021 08:03 — forked from teddziuba/osx_extract_hash.py

Extract a Mac OSX Catalina user's password hash as a hashcat-compatible string

	#!/usr/bin/env python3

	"""
	Mac OSX Catalina User Password Hash Extractor

	Extracts a user's password hash as a hashcat-compatible string.

	Mac OSX Catalina (10.15) uses a salted SHA-512 PBKDF2 for storing user passwords
	(hashcat type 7100), and it's saved in an annoying binary-plist-nested-inside-xml-plist
	format, so previously reported methods for extracting the hash don't work.

fzxcp3 / Get-InjectedThread.ps1

Created February 20, 2019 14:31 — forked from jaredcatkinson/Get-InjectedThread.ps1

Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION