obscuresec

function Get-ADDNSRecords {
<#
update of dns-dump.ps1 by Michael B. Smith
michael at smithcons dot com
https://github.com/mmessano/PowerShell/blob/master/dns-dump.ps1
#>
Param(
	[string]$zone = "$env:USERDNSDOMAIN",
	[string]$dc = "$(($env:LOGONSERVER).trim('\'))"
)

obscuresec

$DirEntry = New-Object DirectoryServices.DirectoryEntry('LDAP://dc=demo,dc=lab',$user,$pass)
$AdsiSearcher = New-Object DirectoryServices.DirectorySearcher($ADSI,"(objectCategory=User)")
$AdsiSearcher.findall()

obscuresec

$Hso = New-Object Net.HttpListener
$Hso.Prefixes.Add("http://+:8000/")
$Hso.Start()
While ($Hso.IsListening) {
    $HC = $Hso.GetContext()
    $HRes = $HC.Response
    $HRes.Headers.Add("Content-Type","text/plain")
    $Buf = [Text.Encoding]::UTF8.GetBytes((GC (Join-Path $Pwd ($HC.Request).RawUrl)))
    $HRes.ContentLength64 = $Buf.Length
    $HRes.OutputStream.Write($Buf,0,$Buf.Length)

obscuresec

$LdapFilter = #Query Goes Here
([adsisearcher]"$LdapFilter").Findall()

obscuresec

([adsisearcher]"objectCategory=User").Findall() | ForEach {$_.properties.cn}

obscuresec

powershell.exe -com '([adsisearcher]'objectCategory=Computer').Findall() | ForEach {$_.properties.cn}'

obscuresec

(cmd /c echo {([adsisearcher]'objectCategory=Computer').Findall() | ForEach {$_.properties.cn}}).split(' ')[1]

obscuresec

powershell.exe -enc KABbAGEAZABzAGkAcwBlAGEAcgBjAGgAZQByAF0AJwBvAGIAagBlAGMAdABDAGEAdABlAGcAbwByAHkAPQBDAG8AbQBwAHUAdABlAHIAJwApAC4ARgBpAG4AZABhAGwAbAAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAgAHsAJABfAC4AcAByAG8AcABlAHIAdABpAGUAcwAuAGMAbgB9AA==

obscuresec

powershell.exe -com "((([adsisearcher]"objectCategory=User").Findall())[0].properties).PropertyNames"

obscuresec

#simple and dirty proxy
#usage: http://127.0.0.1:8000/?url=http://www.obscuresec.com
$Up = "http://+:8000/"
$Hso = New-Object Net.HttpListener
$Wco = New-Object Net.Webclient

#ignore self-signed/invalid ssl certs
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$True}

Foreach ($P in $Up) {$Hso.Prefixes.Add($P)}