RedRabbit

RedRabbit About RedRabbit is a PowerShell script aimed at helping pentesters conduct ethical hacking RedTeam. The aim is to highlight just how Powerful PowerShell is and how it can be used against you Ethically. To Run You can either run locally by downloading the script or run remotely using:...

Get-log4j-Windows.ps1

Get-log4j-Windows.ps1 Identify all log4j components across all windows servers, entire domain, can be multi domain. CVE-2021-44228 Will scale to 1,000+ windows servers, 250+ servers at a time. 1k servers took about 1 1/2 hours. Apache log4j CVE-2021-44228 Single Server Version: Single Server...

ADModule

ADModule Microsoft signed DLL for the ActiveDirectory PowerShell module Just a backup for the Microsoft's ActiveDirectory PowerShell module from Server 2016 with RSAT and module installed. The DLL is usually found at this path:...

SessionGopher

Copyright 2017 FireEye, created by Brandon Arvanaghi @arvanaghi Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by...

PowerExfil

PowerExfil A collection of custom data exfiltration scripts for Red Team assessments. ExfilCards.ps1 - This script will exfil credit card numbers via base64 encoded strings to a custom DNS server. ExfilDataStreamDNS.ps1 - This script will exfil the entire contents of a file via base64 encoded...

ForceAdmin

💪 ForceAdmin 💪 ForceAdmin is a c payload builder, creating infinate UAC pop-ups until the user allows the program to be ran. The inputted commands are ran via powershell calling cmd.exe and should be using the batch syntax. This attack will force them to run as admin using the old fasioned...

nishang

Nishang Nishang — это фреймворк и коллекция скриптов и полезных нагрузок, которые позволяют использовать PowerShell для наступательной безопасности, пентеста и red teaming. Nishang полезен на всех этапах пентеста. Автор: Nikhil Mittal Основатель Altered Security — Hands-on red team and enterprise...

Invoke-SelfSignedWebRequest

Invoke-SelfSignedWebRequest For InfoSec work, using HTTPS is an incredibly handy mechanism for C2 and maneuver within target network space. Further PowerShell is an amazing productivity tool that can help an operator achieve dynamic results. A natural next conclusion is to combine the C2 channel...

CitrixADC-CVE-2020-8300

Detect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020-8300 using Citrix ADC NITRO API EXAMPLE & '.\CitrixADC-CVE-2020-8300.ps1' -NSIPProtocol http -NSIP 10.10.10.10 -user nitro -pass "SshhhItsASecret" If this proves useful to anyone I will develop further with the...

Tater

Tater Tater is a PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit. Credit All credit goes to @breenmachine, @foxglovesec, Google Project Zero, and anyone else that helped work out the details for this exploit. Potato - https://github.com/foxglovesec/Potato Included...

Invoke-Stealth

Invoke-Stealth is a Simple & Powerful PowerShell Script Obfuscator. This tool helps you to automate the obfuscation process of any script written in PowerShell with different techniques. You can use any of them separately, together or all of them sequentially with ease, from Windows or Linux...

Shell3er

Shell3er Shell3er PowerShell Reverse Shell The Shell3er Reverse Features Get-RandomProcessName Function The Get-RandomProcessName function generates a random process name by concatenating "PS" with a new GUID. This is used to create unique and seemingly random process names, making it harder to...

proxynotshell-IOC-Checker

proxynotshell-IOC-Checker Powershell script used to check for IOC's for CVE-2022-41040 and CVE-2022-41082 based on community research and Microsoft: GTESC The Sec Master Double Puslar Microsoft Security Resource Center Microsoft Security Blog The script may be updated to include more IOC's as mor...

PowerMeta

PowerMeta PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches. It then allows for the download of those files from the target domain. After retrieving the files, the metadata associated with them c...

Get-log4j-Windows-local

Get-log4j-Windows-local.ps1 Identify all log4j components on a single local windows servers. CVE-2021-44228. A single use copy - see https://github.com/KeysAU/Get-log4j-Windows.ps1 for multi computer. Apache log4j CVE-2021-44228 Script Running: Export: Columns A - I: Continued: Description: Local...

CmdLineSpoofer

Command Line Spoofer An example of using C to inject a meterpreter shell, whilst spoofing the command line. The command line is stored in the Process Environment Block, is logged when a new process starts, and is displayed in tools such as Process Hacker and Task Manager. Introduction This code i...

CVE-2013-3900-Remediation-Script

CVE-2013-3900 Remediation Script Define registry paths for both 32-bit and 64-bit configurations $regPaths = @ "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config", "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" Function to add or update the registry key function...

antivmdetection

Antivmdetection Background A script to help you create templates, which you can use with VirtualBox to make VM detection harder. My first post on the subject was in 2012 and have after that been updated at random times. The blog format might have not been the best way of publishing the informatio...

ibombshell

ibombshell - Dynamic Remote Shell ,--.!, / -- / / / // / / / / ,d08b. '| / / / / / \ / / / / / 0088MM / / // / // / / / / / / // // / / / / / / / 9MMP' ///// // //./// ///// + Starting the console... Console ready! ibombshell is a tool written in Powershell that allows you to have a prompt...

DET

DET extensible Data Exfiltration Toolkit DET is provided AS IS, is a proof of concept to perform Data Exfiltration using either single or multiple channels at the same time. This is a Proof of Concept aimed at identifying possible DLP failures. This should never be used to exfiltrate sensitive/li...