IraqNoPhobia

This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector. Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.

All of the below examples had been generated for using as a remote address: 192.168.56.101.

List:

0. Page substiution macro for luring user to click Enable Content
1. The Unicorn Powershell based payload

IraqNoPhobia

using System;
using System.Text;
using System.IO;
using System.Diagnostics;
using System.ComponentModel;
using System.Linq;
using System.Net;
using System.Net.Sockets;

IraqNoPhobia

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

IraqNoPhobia

$assemblies=(
	"System"
)

$source=@"
using System;
using Microsoft.Win32;
using System.Diagnostics;

namespace Helloworld

IraqNoPhobia

wordlist created from original 41G stash via:

grep -rohP '(?<=:).*$' | uniq > breachcompilation.txt

Then, compressed with:

7z a breachcompilation.txt.7z breachcompilation.txt

Size:

IraqNoPhobia

### Keybase proof

I hereby claim:

  * I am iraqnophobia on github.
  * I am iraqnophobia (https://keybase.io/iraqnophobia) on keybase.
  * I have a public key ASB-29x0WuIjyZKiP-PRaTKWiWC7V0iMZUVgkXRnklbahQo

To claim this, I am signing this object:

IraqNoPhobia

##########
# Tweaked Win10 Initial Setup Script
# Primary Author: Disassembler <disassembler@dasm.cz>
# Modified by: alirobe <alirobe@alirobe.com> based on my personal preferences.
# Version: 2.20.2, 2018-09-14
# Primary Author Source: https://github.com/Disassembler0/Win10-Initial-Setup-Script
# Tweaked Source: https://gist.github.com/alirobe/7f3b34ad89a159e6daa1/
# Tweak difference:
#
#    @alirobe's version is a subset focused on safely disabling telemetry, some 'smart' features and 3rd party bloat ...

IraqNoPhobia

#!/bin/bash
#Hacked together by:  Nick Delewski / @r4ndom_handle / r@ndom.email
#Date:  28 December 2018
#Installs the newest kismet with all currently enabled RTLSDR goodness on a fresh Kali build.

cd /opt
apt -y remove kismet

#install rtl_433
git clone https://github.com/merbanan/rtl_433.git

IraqNoPhobia

// ==UserScript==
// @name           Auto Check-In to Southwest Flights
// @namespace      http://www.ryanizzo.com/southwest-auto-check-in/
// @version        1.7
// @author         Nicholas Buroojy (http://userscripts.org/users/83813)
// @contributor    Ryan Izzo (http://www.ryanizzo.com)
// @contributor    JR Hehnly (http://www.okstorms.com @stormchasing)
// @contributor    Trevor McClellan (github.com/trevormcclellan)
// @description    Automatically check in to Southwest Airline flights at the appropriate time.
// @include        https://www.southwest.com/air/check-in/index.html*

IraqNoPhobia

<#

.SYNOPSIS

    ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.

.DESCRIPTION

    ADRecon is a tool which extracts various artifacts (as highlighted below) out of an AD environment in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis.
    The report can provide a holistic picture of the current state of the target AD environment.