Skip to content

Instantly share code, notes, and snippets.

View picheljitsu's full-sized avatar

Matt Pichelmayer picheljitsu

  • RED TEAM
View GitHub Profile
@picheljitsu
picheljitsu / Hero4BlackWifi.md
Created March 15, 2023 15:15 — forked from KonradIT/Hero4BlackWifi.md
Wifi hacking for HERO4 Black
@picheljitsu
picheljitsu / Get-LinuxProcesses.ps1
Last active August 3, 2018 13:10
Getting Linux Processes using PLink
function Get-LinuxProcesses {
<#
.NOTES
Plink Help File
Plink: command-line connection utility
Release 0.70
Usage: plink [options] [user@]host [command]
("host" can also be a PuTTY saved session name)
@picheljitsu
picheljitsu / Test-EventLogPasswords.ps1
Created July 10, 2018 21:14
Harvesting Eventlog passwords due to human-error
function Test-EventLogPasswords {
[CmdletBinding(DefaultParameterSetName='StartEnd')]
param([parameter( Mandatory=$false)]
[string]$ComputerName=$env:COMPUTERNAME,
[parameter( Mandatory=$false)]
[string]$Domain=(Get-WmiObject Win32_ComputerSystem).Domain,
#Known accounts to ignore or accounts that don't meet the domain's naming
function Get-DCOMSecurity{
<#
.SYNOPSIS
Enumerates and Maps DCOM Access and Launch ACL Settings
.DESCRIPTION
This script is used to enumerate security settings based on WMI information from the Win32_DCOMApplication,
@picheljitsu
picheljitsu / Get-RemoteMFT.ps1
Last active August 2, 2024 19:55
Powershell Diskless MFT Grabber
function Get-RemoteMFT {
<#
.SYNOPSIS
Extracts master file table from volume.
Version: 0.1
Author : Jesse Davis (@secabstraction)
@picheljitsu
picheljitsu / Parse-AuthLogs.ps1
Last active October 3, 2017 08:14
Parse Security Event Logs for Local, Remote and Network Logons
function Parse-AuthLogs{
<#
.SYNOPSIS
Parse Security Event Logs for Local, Remote and Network Logons
.DESCRIPTION
@picheljitsu
picheljitsu / Get-RecentFiles.ps1
Last active October 10, 2021 23:29
Parsing Forensic Recent Files
function Get-RecentFiles{
<#
.SYNOPSIS
Lists files in a user's Recent directory sorted by lastwritetime property.
.DESCRIPTION
The files returned in the specified user's Recent directory are .lnk files. Analyzing the
contents of the files will show what documents were accessed as Windows mantains a history