w0rk3r's Windows Hacking Library

Extracting User Password Data with Mimikatz DCSync https://blog.stealthbits.com/extracting-user-password-data-with-mimikatz-dcsync/ @WindowsHackingLibrary

Domain Access With Write Access on the Domain NC Head https://sdmsoftware.com/group-policy-blog/security-policy/elevating-ad-domain-access-with-write-access-on-the-domain-nc-head @WindowsHackingLibrary

https://github.com/Kevin-Robertson/Powermad/blob/master/README.md @WindowsHackingLibrary

Beyond LLMNR/NBNS Spoofing – Exploiting Active Directory-Integrated DNS https://blog.netspi.com/exploiting-adidns @WindowsHackingLibrary

Feature, not bug: DNSAdmin to DC compromise in one line https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83 @WindowsHackingLibrary

RE: Evading Autoruns PoCs on Windows 10 https://medium.com/@KyleHanslovan/re-evading-autoruns-pocs-on-windows-10-dd810d7e8a3f @WindowsHackingLibrary

A Guide to Attacking Domain Trusts http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ @WindowsHackingLibrary

Using a SCF File to gather Hashes https://1337red.wordpress.com/using-a-scf-file-to-gather-hashes/ @WindowsHackingLibrary

Powershell script to Enumerate executables with auto-elevation enabled, handy for privilege escalation purposes. https://gist.github.com/Evilcry/71e03a969689b8fd1297a1803aa4d7cf @WindowsHackingLibrary

What is it that Makes a Microsoft Executable a Microsoft Executable? An Attacker’s and a Defender’s Perspective https://posts.specterops.io/what-is-it-that-makes-a-microsoft-executable-a-microsoft-executable-b43ac612195e @WindowsHackingLibrary @BlueTeamLibrary

LethalHTA - A new lateral movement technique using DCOM and HTA https://codewhitesec.blogspot.com/2018/07/lethalhta.html @WindowsHackingLibrary

Red Team Tales 0x01: From MSSQL to RCE https://www.tarlogic.com/en/blog/red-team-tales-0x01 @WindowsHackingLibrary

Incapacitating Windows Defender http://www.offensiveops.io/tools/incapacitating-windows-defender/ @WindowsHackingLibrary

Spoof SSDP replies to phish for NTLM hashes on a network. Creates a fake UPNP device, tricking users into visiting a malicious phishing page. https://gitlab.com/initstring/evil-ssdp @WindowsHackingLibrary

Bypassing SQL Server Logon Trigger Restrictions https://blog.netspi.com/bypass-sql-logon-triggers/ @WindowsHackingLibrary

PSScriptAnalyzer is a static code checker for Windows PowerShell modules and scripts. PSScriptAnalyzer checks the quality of Windows PowerShell code by running a set of rules. The rules are based on PowerShell best practices identified by PowerShell Team and the community. It generates DiagnosticResults (errors and warnings) to inform users about potential code defects and suggests possible solutions for improvements. https://github.com/PowerShell/PSScriptAnalyzer @WindowsHackingLibrary

A multithreaded tool designed to identify if credentials are valid, invalid, or local admin valid credentials within a network at-scale via SMB, plus now with a user hunter https://github.com/Raikia/CredNinja @WindowsHackingLibrary

Inveigh is a PowerShell LLMNR/mDNS/NBNS spoofer and man-in-the-middle tool designed to assist penetration testers/red teamers that find themselves limited to a Windows system. https://github.com/Kevin-Robertson/Inveigh/blob/master/README.md @WindowsHackingLibrary

Disabling AMSI in JScript with One Simple Trick https://tyranidslair.blogspot.com/2018/06/disabling-amsi-in-jscript-with-one.html @WindowsHackingLibrary