Archive | Windows Hacking

p0wnedShell – PowerShell Runspace Post Exploitation Toolkit

January 14, 2017 | 2,238 views 0

p0wnedShell is an offensive PowerShell Runspace Post Exploitation host application written in C# that does not rely on powershell.exe but runs PowerShell commands and functions within a PowerShell run space environment (.NET). It has a lot of offensive PowerShell modules and binaries included making the process of Post Exploitation easier. What the author tried was […]

Tags: p0wnedshell, powershell, powershell hacking, powershell hacking tool, powershell invoke shellcode, powershell offensive host application, powershell post-exploitation, windows privilege escalation, windows-security

Posted in: Exploits/Vulnerabilities, Hacking Tools, Windows Hacking | Add a Comment

nishang – PowerShell For Penetration Testing

October 18, 2016 | 2,862 views

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for penetration testing, offensive security and red teaming. Nishang is useful during all phases of penetration testing. Usage Import all the scripts in the current PowerShell session (PowerShell v3 onwards).

PS C:\nishang> Import-Module .\nishang.psm1

1	PS C:\nishang> Import-Module .\nishang.psm1

Use the individual scripts with dot sourcing.

PS C:\nishang> . C:\nishang\Gather\Get-Information.ps1

PS C:\nishang> Get-Information

PS C:\nishang> . C:\nishang\Gather\Get-Information.ps1

PS C:\nishang> Get-Information

To […]

Tags: nishang, powershell, powershell for pen testing, powershell for penetration testing, powershell hacking, powershell hacking tools, powershell security, Windows Hacking, windows-security

Posted in: Exploits/Vulnerabilities, Hacking Tools, Windows Hacking | Add a Comment

mimikittenz – Extract Plain-Text Passwords From Memory

September 30, 2016 | 5,544 views

mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory() in order to extract plain-text passwords from various target processes. The aim of mimikittenz is to provide user-level (non-admin privileged) sensitive data extraction in order to maximise post exploitation efforts and increase value of information gathered per target. NOTE: This tool is targeting […]

Tags: extract passwords from memory, mimikatz, mimikittenz, post exploitation, powershell, powershell post-exploitation, windows memory extractor, windows password extractor

Posted in: Exploits/Vulnerabilities, Hacking Tools, Windows Hacking | Add a Comment

PowerOPS – PowerShell Runspace Portable Post Exploitation Tool

August 20, 2016 | 4,606 views

PowerShell Runspace Portable Post Exploitation Tool aimed at making Penetration Testing with PowerShell “easier”. PowerOPS is an application written in C# that does not rely on powershell.exe but runs PowerShell commands and functions within a powershell runspace environment (.NET). It intends to include multiple offensive PowerShell modules to make the process of Post Exploitation easier. […]

Tags: post exploitation, post exploitation tool, powerops, powershell, powershell exploit, powershell post-exploitation, powershell runspace exploitation, Windows Hacking

Posted in: Exploits/Vulnerabilities, Hacking Tools, Windows Hacking | Add a Comment

Unicorn – PowerShell Downgrade Attack

June 11, 2016 | 3,446 views

Magic Unicorn is a simple tool for using a PowerShell downgrade attack to inject shellcode straight into memory. Based on Matthew Graeber’s PowerShell attacks and the PowerShell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18. Usage is simple, just run Magic Unicorn (ensure Metasploit is installed and in the right […]

Tags: david kennedy, defcon, josh kelly, Matthew Graeber, metasploit, powershell, powershell attack, powershell downgrade, powershell downgrade attack, powershell hacking, trustedsec, Windows Hacking

Posted in: Hacking Tools, Windows Hacking | Add a Comment

The Backdoor Factory (BDF) – Patch Binaries With Shellcode

May 16, 2016 | 3,493 views

The Backdoor Factory or BDF is a tool which enables you to patch binaries with shellcode and continue normal execution exactly as the executable binary would have in its’ pre-patched state. Some executables have built in protection, as such this tool will not work on all binaries. It is advisable that you test target binaries […]

Tags: backdoor factory, bdf, code caves, install shellcode in binary, patch binaries with shellcode, patch executable with shellcode, patch pe binary, patch shellcode to binary, shellcode, the backdoor factory

Posted in: Hacking Tools, Programming, Windows Hacking | Add a Comment

Gdog – Python Windows Backdoor With Gmail Command & Control

May 13, 2016 | 5,159 views

Gdog is a stealthy Python Windows backdoor that uses Gmail as a command and control server, it’s inspired by Gcat and pushes a little beyond a proof of concept with way more features. And don’t forget, Gcat also inspired Twittor – Backdoor Using Twitter For Command & Control. Features Encrypted transportation messages (AES) + SHA256 […]

Tags: backdoor, command and control, gdog, gmail c&c, gmail command and control, hacking-windows, Python, python backdoor, windows-backdoor

Posted in: Hacking Tools, Windows Hacking | Add a Comment

Empire – PowerShell Post-Exploitation Agent

April 30, 2016 | 3,389 views

Empire is a pure PowerShell post-exploitation agent built on cryptographically secure communications and a flexible architecture. Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework. It has a LOT […]

Tags: empire, empire powershell, hacking with powershell, powershell, powershell empire, powershell exploitation agent, powershell framework, powershell hacking, powershell post-exploitation

Posted in: Hacking Tools, Windows Hacking | Add a Comment

SamParser – Parse SAM Registry Hives With Python

April 23, 2016 | 2,209 views

SamParser is a Python script used to parse SAM registry hives for both users and groups, it’s only dependency is python-registry. This would be a great little script to write into another toolset or larger attack pattern, especially if you’re already using a Python kit or framework. Dependencies

pip install python-registry

1	pip install python-registry

Usage

python samparse.py <hive>

1	python samparse.py <hive>

Sample Output

----- Administrator -----
Comment : Built-in account for administering the computer/domain
Account Type : Default Admin User
RID : 500
Account Created Date : 13 May 2008 - 22:20:14
Last Login Date : 21 July 2008 - 01:22:18
Password Reset Date : 13 May 2008 - 22:23:39
Password Fail Date : Never
Account Flags : Password does not expire | Normal user account |
Failed Login Count : 0
Login Count : 24


----- Guest -----
Comment : Built-in account for guest access to the computer/domain
Account Type : Default Guest Acct
RID : 501
Account Created Date : 13 May 2008 - 22:20:14
Last Login Date : Never
Password Reset Date : Never
Password Fail Date : Never
Account Flags : Password does not expire | Account Disabled | Password not required | Normal user account |
Failed Login Count : 0
Login Count : 0

----- Administrators -----
Group Description : Administrators have complete and unrestricted access to the computer/domain
Last Write : 2008-05-14 05:35:35.281248
User Count : 7
Memebers : S-1-5-21-484763869-796845957-839522115-500
S-1-5-21-484763869-796845957-839522115-1003
S-1-5-21-484763869-796845957-839522115-1004
S-1-5-21-484763869-796845957-839522115-1005
S-1-5-21-484763869-796845957-839522115-1006
S-1-5-21-484763869-796845957-839522115-1007
S-1-5-21-484763869-796845957-839522115-1008

----- Users -----
Group Description : Users are prevented from making accidental or intentional system-wide changes.  Thus, Users can run certified applications, but not most legacy applications
Last Write : 2008-05-14 05:35:35.265625
User Count : 8
Memebers : S-1-5-4
S-1-5-11
S-1-5-21-484763869-796845957-839522115-1003
S-1-5-21-484763869-796845957-839522115-1004
S-1-5-21-484763869-796845957-839522115-1005
S-1-5-21-484763869-796845957-839522115-1006
S-1-5-21-484763869-796845957-839522115-1007
S-1-5-21-484763869-796845957-839522115-1008

----- Administrator -----

Comment : Built-in account for administering the computer/domain

Account Type : Default Admin User

RID : 500

Account Created Date : 13 May 2008 - 22:20:14

Last Login Date : 21 July 2008 - 01:22:18

Password Reset Date : 13 May 2008 - 22:23:39

Password Fail Date : Never

Account Flags : Password does not expire | Normal user account |

Failed Login Count : 0

----- Guest -----

Comment : Built-in account for guest access to the computer/domain

Account Type : Default Guest Acct

RID : 501

Account Created Date : 13 May 2008 - 22:20:14

Last Login Date : Never

Password Reset Date : Never

Password Fail Date : Never

Account Flags : Password does not expire | Account Disabled | Password not required | Normal user account |

Failed Login Count : 0

----- Administrators -----

Group Description : Administrators have complete and unrestricted access to the computer/domain

Last Write : 2008-05-14 05:35:35.281248

User Count : 7

Memebers : S-1-5-21-484763869-796845957-839522115-500

S-1-5-21-484763869-796845957-839522115-1003

S-1-5-21-484763869-796845957-839522115-1004

S-1-5-21-484763869-796845957-839522115-1005

S-1-5-21-484763869-796845957-839522115-1006

S-1-5-21-484763869-796845957-839522115-1007

S-1-5-21-484763869-796845957-839522115-1008

----- Users -----

Group Description : Users are prevented from making accidental or intentional system-wide changes. Thus, Users can run certified applications, but not most legacy applications

Last Write : 2008-05-14 05:35:35.265625

User Count : 8

Memebers : S-1-5-4

S-1-5-11

S-1-5-21-484763869-796845957-839522115-1003

S-1-5-21-484763869-796845957-839522115-1004

S-1-5-21-484763869-796845957-839522115-1005

S-1-5-21-484763869-796845957-839522115-1006

S-1-5-21-484763869-796845957-839522115-1007

S-1-5-21-484763869-796845957-839522115-1008

You […]

Tags: parse sam registry hive, parse sam with python, Python, python sam parser, sam parser, sam parsing, sam registry hive, windows sam parser, windows-security

Posted in: Password Cracking, Windows Hacking | Add a Comment

Apple Will Not Patch Windows QuickTime Vulnerabilities

April 20, 2016 | 778 views

Much like Adobe Flash, QuickTime from Apple is a bit of a relic some pretty serious, remote code execution type Windows QuickTime Vulnerabilities were recently discovered by Trend Micro. Apple has officially stated that they won’t be fixing them and the official line on this, is to uninstall QuickTime. I guess a lot of people […]

Tags: apple, apple quicktime, apple quicktime security, quicktime, quicktime exploit, quicktime security, quicktime vulnerability, windows quicktime, windows-security