ffcommax

## Web_Triks.txt
BurpJSLinkFinder

viewdns
ip histry


b dir

meg
dirsearch

## advisories.txt
https://www.checkpoint.com/advisories/
https://www.zerodayinitiative.com/advisories/published/

https://github.com/nomi-sec

## user_logon_logs.txt
how to get user logon logs
Get-EventLog -LogName security -InstanceId 4625 -After ((Get-Date).AddDays(-100)) | Select-Object -Property timegenerated, @{n="AccountName";e = {$.replacementstrings[5]}}, @{n="AccountDomain";e = {$.replacementstrings[6]}}, @{n="WorkstationName" ; e = {$_.replacementstrings[19]}} | export-csv c:\users\public\logs.csv

## Sharepoint.txt
https://github.com/H0j3n/EzpzSharepoint

## Simple_Port_scanner.ps1
1..255 | % { $a = $_; 135,389,3389,445,5986 | % {"10.0.61.$a";echo ((new-object Net.Sockets.TcpClient).Connect("10.0.61.$a",$_)) "Port $_ is open!"} 2>$null}

## Authenticated Remote Code Execution Methods in Windows.txt
1. Service Control Manager (SCM)
This method is used by psexec and all of its clones to start the executable that psexec creates.
Result:
A command to be run on demand and/or boot as SYSTEM (or less privileged accounts, but why would you do that?).
Example:
step 1/2; a new service can be created:
sc REMOTECOMPUTERNAME create myservicename binPath= executableToRun start= auto
alternatively, an existing service can be reconfigured:
sc REMOTECOMPUTERNAME config existingservice binPath= executableToRun start= auto
step 2/2; executableToRun will run on the remote system on boot as SYSTEM, or when instructed by:

## rdphistory.ps1
$LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
$Results = @()
$Events = Get-WinEvent -LogName $LogName
foreach ($Event in $Events) {
    $EventXml = [xml]$Event.ToXML()

    $ResultHash = @{
        Time        = $Event.TimeCreated.ToString()
        'Event ID'  = $Event.Id
        'Desc'      = ($Event.Message -split "`n")[0]

## EWS_Brut.py
#https://github.com/0x0021h/expbox
#!/usr/bin/python
import socket, time
import http.client as httplib
import requests
import urllib
import os, ssl

from requests_ntlm2 import HttpNtlmAuth
from urllib3.exceptions import InsecureRequestWarning

## Microsoft Office Product Spawning Windows Shell.yml
title: Microsoft Office Product Spawning Windows Shell
id: 438025f9-5856-4663-83f7-52f878a70a50
status: experimental
description: Detects a Windows command and scripting interpreter executable started from Microsoft Word, Excel, Powerpoint, Publisher and Visio
references:
    - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
    - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
tags:
    - attack.execution
    - attack.t1204          # an old one

## Pentest-Tools Good
https://github.com/S3cur3Th1sSh1t/Pentest-Tools
	https://www.checkpoint.com/advisories/
	https://www.zerodayinitiative.com/advisories/published/

	https://github.com/nomi-sec
	how to get user logon logs
	Get-EventLog -LogName security -InstanceId 4625 -After ((Get-Date).AddDays(-100)) \| Select-Object -Property timegenerated, @{n="AccountName";e = {$.replacementstrings[5]}}, @{n="AccountDomain";e = {$.replacementstrings[6]}}, @{n="WorkstationName" ; e = {$_.replacementstrings[19]}} \| export-csv c:\users\public\logs.csv
	1. Service Control Manager (SCM)
	This method is used by psexec and all of its clones to start the executable that psexec creates.
	Result:
	A command to be run on demand and/or boot as SYSTEM (or less privileged accounts, but why would you do that?).
	Example:
	step 1/2; a new service can be created:
	sc REMOTECOMPUTERNAME create myservicename binPath= executableToRun start= auto
	alternatively, an existing service can be reconfigured:
	sc REMOTECOMPUTERNAME config existingservice binPath= executableToRun start= auto
	step 2/2; executableToRun will run on the remote system on boot as SYSTEM, or when instructed by:
	$LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
	$Results = @()
	$Events = Get-WinEvent -LogName $LogName
	foreach ($Event in $Events) {
	$EventXml = [xml]$Event.ToXML()

	$ResultHash = @{
	Time = $Event.TimeCreated.ToString()
	'Event ID' = $Event.Id
	'Desc' = ($Event.Message -split "`n")[0]
	#https://github.com/0x0021h/expbox
	#!/usr/bin/python
	import socket, time
	import http.client as httplib
	import requests
	import urllib
	import os, ssl

	from requests_ntlm2 import HttpNtlmAuth
	from urllib3.exceptions import InsecureRequestWarning
	title: Microsoft Office Product Spawning Windows Shell
	id: 438025f9-5856-4663-83f7-52f878a70a50
	status: experimental
	description: Detects a Windows command and scripting interpreter executable started from Microsoft Word, Excel, Powerpoint, Publisher and Visio
	references:
	- https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
	- https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
	tags:
	- attack.execution
	- attack.t1204 # an old one