4154 matches found
chalumeau
Chalumeau Chalumeau est un outil automatisé, extensible et personnalisable de collecte d'identifiants basé sur powershell et python. Fonctionnalités principales Écrivez vos propres payloads Exécution en mémoire Extraire une liste de mots de passe Rapports sur tableau de bord / Interface web Analy...
Sitecore.Solr-log4j-mitigation
Sitecore.Solr-log4j-mitigation CVE-2021-44228 Этот репозиторий содержит скрипт, который вы можете запустить на своей Windows машине для смягчения последствий CVE-2021-44228, применяя рекомендации, описанные на https://solr.apache.org/security.htmlapache-solr-affected-by-apache-log4j-cve-2021-4422...
CVE-2020-1350
CVE-2020-1350 Scanner and Mitigator for CVE 2020-1350 How to run: 1- Run as Administrator windows commandline. 2- powershell -ExecutionPolicy Bypass -File CVE-2020-1350.ps1...
powershell-reverse-tcp
PowerShell Reverse TCP Scripts PowerShell pour communiquer avec un hôte distant. L'hôte distant aura un contrôle total sur le client et toutes les commandes système sous-jacentes. Consultez les shells basés sur : la commande PowerShell Invoke-Expression ici, les process pipes ici. Testé avec...
OffensiveDLR
OffensiveDLR Toolbox containing research notes & PoC code for weaponizing .NET's DLR Contents Script| Description ---|--- Kukulkan| A slimmed down version of SILENTTRINITY, C DLL & EXE that embed an IPY engine. Comms are encrypted and can be used with CobaltStrike Invoke-JumpScare.ps1| Executes...
powerob
Powerob Un obfuscateur de scripts PowerShell à la volée destiné aux engagements d'équipe rouge. Construit par nécessité. Cela n'obfusque que les fonctions et supprime les commentaires trouvés dans les scripts PowerShell. La feuille de route inclut l'obfuscation des variables. Les pull requests et...
WMImplant
WMImplant WMImplant is a PowerShell based tool that leverages WMI to both perform actions against targeted machines, but also as the C2 channel for issuing commands and receiving results. WMImplant will likely require local administrator permissions on the targeted machine. Developed by...
quick-fix-cve-2024-38063
quick-fix-cve-2024-38063 quick powershell script to fix cve-2024-38063 Donation if you want to support my works, you can donate me at the following monero address: 4B9WQivaHfd3miDfPKEfCianocGpBx9d8FXycz2vmNW3aBDVKHgkBd9Gmapt4RBVEpTwnehujsiUBBehUiLvnEHs7VFstCC Or using PayPal:...
gundog
gundog gundog - Chasse guidée basée sur PowerShell dans Microsoft 365 Defender Gundog vous offre une chasse guidée dans Microsoft 365 Defender. Particulièrement sinon uniquement pour les alertes par e-mail et les alertes de point de terminaison pour l'instant. Fonctionnalités Vous fournissez un...
BadBlood
BadBlood BadBlood de Secframe remplit un domaine Microsoft Active Directory avec une structure et des milliers d'objets. Le résultat de l'outil est un domaine similaire à un domaine du monde réel. Après l'exécution de BadBlood sur un domaine, les analystes et ingénieurs en sécurité peuvent...
UpdateWindowsRE-CVE-2022-41099
Overview Forked from u/InternetStranger4You with some considerable changes. Layout Code is split between two modules: Microsoft.Windows.PSGeneral Wrapper code for DISM and ReAgentC Extended tests for pending reboot Automatic resizing/rebuilding of Windows RE partition Microsoft.Windows.PSMitSec...
Microsoft-2024-December-Update-Control
Windows December 2024 Security Patches Audit Script This PowerShell script checks whether the required KB updates for specific security vulnerabilities CVE-2024-49124, CVE-2024-49117, CVE-2024-49118, and CVE-2024-49122 announced in the December 2024 Microsoft security bulletins are installed on...
xencrypt
Xencrypt Crypter PowerShell v 1.0 Auteurs Xentropy @SamuelAnttila SecForce @SECFORCELTD Si vous voulez en savoir plus sur la conception de cet outil et comment fabriquer votre propre crypter, j'ai écrit un article à ce sujet ici : Écrire un crypter dans n'importe quel langage Remarque Ne soyez pa...
SOC335-CVE-2024-49138-Exploitation-Detected
Privilege Escalation Case - SOC335-CVE-2024-49138-Exploitation-Detected Alert Overview Affected Hostname: Victor Triggering Process: scohost.exe Parent Process: C:\Windows\System32\WINDOWSPOWERSHELL\V1.0\powershell.exe File Hash: b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9...
Follina_MSDT_CVE-2022-30190
Microsoft explains that “a remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker ca...
CVE-2025-55319-PoC
Reference: CVE-2025-55319 Proof-of-concept VS Code .vsix extension for the HTB "Checkpoint" challenge. Once installed, the extension auto-activates and spawns a hidden PowerShell reverse shell back to the attacker. ⚠️ Authorized use only. This is a CTF/lab artifact. Only deploy it against machines...
DriveLife-PsTrojan
DriveLife-PsTrojan TrojanDropper/PS.Maloader.d Introduction to the "DriveLife" Virus Since its emergence in 2018, the "DriveLife" virus has spawned multiple variants and continuously refined its techniques to evade detection and removal by security software. The virus exploits multiple high-risk...
CVE-2019-1619
CVE-2019-1619 Powershell Script to build the token needed for Authentication Bypass. I was in a pentest and found a server vulnerable to CVE-2019-1619. I couldn't leverage the metasploit module due to restricted access so I exploited it manually. I created this script to automate the building of...
CVE-2022-47966_checker
CVE-2022-47966checker Quick and dirty powershell script to look for ManageEngine CVE-2022-47966 IOCs. The script will parse requests in ME HTTP access logs. If a characteristic SAML request is found, it will attempt to decode and extract the attacker's payload. Findings are written to...