Flangvik

PKI Abuse

Some golden links when you are having issues: https://social.technet.microsoft.com/Forums/windows/en-US/96016a13-9062-4842-b534-203d2f400cae/ca-certificate-request-error-quotdenied-by-policy-module-0x80094800quot-windows-server-2008?forum=winserversecurity

Enumerating ADCS On Linux

Download and install Certi

SMSAgentSoftware

[CmdletBinding()]
Param(
    [switch]$ListAllAvailable,
    [switch]$ExcludePreview,
    [switch]$ExcludeOutofBand
)
$ProgressPreference = 'SilentlyContinue'

Function Get-MyWindowsVersion {
    [CmdletBinding()]

IAmStoxe

Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\Blob_storage\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\cache\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\IndexedDB\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\databases\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\GPUCache\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\Local Storage\") -Recurse -Force
Remove-Item (Join-Path $env:APPDATA "\Microsoft\Teams\tmp\") -Recurse -Force

csandker

PS C:\Users\Clark.Kent\Desktop> ## Unconstrained Delegation
PS C:\Users\Clark.Kent\Desktop> ([adsisearcher]'(userAccountControl:1.2.840.113556.1.4.803:=524288)').FindAll()

Path                                                          Properties
----                                                          ----------
LDAP://CN=DC01,OU=Domain Controllers,DC=MonkeyIsland,DC=local {ridsetreferences, logoncount, codepage, objectcategor...
LDAP://CN=HTTPSvc,CN=Users,DC=MonkeyIsland,DC=local           {givenname, codepage, objectcategory, dscorepropagatio...


PS C:\Users\Clark.Kent\Desktop> ## Constrained Delegation

Neo23x0

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
JAB	🗣 Jabber	$.	Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq	📺 Television	MZ	MZ header
SUVY	🚙 SUV	IEX	PowerShell Invoke Expression
SQBFAF	🐣 Squab favorite	I.E.	PowerShell Invoke Expression (UTF-16)
SQBuAH	🐣 Squab uahhh	I.n.	PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA	💪 "Pah!"	<.	Often used by Emotet (UTF-16)

TarlogicSecurity

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Jaykul

Using Nerd Fonts in PowerShell

I've been recommending people use NerdFonts in their terminals for a while, but using the extra characters ends up being rather a pain. I have to look up characters in their web cheat-sheet, and then I either end up with a whole bunch of "$([char]0xf1ed)$([char]0xf00d)" in my profile scripts, which is impossible to read, or I have to translate the hex to decimal so I can type the ALT codes in my editor...

So today I fixed it, using PANSIES (the PowerShell ANSI Escape Sequences module).

PANSIES has &entities;

In PANSIES output (i.e. via the Write-Host, or by using New-Text in a string), you can embed named entities like in html. But unlike HTML, Pansies entities are extensible. So I wrote a little script to re-use the css names for the nerd-font characters and generate entities.

mdowst

Function Search-PSScripts{
<#
.SYNOPSIS
Use to search the text inside PowerShell scripts for a particular string

.PARAMETER SearchString
The string to search for inside the script file
    
.PARAMETER Path
The folder path to search for PowerShell files in. Default to userprofile if not specified.

wdormann

If (([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Warning "This script will not function with administrative privileges. Please run as a normal user."
    Break
}

$outfile = "acltestfile"
set-variable -name paths -value (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment' -Name PATH).path.Split(";")
Foreach ($path in $paths) {
    # This prints a table of ACLs
    # get-acl $path | %{ $_.Access  } | ft -Wrap -AutoSize -property IdentityReference, AccessControlType, FileSystemRights

kevinblumenfeld

Credit: Mark Kraus
Website: https://get-powershellblog.blogspot.com

Collection Type Guidence

When to use what

• Use Arrays if you know the element types and have a fixed length and/or known-up-front collection size that will not change.
• Use ArrayList if you have an unkown collection size with either unknown or mixed type elements.
• Use a Generic List when know the type of the elements but not the size of the collection.
• Use a HashTable if you are going to do key based lookups on a collection and don't know the object type of the elements.
• Use a Dictionary<TKey, TValue> you are going to do key based lookups on a collection and you know the type of the elements.
• Use a HashSet when you know the type of elements and just want unique values and quick lookups and assignmnets.