edermi

Keybase proof

I hereby claim:

• I am edermi on github.
• I am edermi (https://keybase.io/edermi) on keybase.
• I have a public key ASCW4hvy-ACn2JOQgRhz__YJFW6Y069muaOF5HF3GWeMEAo

To claim this, I am signing this object:

edermi

lfm.php
.idea/WebServers.xml
config/databases.yml
.git/config
.svn/entries
CVS/Root
server-status
core
sftp-config.json
WS_FTP.ini

edermi

#!/usr/bin/env python3

# For untrusted XML input, use a hardened parser, see https://docs.python.org/3/library/xml.html

import xml.etree.ElementTree as ET
import sqlite3
import argparse
import sys

edermi

##################################################
## PyDefenderCheck - Python implementation of DefenderCheck
##################################################
## Author: daddycocoaman
## Based on: https://github.com/matterpreter/DefenderCheck
##################################################


import argparse
import enum

edermi

<?php

function escapetext($text) {
    return str_replace("\n", "<br>", htmlentities($text));
}

function exec_command($cmd, $internal = false) {
    try {
        $shell_exec = shell_exec($cmd);
    } catch (Exception $e) {

edermi

package main

/*
Example Go program with multiple .NET Binaries embedded

This requires packr (https://github.com/gobuffalo/packr) and the utility. Install with:
	$ go get -u github.com/gobuffalo/packr/packr

Place all your EXEs are in a "binaries" folder

edermi

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

• Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
• Relaying that machine authentication to LDAPS for configuring RBCD
• RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

edermi

using System;
using System.DirectoryServices;

namespace SharpApprover
{
    class Program
    {

        public static void SetAdInfo(string objectFilter,
                int objectValue, string LdapDomain)

edermi

import sys

def main():
    with open(sys.argv[1], 'rb') as f:
        shellcode = f.read()
    hexlified = ['0x{:02X}'.format(b) for b in shellcode]
    with open(sys.argv[2], 'w') as f:
        f.write(','.join(hexlified))
    sys.stderr.write("Shellcode length: {}".format(len(shellcode)))

edermi

server:
    # log verbosity
    verbosity: 1

    use-syslog: yes

    interface: 127.0.0.1
    interface: ::1

    do-ip6: yes