w0rk3r's Windows Hacking Library

DiskShadow: The Return of VSS Evasion, Persistence, and Active Directory Database Extraction https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ @WindowsHackingLibrary

Bypassing Device Guard with .NET Assembly Compilation Methods http://www.exploit-monday.com/2017/07/bypassing-device-guard-with-dotnet-methods.html @WindowsHackingLibrary

Active Directory as a C2 (Command & Control) https://akijosberryblog.wordpress.com/2018/03/17/active-directory-as-a-c2-command-control @WindowsHackingLibrary

[Kernel Exploitation] 7: Arbitrary Overwrite (Win7 x86) https://www.abatchy.com/2018/01/kernel-exploitation-7 @WindowsHackingLibrary

Invoke-WMILM This is a PoC script for various methods to acheive authenticated remote code execution via WMI, without (at least directly) using the Win32_Process class. The type of technique is determined by the "Type" parameter. https://github.com/Cybereason/Invoke-WMILM/blob/master/README.md @WindowsHackingLibrary

Abusing DCOM For Yet Another Lateral Movement Technique https://bohops.com/2018/04/28/abusing-dcom-for-yet-another-lateral-movement-technique @WindowsHackingLibrary

Elevate, UAC bypass, persistence, privilege escalation, dll hijack techniques https://github.com/rootm0s/WinPwnage @WindowsHackingLibrary

15 Ways to Bypass the PowerShell Execution Policy https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ @WindowsHackingLibrary

Dumping Active Directory Domain Info – with PowerUpSQL! https://blog.netspi.com/dumping-active-directory-domain-info-with-powerupsql/ @WindowsHackingLibrary

Invoke-Phant0m This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running. https://artofpwn.com/phant0m-killing-windows-event-log.html https://github.com/hlldz/Invoke-Phant0m @WindowsHackingLibrary

NTLMv1 Multitool This tool modifies NTLMv1/NTLMv1-ESS/MSCHAPv2 hashes so they can be cracked with DES Mode 14000 in hashcat https://github.com/evilmog/ntlmv1-multi/ @WindowsHackingLibrary

NBNS Spoofing https://pentestlab.blog/2018/05/08/nbns-spoofing/ @WindowsHackingLibrary

This script will attempt to list and get TGTs for those users that have the property 'Do not require Kerberos preauthentication' set (UF_DONT_REQUIRE_PREAUTH). For those users with such configuration, a John The Ripper output will be generated so you can send it for cracking. https://github.com/CoreSecurity/impacket/commit/bada8a719f8ed7be4633514eea94bc768dbaf019 @WindowsHackingLibrary

Office365 ActiveSync Username Enumeration https://www.sec-1.com/blog/2017/office365-activesync-username-enumeration @WindowsHackingLibrary

Dumping Clear-Text Credentials https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/ @WindowsHackingLibrary

PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. You can also execute raw shellcode using the same approach. https://github.com/Mr-Un1k0d3r/PowerLessShell @WindowsHackingLibrary

Understanding and Evading Get-InjectedThread https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/ @WindowsHackingLibrary

Kerberoasting, exploiting unpatched systems – a day in the life of a Red Teamer http://niiconsulting.com/checkmate/2018/05/kerberoasting-exploiting-unpatched-systems-a-day-in-the-life-of-a-red-teamer/ @WindowsHackingLibrary

ADAPE - Active Directory Assessment and Privilege Escalation Script https://github.com/hausec/ADAPE-Script @WindowsHackingLibrary

How to bypass GPO Policy restriction for Powershell usage https://github.com/p3nt4/PowerShdll @WindowsHackingLibrary