k0z4c k0z4c

How to play ASCII-Art Star Wars offline

Following will teach you how to play the "easter-egg" (which actually isn't, but many people describe this as an easter egg) of ASCII-Art Star Wars (or Star Wars in terminal/telnet, whatever), the one you normally starts like this:

$ telnet towel.blinkenlights.nl

Before you start, ensure Node.js is installed.
Navigate to www.asciimation.co.nz, the original home of that ASCII-Art Star Wars.
Press F12 to open developer tools.

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
`JAB`	🗣 Jabber	`$.`	Variable declaration (UTF-16), e.g. `JABlAG4AdgA` for `$env:`
`TVq`	📺 Television	`MZ`	MZ header
`SUVY`	🚙 SUV	`IEX`	PowerShell Invoke Expression
`SQBFAF`	🐣 Squab favorite	`I.E.`	PowerShell Invoke Expression (UTF-16)
`SQBuAH`	🐣 Squab uahhh	`I.n.`	PowerShell Invoke string (UTF-16) e.g. `Invoke-Mimikatz`
`PAA`	💪 "Pah!"	`<.`	Often used by Emotet (UTF-16)

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

What would you need:

Postgres 9.3, 9.4, 9.5, 9.6 or 10 with cstore_fdw extention (https://github.com/citusdata/cstore_fdw)
Docker 1.12.6 or higher
Docker Compose
Linux machine

Hardware requirements

	#!/usr/bin/env python

	# abuse cases and better implementation from the original discoverer: https://github.com/leechristensen/SpoolSample
	# some code from https://www.exploit-db.com/exploits/2879/

	import os
	import sys
	import argparse
	import binascii
	import ConfigParser

	#
	# TO-DO: set \|DESTINATIONURL\| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
	#
	# Note this version requires Apache 2.4+
	#
	# Save this file into something like /etc/apache2/redirect.rules.
	# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
	#
	# Include /etc/apache2/redirect.rules
	#

	typedef interface ICMLuaUtil ICMLuaUtil;

	typedef struct ICMLuaUtilVtbl {

	BEGIN_INTERFACE

	HRESULT(STDMETHODCALLTYPE *QueryInterface)(
	__RPC__in ICMLuaUtil * This,
	__RPC__in REFIID riid,
	_COM_Outptr_ void **ppvObject);

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

	//sample: 1554e74b935a61d446cb634f80d7d1e200e864bc
	//posted by @JohnLaTwC
	// Also see research by Sudeep Singh, Yin Hong Chang @ https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html

	----------------------------------------------- macro ----------------------------------

	Private Sub Workbook_Open()
	Call doom_Init
	Call doom_ShowHideSheets
	End Sub

	from scapy.all import *
	import unicodedata
	import sys, getopt
	import time, datetime
	import argparse
	import socket
	import fcntl
	import struct
	import threading